Privacy Policy

Who we are

• StreakBoard is run by Mariusz Złotucha, a private individual, who is the controller of your personal data.
• Contact: mariusz.zlotucha@gmail.com
• There is no data protection officer.

What we collect

• Your account: your e-mail address, your nickname (2 to 24 characters, chosen by you and shown to the members of your group), a hash of your password kept by our sign-in provider, Supabase Auth (the app itself never stores your password), and when you signed up and last signed in. If you sign up from an invite link, the invite's code is kept with your account until your first visit to the dashboard, which joins you to the group, so the invite works even if you confirm your e-mail address in another browser.
• With "Continue with Google": the name, e-mail address and profile picture that Google shares. The app uses the e-mail address and proposes the name as your nickname; the profile picture is not used.
• Your sessions: for each signed-in session, the IP address and the browser you use (user agent), plus a security log of account events (such as sign-ins) with the IP address, kept by Supabase Auth.
• What you create: your group's name, task titles (free text, so please keep anything sensitive out of them), memberships, the tasks you join and the days or weeks you mark done.
• If you turn on reminders: for each device where you turn them on in Settings, the push address your browser gives us (a web address at your browser's push service) and two encryption keys, linked to your account. Nothing is stored for a device until you turn reminders on there.
• Technical data:
  • our own log entries: the route, your user id, a request id and the time;
  • error reports, which identify you only by your user id and never contain cookies, headers, request bodies or query strings;
  • our own log entries and error reports mask e-mail addresses and invite codes;
  • Cloudflare, which hosts the site, processes your IP address and request details to serve it, and its request logs record each address you request (an invite link contains its code) with request details such as your IP address.
• No analytics, no advertising and no tracking scripts.

Why we use it and on what legal basis

• To run your account and the group features (creating and joining a group, tasks, marking them done, streaks and the leaderboard) and to send the sign-up confirmation e-mail: performance of the contract, which is your use of StreakBoard (Art. 6(1)(b) GDPR).
• To send you evening reminders about tasks still to do: your consent, given by turning reminders on for a device in Settings (Art. 6(1)(a) GDPR). You can withdraw it at any time by turning them off on that device or on all your devices; this deletes the stored subscriptions.
• To keep the service secure and to find and fix errors (request logs, error reports, session data and the security log): our legitimate interest in a working and secure service (Art. 6(1)(f) GDPR).

Who can see your data

• The other members of your group see your nickname, the tasks you create and join, the days or weeks you mark done, your streaks and your place on the leaderboard. Each task shows its participants' recent days or weeks, so they can also tell roughly when you joined it. They do not see your e-mail address.
• Anyone signed in who has your group's invite link can see the group's name before joining.
• Nicknames and group names are unique across the app, whatever the capital letters: someone who picks a name that is already in use is told it is taken, but not whose it is.
• A group's owner can hand the group over to another member, who then manages it (renames it, removes members or deletes it); the former owner stays in the group as a member.
• When you leave a group, or its owner removes you, your participation and the days or weeks you marked done in its tasks are deleted and the group no longer shows your nickname. Tasks you created stay in the group.
• Nobody else sees your nickname or your e-mail address in the app; your e-mail address is shown only to you, on the settings page.

Service providers and transfers

• Cloudflare: hosting, the domain, DNS and request logs.
• Supabase: the database and sign-in. The database is in the EU (Ireland); the contracting party is Supabase Pte. Ltd. (Singapore), under Standard Contractual Clauses.
• Resend: sends the confirmation e-mail and keeps account data, e-mail metadata and logs in the United States.
• Sentry: error reports; it may process data in the United States.
• Google: acts under its own terms when you choose "Continue with Google".
• Your browser's push service (Google for Chrome and Android, Mozilla for Firefox, Apple for Safari and iPhone), only if you turn on reminders: it delivers each reminder to your device. The reminder is encrypted for your device, so the push service cannot read the task names in it.

Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

How long we keep it

• Your account, your nickname, your membership, your participation and the days or weeks you mark done, session data and the security log: until your account is deleted. Leaving a task, leaving the group or being removed from it deletes your participation in those tasks and every day or week you marked done in them.
• Your group and the tasks you create: until they are deleted. When you delete your account, they stay for the group's other members, if it has any (see "Deleting your account").
• A device's reminder subscription: until you turn reminders off on that device or on all your devices, until the push service reports it has expired, or until your account is deleted.
• Request logs, ours and Cloudflare's: up to 7 days.
• Error reports: up to 90 days (30 days on Sentry's free plan, 90 days while an organization trial runs).
• E-mail delivery logs: 30 days.
• Supabase platform logs: 1 day.
• Cookies: see the next section.

Cookies

StreakBoard sets only strictly necessary cookies:

• the session cookie (sb-…-auth-token, possibly split into numbered parts) keeps you signed in; it is removed when you sign out and otherwise lasts up to 400 days after it was last refreshed;
• a sign-in check cookie (sb-…-code-verifier) is used during e-mail sign-up and Google sign-in;
• join_code (7 days) remembers an invite until you sign in, which joins you to its group;
• auth_email (60 seconds) refills the e-mail field after a failed attempt.

We do not ask for consent, because none of these cookies is used for anything but the service you asked for.

If you choose "Not now" on the suggestion to install StreakBoard, your browser keeps a note of it on this device (in local storage, as streakboard.install-dismissed), so the suggestion stays hidden; clearing the site's data in your browser removes it.

StreakBoard also registers a service worker, a small script your browser keeps for this site, so the app can be installed on your device and, if you turn on reminders, receive and show them. It stores no pages, data or personal information on the device. Removing the app or clearing the site's data in your browser removes it.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing and to receive it in a portable form.

Right to object. You have the right to object at any time to the processing of your data based on our legitimate interests (Art. 21 GDPR).

You can withdraw your consent to reminders at any time by turning them off in Settings; this does not affect the reminders sent before.

You can delete your account yourself on the settings page (see "Deleting your account"). To use any of these rights, including erasure when you cannot sign in, write to mariusz.zlotucha@gmail.com and you get an answer within one month.

You can also complain to the Polish supervisory authority, the Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, by post or through the uodo.gov.pl website.

Deleting your account

• You can delete your account yourself with "Delete account" on the settings page. After you confirm, it is deleted right away, it cannot be restored, and you are signed out.
• Deleted with it: your account, your nickname, your group membership, your participation in tasks and the days or weeks you marked done, your sessions, your reminder subscriptions on every device, the ways you sign in (password or Google) and the security log entries that name you.
• Tasks you created stay in their group with the other members' participation and the days or weeks they marked done. They pass to the group's owner and no longer record you as their creator.
• If you own a group with other members, you choose one of them to take it over before your account is deleted. If you are its only member, the group is deleted with its tasks and the days or weeks marked done in it.
• If you cannot sign in any more, write to mariusz.zlotucha@gmail.com from your account's e-mail address, and your account is deleted the same way within one month.
• Request logs and error reports that contain your user id are not deleted with the account; they expire after the periods in "How long we keep it".
• Leaving a group keeps your account.

Do you have to give us your data

• An e-mail address is needed to create an account, and a nickname (2 to 24 characters) before you can use the dashboard; without them the service cannot work.
• There are no automated decisions with legal or similarly significant effects; the leaderboard only adds up streaks.

Changes

Changes to this policy are published on this page with a new date.