Privacy policy

The data controller is the publisher of the Service, identified in the legal notice.

For any question about your data, write to the contact address given in that notice.

Account data: email address, first and last name if you provide them, profile picture from your Google account where applicable, language and time zone.

Content you create: projects, goals, steps, notes, tasks, tracked figures and imported files.

Data from the services you connect, with your explicit consent: calendar events; and for email, only message metadata (sender, recipients, subject, labels, date), never the body of the messages.

Files that you select yourself in your storage space, and those files only.

Billing data processed by our payment provider. No card details are kept by the Service.

Providing the Service and performing the contract: creating the account, breaking projects down, tracking progress, displaying your pages.

Managing subscriptions and payments, on the basis of performance of the contract and accounting obligations.

Sending you the messages the Service needs to send: progress reminders, alerts, weekly summary. Those that are not essential can be switched off in the settings.

Keeping the Service secure and working properly, on the basis of legitimate interest.

Breaking a project into steps, ranking your tasks and sorting your messages rely on automated processing provided by a third party, Anthropic PBC (United States).

The data sent is limited to what the requested gesture needs: the project statement and its context, or the metadata of the messages to be sorted. It is not used to train models.

This processing produces proposals. It makes no decision producing legal effects concerning you within the meaning of article 22 of the General Data Protection Regulation: you remain free to accept, change or ignore them.

No data is sold, rented or transferred to third parties for advertising purposes.

The Service relies on processors that access your data only as needed to provide their service: Supabase (database), Vercel (application hosting), Anthropic (automated processing), Stripe (payments), Resend (email delivery) and Google (calendar, email and files, if you connect those services).

Each of them is bound by a contract governing the security and confidentiality of the data entrusted to it.

Your data is not passed to any other recipient, except where required by law.

Application data is hosted in the European Union (region eu-west-1).

Some processors are established in the United States. The corresponding transfers are covered by the European Commission standard contractual clauses or by the EU to US Data Privacy Framework.

Account data and your content are kept for as long as your account exists.

When the account is deleted, they are erased. Data held by the payment provider is kept according to its own accounting obligations.

Notifications you have read are deleted automatically after 30 days. Unread ones are kept until they have been dealt with.

Technical logs needed for security and diagnosis are kept for a limited time by the hosting providers.

Every account is isolated at database level: an access rule enforced by the engine itself prevents a query from reaching another account's data.

Access tokens for the services you connect are encrypted before being stored.

Exchanges with the Service are encrypted in transit.

No card details pass through the Service: payment takes place on our provider's pages.

You have rights of access, rectification, erasure, restriction, objection and portability over your data.

Much of this can be exercised directly in the Service: editing your profile, correcting or deleting your content, disconnecting a third-party service, deleting your account.

For anything else, write to the contact address in the legal notice. You may also lodge a complaint with the CNIL (cnil.fr) if you believe your rights are not being respected.