Privacy Policy

Personal information you provide: We collect email addresses, usernames, passwords (stored as hashed values, never in plain text), contact preferences, and billing addresses. Payment card data is handled entirely by Lemon Squeezy and never stored by us.

Payment data: All payment data is handled and stored by Lemon Squeezy. Their privacy policy is available at https://www.lemonsqueezy.com/privacy.

Social login data: If you register using Google, we receive your email address and Google profile ID from Google. We do not receive your Google password.

Information automatically collected: We automatically collect log and usage data (IP address, browser type, pages visited, timestamps) and device data (device type, operating system, browser). This data does not reveal your specific identity and is used for security, analytics, and improving the Services. More details in our Cookie Policy.

We process your information to:

• Create and manage your account
• Deliver and improve the Services
• Process payments and manage subscriptions
• Respond to your inquiries and support requests
• Send administrative emails (account activity, payment receipts)
• Send product update emails, if you opted in
• Protect against fraud and abuse
• Comply with legal obligations
• Analyse usage trends to improve the product

Under GDPR, we rely on the following legal bases:

• Consent: When you opt in to marketing emails, we process your email on this basis. You can withdraw consent at any time.
• Performance of a contract: Processing necessary to provide the Services and manage your subscription.
• Legitimate interests: Analytics to improve the product, security monitoring, and fraud prevention.
• Legal obligation: Where we are required to retain or process data by law.

We share information only in the following circumstances:

• Lemon Squeezy: payment processing and subscription management
• Google: OAuth authentication (Google Sign-In)
• Resend: transactional and marketing email delivery
• Legal requirements: if required by law, court order, or governmental authority

We do not sell, rent, or trade your personal information to third parties.

We use a session token stored in browser local storage to keep you signed in. We use Umami Analytics, a privacy-first analytics tool that sets no cookies and collects no personal data. Full details are in our Cookie Policy.

If you choose to register or log in using Google, we receive certain profile information from Google, specifically your email address and a unique Google identifier. We use this only to create or authenticate your account. We do not receive your Google password. Google's use of your data is governed by Google's Privacy Policy.

Our servers are located in Spain. We also use Neon (database hosting, EU region), Lemon Squeezy (United States), Google (United States), and Resend (United States). When we transfer data outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses, which our third-party providers have agreed to.

We keep your personal information for as long as your account is active. When you delete your account, we anonymise your personal data immediately: your email, password hash, and social login identifiers are removed. We may retain anonymised usage data and financial transaction records for legal and accounting purposes.

We implement appropriate technical and organisational security measures including password hashing (bcrypt), HTTPS encryption in transit, and access controls. However, no system is 100% secure. If you become aware of any security issue, please contact us at [email protected].

We do not knowingly collect data from or market to children under 18 years of age. If you become aware that a minor has provided us with personal information, please contact us so we can delete it.

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your personal data ("right to erasure")
• Object to or restrict processing of your data
• Data portability (receive your data in a structured format)
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, visit your account settings or email [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (AP) at autoriteitpersoonsgegevens.nl.

Withdrawing marketing consent: You can unsubscribe from product update emails at any time using the unsubscribe link in any email we send, or by toggling the setting in your account.

Most browsers include a Do-Not-Track ("DNT") setting. We do not currently respond to DNT signals because no uniform standard has been adopted. Since we use Umami Analytics (cookieless, no personal data), there is no tracking to opt out of beyond what is described in this policy.

We may update this Privacy Policy from time to time. The updated version will be indicated by the "Last updated" date at the top. If we make material changes, we will notify you by email or by a prominent notice on the Site. We encourage you to review this policy periodically.

If you have questions or comments about this policy, email us at [email protected].

You can review and update your account information in your account settings. To delete your account and all associated personal data, go to account settings and select "Delete account and data." You can also email [email protected] to make a data subject access request.