Privacy Policy

Sergey Kozyrev, Schulzenstraße 4, 68259 Mannheim, Germany. Email: sergey.al.kozyrev@gmail.com.

There is no designated data protection officer; the controller can be reached directly at the address above.

Without an account, everything you enter stays in your own browser's local storage. It is not transmitted to any server, and clearing your browser data deletes it.

If you create an account, your plan is stored in our database so it can follow you between devices. Access is restricted per user at database level: rows are readable and writable only by the account that owns them.

Purpose: providing the planning function you asked for. Legal basis: performance of a contract, Art. 6(1)(b) GDPR. Retention: until you delete the data or your account.

Sign-up and sign-in are handled through Supabase Auth. We process your email address, a hashed password (or, for Google sign-in, the account identifier and email returned by Google), and session tokens. Session tokens are kept in your browser so you stay signed in.

If you sign in with Google, Google receives the fact that you are authenticating with this site. Purpose: account access. Legal basis: Art. 6(1)(b) GDPR.

The following processors are actually used by the live site:

• Supabase — database, authentication and server storage for accounts, plan data and feedback messages.
• Lovable — hosting and content delivery for the website itself; server logs of requests (including IP address) are created as a technical necessity of delivering the site.
• Google Ireland Ltd. — Google Analytics 4, see below.

The production site loads Google Analytics 4 (measurement ID G-JXWF98DYET) to understand how many people reach the site and which pages and steps they use. It sets its own cookies and identifiers, records page views and product milestone events (for example that an example forecast was started), and receives campaign parameters from the URL and technical data such as device type, approximate location derived from the IP address, and referrer.

Analytics never receives your financial figures, account balances, transaction names, feedback text or email address. For signed-in users an opaque identifier is passed so sessions can be joined; it is cleared on sign-out and cannot be resolved back to a person by us.

Advertising storage is switched off. Data may be transferred to the United States; Google relies on the EU Commission's adequacy decision and standard contractual clauses.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can change or withdraw your decision at any time in Settings, under the privacy and measurement section; withdrawal applies going forward.

The site also keeps its own aggregate counters (for example how many times the landing page was viewed or an example was started), grouped by day, campaign, language, device class and traffic class. These are counters only: no visitor identifier, no IP address, no financial values and no personal data are stored with them, and individual visitors cannot be reconstructed from them.

Purpose: knowing whether the product works. Legal basis: legitimate interest in basic, non-identifying usage statistics, Art. 6(1)(f) GDPR.

If you send a message through the feedback box or the contact page, we store the message text, the page you sent it from, the interface language, your account identifier if you are signed in, and your email address if you chose to provide one. Messages can be read only by the operator.

Purpose: answering you and improving the product. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) where your message concerns your account. Retention: until the matter is settled and no longer needed, then deleted on request at the latest.

Strictly necessary: your session token and your own settings and, for guests, the plan itself — all stored locally in your browser so the product works at all.

Optional: Google Analytics cookies and identifiers, only after your consent, which is itself recorded as a small local entry containing nothing but your choice and its date.

You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time with effect for the future. Write to the email address above.

You also have the right to lodge a complaint with a supervisory authority, for example the data protection authority of the German federal state of Baden-Württemberg.