Legal
Privacy Policy
Last updated 23 August 2026
The short version
We collect what the product needs to work, we do not sell it, and you can export or delete all of it yourself from Settings.
What we collect
- Account: your email address and a hashed password. We never store the password itself.
- Practice: the sessions you run, their patterns and durations, whether you completed them, and the mood you logged.
- Preferences: your goal, session length, and app settings.
- Billing: your plan, and a record of payments. Card details go to our payment provider and never reach our servers.
- Technical: IP address and coarse device type on security-relevant actions such as sign-in, used to spot abuse.
What we do with it
We use it to run your account, generate your stats and suggestions, take payment, keep the service secure, and answer you when you get in touch. We do not sell personal data and we do not run advertising.
Legal basis
Where the GDPR applies: we process your account and practice data to perform our contract with you, security data under our legitimate interest in protecting the service, and anything optional only with your consent.
Who else sees it
Only the processors we need: our hosting provider, our email provider for transactional messages such as verification and password resets, and our payment providers. Each handles data on our instructions. We disclose data to authorities only when legally required.
How long we keep it
Your data stays while your account is open. When you delete your account it is removed, and cascades to your sessions, moods and preferences. Payment records are kept as long as tax and accounting rules require.
Your rights
You can access, export, correct or delete your data. Export and delete are both self-service in Settings, and the export is a machine-readable file of everything we hold about you. Depending on where you live you may also object to processing or complain to your data protection authority.
Security
Passwords are hashed with PBKDF2. Sessions use signed tokens in cookies that scripts cannot read, and can be revoked from any device. Data is encrypted in transit. No system is perfect, and we will tell affected users promptly if a breach happens.
Cookies
We set one cookie, and it holds your session so you stay signed in. There are no advertising or third-party tracking cookies.
Contact
Privacy questions and requests go to the support address listed in your account settings.