Privacy policy

Without an account

All data stays in this browser and nothing is sent to the server. Clearing the site data in your browser deletes it. You can save it beforehand with Export in Settings.

What an account stores

Your email address and sign-in data. The password is kept by the Supabase sign-in service as a hash and cannot be read.

Goals: name, color, type, schedule, daily target, order and dates.

Timer sessions: start, end and a note if you wrote one. Day marks and plan changes for specific days.

If encryption is on, your data key in encrypted form. Only your password or recovery key can open it.

Encryption

With encryption on, goal names and notes are encrypted on your device before they are sent. Nobody can read them on the server, including the owner of the service.

Times, dates, colors and schedules are not encrypted: sync and statistics depend on them.

Without encryption, names and notes are stored as plain text, and the owner of the service can technically see them.

Sign in with Google

Google shares your email address, name and profile photo link. The app uses only the email address. It has no access to your mail, files, contacts or any other Google data.

Who processes the data

Supabase: the database and account sign-in.

Vercel: website hosting. Like any host, it keeps request logs with IP addresses and browser details.

Cloudflare Turnstile: the bot check at sign-in and sign-up, when it is enabled.

GitHub: daily database backups encrypted with a password. Each backup is kept for 30 days.

What we don't do

We don't sell or share your data. The app has no ads, analytics or trackers. Your sign-in is kept in the browser; there are no advertising cookies.

Deletion

Delete account on the account screen removes the account and all its data from the server right away. Backups drop it within 30 days.

You can download all your data as a file with Export in Settings.