Privacy Policy
Last updated: June 5, 2026
1. Information we collect
We collect: (a) account information you provide, such as your name, email, and password (stored hashed); (b) content you create in the Service, such as tasks, notes, books, and habits; (c) usage and device data, such as log data and approximate location derived from your IP address; and (d) billing information processed by Stripe — we do not store your full card details.
2. How we use information
We use your information to provide and maintain the Service, authenticate you, process payments, communicate with you about your account, provide support, improve the Service, and comply with legal obligations. We do not sell your personal data, and we do not use your content to train AI models.
3. Legal bases for processing
Where the GDPR or similar laws apply, we process personal data on the bases of performance of our contract with you, your consent (where requested), our legitimate interests in operating and improving the Service, and compliance with legal obligations.
4. How we share information
We share data with service providers who help us operate the Service, including Stripe (payments), AWS (hosting and transactional email via SES), MongoDB Atlas (database), and Google (optional sign-in). These providers process data on our behalf under appropriate agreements. We may also disclose data when required by law or to protect rights and safety.
5. Data retention
We retain your data for as long as your account is active or as needed to provide the Service. When you delete your account, we remove your personal data and content within a reasonable period, except where we must retain certain records to comply with legal, tax, or accounting obligations.
6. Your rights
Depending on your location, you may have rights to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. You can delete your account and content from Settings. To exercise other rights, contact us. You may also lodge a complaint with your local data-protection authority.
7. Security
We use reasonable technical and organizational measures to protect your data, including encryption in transit and hashed passwords. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
8. International transfers
Your data may be processed in countries other than where you live, including where our service providers operate. Where required, we rely on appropriate safeguards for such transfers.
9. Cookies and local storage
We use strictly necessary cookies and local storage to keep you signed in and remember preferences such as language and theme. We do not use advertising cookies.
10. Children's privacy
The Service is not directed to children under the age required for digital consent in their country, and we do not knowingly collect their personal data.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version and revise the "last updated" date, and provide additional notice for material changes.
12. Contact
For privacy questions or requests, contact us at [support@yourdomain.com].