Privacy Policy

We collect only what is necessary to provide the Service:

Account information

• Email address — used to identify your account and communicate with you.
• Name — displayed in the application if you choose to provide it.
• Password — stored after being salted and hashed. We never store or transmit your password in plain text.

Content you create

• Goals, sub-goals, and their details (title, description, SMART criteria, target dates, status).
• Work sessions linked to your goals (scheduled times, scores, notes).
• Notes (title, body, position, color, pinned status).
• Retrospectives (type, period, reflection text, productivity score).

Technical data

• Account creation timestamp.
• Standard server logs generated by our hosting provider (Vercel) including IP address and request metadata. These are retained for up to 30 days by Vercel and are not linked to your content.

We use your information solely to operate and improve the Service:

• To authenticate you and maintain your session.
• To store and retrieve your goals, notes, sessions, and retrospectives.
• To process payments and manage your subscription (when billing is active).
• To respond to support requests you initiate.
• To send essential service communications (e.g., billing receipts, security notices).
• To analyze anonymized usage data to improve the Service.

We use cookies as follows:

• Essential cookies for authentication and core functionality.
• Privacy-focused analytics with anonymized data.
• No third-party advertising cookies.

You can manage cookie preferences through your browser settings.

We do not sell, rent, or share your personal data with third parties for their own purposes. We share data only with the following infrastructure providers who process data on our behalf:

• Vercel, Inc. (hosting and serverless functions) — servers located in the United States. Privacy policy: vercel.com/legal/privacy-policy.
• Turso / ChiselStrike, Inc. (database) — data stored in AWS us-east-1 (Virginia, USA). Privacy policy: turso.tech/privacy.
• Stripe, Inc. (payment processing, when billing is active) — Stripe processes payment card data. We do not store card numbers. Privacy policy: stripe.com/privacy.

We may disclose your information if required to do so by law or in response to valid legal process (e.g., a court order or subpoena).

We retain your personal data for as long as your account is active. When you delete your account:

• All your goals, sessions, notes, and retrospectives are permanently deleted immediately.
• Your account record (email, name, hashed password) is permanently deleted immediately.
• Infrastructure-level backups may retain data for up to 30 days before automatic deletion.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy with an updated effective date. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.