Privacy Policy

Sergey Kozyrev, Schulzenstraße 4, 68259 Mannheim, Germany. Email: sergey.al.kozyrev@gmail.com.

There is no designated data protection officer; the controller can be reached directly at the address above.

Without an account, everything you enter stays in your own browser's local storage. It is not transmitted to any server, and clearing your browser data deletes it.

If you create an account, your plan is stored in our database so it can follow you between devices. Access is restricted per user at database level: rows are readable and writable only by the account that owns them.

Purpose: providing the planning function you asked for. Legal basis: performance of a contract, Art. 6(1)(b) GDPR. Retention: until you delete the data or your account.

Sign-up and sign-in are handled through Supabase Auth. We process your email address, a hashed password (or, for Google sign-in, the account identifier and email returned by Google), and session tokens. Session tokens are kept in your browser so you stay signed in.

If you sign in with Google, Google receives the fact that you are authenticating with this site. Purpose: account access. Legal basis: Art. 6(1)(b) GDPR.

The following processors are actually used by the live site:

• Supabase — database, authentication and server storage for accounts, plan data and feedback messages.
• Lovable — hosting and content delivery for the website itself; server logs of requests (including IP address) are created as a technical necessity of delivering the site.
• Google Ireland Ltd. — Google Analytics 4, see below.

The production site loads Google Analytics 4 (measurement ID G-JXWF98DYET) to see how many people reach the site and which pages and steps they use. It runs in a cookieless configuration: Google Consent Mode is set to denied for analytics storage, ad storage, ad user data and ad personalisation, the tag's browser storage is switched off (client storage "none"), Google signals are disabled and ad data redaction is on. No Google Analytics cookie is written and no analytics identifier is kept on your device.

What is transmitted is limited to the event itself: page views and product milestones (for example that an example forecast was started), campaign parameters from the URL, and technical data your browser sends with any request, such as device type, referrer and the approximate location Google derives from the IP address. Analytics never receives your financial figures, balances, transaction names, feedback text or email address.

Because nothing is stored on or read from your device, no consent under § 25(1) TDDDG is required and no consent banner is shown. Legal basis for the processing itself: legitimate interest in basic reach and usage measurement, Art. 6(1)(f) GDPR; you can object at any time at the address above. Data may be transferred to the United States; Google relies on the EU Commission's adequacy decision and standard contractual clauses.

The site also keeps its own aggregate counters (for example how many times the landing page was viewed or an example was started), grouped by day, campaign, language, device class and traffic class. These are counters only: no visitor identifier, no IP address, no financial values and no personal data are stored with them, and individual visitors cannot be reconstructed from them.

Purpose: knowing whether the product works. Legal basis: legitimate interest in basic, non-identifying usage statistics, Art. 6(1)(f) GDPR.

If you send a message through the feedback box or the contact page, we store the message text, the page you sent it from, the interface language, your account identifier if you are signed in, and your email address if you chose to provide one. Messages can be read only by the operator.

Purpose: answering you and improving the product. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) where your message concerns your account. Retention: until the matter is settled and no longer needed, then deleted on request at the latest.

Strictly necessary: your session token and your own settings and, for guests, the plan itself — all stored locally in your browser so the product works at all.

Optional: none. No analytics cookie, no advertising cookie, no advertising pixel and no consent record are used, because no such choice has to be stored.

You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time with effect for the future. Write to the email address above.

You also have the right to lodge a complaint with a supervisory authority, for example the data protection authority of the German federal state of Baden-Württemberg.