Privacy Policy
Last updated: September 13, 2026
1. What We Collect
- Account data: email address, name, hashed password
- Content you create: goals, ideas, projects, tasks, notes, attachments, and other entities
- AI telemetry: query content processed by AI features, usage counts for quota management
- Technical logs: IP address and user agent for security audit purposes (retained 180 days)
2. Why We Process
- To provide the service (account, storage, AI features)
- To enforce plan quotas and prevent abuse
- To send transactional emails (verification, password reset, receipts)
We do not send marketing emails. We do not sell your data.
3. Third-Party Processors
- Paddle — payment processing (Paddle legal)
- Resend — transactional email delivery
- Cloudflare — CDN, DNS, and object storage
- DeepSeek — AI model inference (query content is processed to generate responses)
4. Data Retention
Your content is retained while your account is active. Deleted entities are soft-deleted then purged. Account deletion removes all data (see Section 5).
5. Your Rights (GDPR)
- Export: Download all your data (JSON + attachments) from Settings → Data Export
- Deletion: Delete your account and all associated data from Settings → Danger Zone
- Access/Rectification: Manage all content in-app
Only session cookies are used (essential). No analytics or advertising cookies.
6. Data Residency
Primary data is stored in EU region. Cloudflare CDN may cache globally.