Core Privacy Rights

We recognize several core privacy rights for all individuals:

• The right to know what personal data we hold about you
• The right to access, correct, or delete your personal data
• The right to transfer your personal data (data portability)
• The right to set your individual marketing and advertising preferences

Where technically feasible and appropriate, we provide self-service mechanisms to allow you to exercise your privacy rights through your Account Settings. We also manually review requests to exercise privacy rights where self-service is not possible. If we need more information to process a request, we will contact you by email.

Personal Data We Collect

Personal Data You Provide

We collect personal data when you create an account, use our services, or contact us. This includes:

• Account information: email address, name (optional), birthday (optional)
• Profile information: job type (optional), commute time (optional)
• Task and productivity data: tasks, goals, descriptions, completion status, timestamps, weekly schedules, and routines
• Communication preferences: notification settings and reminder preferences
• Payment information: processed securely by Stripe (we store only subscription status and billing dates)

Personal Data We Collect Automatically

We collect certain data automatically when you visit our website and use our services, including:

• Device and browser information
• IP address and location data
• Service usage patterns and interaction data
• Session information through essential cookies

Personal Data We Generate

We process data in connection with our services to generate insights that may be linked to you, including through the use of AI and data analytics to improve task recommendations and productivity features.

Use of Personal Data

We use personal data to operate and improve our services, including:

• Managing customer accounts and authentication
• Providing task management and productivity features
• Processing subscription payments through our payment processor
• Delivering notifications and reminders you configure
• Providing customer support and responding to inquiries
• Securing, updating, and improving our services
• Detecting fraud and preventing unauthorized access
• Analyzing service usage to enhance user experience
• Communicating service updates and features (with your consent for marketing)
• Other uses consistent with the purposes for which the personal data was collected

No Sale of Personal Data

We do not sell, lease, rent, or transfer personal data to third parties for monetary or other consideration.

Disclosures to Others

We disclose personal data only in the following circumstances:

• Service Providers: To processors who operate our services, including Supabase (database hosting and authentication), Stripe (payment processing), and Anthropic (AI-powered task assistance, only when you use AI features)
• Legal Compliance: To comply with law enforcement and legal requests, protect our legal rights, prevent harm, and enforce our policies and contracts
• Business Transfers: If we sell some or all of our assets or merge with another company, we may transfer relevant personal data to the buyer or new entity

Data Security and Encryption

We use risk-based security measures to protect your personal data, including:

• Encryption at rest: All your tasks, goals, and descriptions are encrypted using AES-256-GCM encryption before storage
• Each user has their own unique encryption key
• Your encrypted data is protected even if our database infrastructure is compromised
• Secure transmission of data using industry-standard protocols
• Employee training on data protection and security practices
• Regular security audits and updates

Cookies and Online Identifiers

We use cookies and similar technologies on our website and in our services. Cookies are text files placed on your device that help us provide and improve our services.

Types of Cookies We Use

• Essential Cookies: Required for authentication, session management, and core service functionality. These cannot be disabled.
• Functional Cookies: Enable enhanced features and personalization based on your preferences
• Analytics Cookies: Help us understand how you use our services to improve performance and user experience

We do not use tracking or advertising cookies. You can manage your cookie preferences through our cookie consent banner when you first visit our site.

Storage and International Transfers

We store personal data on secure systems including trusted service providers such as Supabase and Amazon Web Services. Your data may be transferred internationally to operate our services. When we make international transfers, we ensure appropriate safeguards are in place to protect your data in accordance with applicable law.

Data Retention

We retain personal data for as long as necessary for our business needs and to comply with law. Factors we consider when deciding retention periods include:

• Whether you maintain an active account with us
• Whether we are required to retain personal data to comply with legal obligations
• Whether the personal data is needed for tax, accounting, or other business purposes

When you delete your account, all your personal data is permanently deleted within 30 days. If we no longer need personal data, we delete it or de-identify it so it no longer identifies you.

Your Privacy Rights

Depending on where you live, you may have additional privacy rights under applicable law. You have the right to:

• Access and review your personal data
• Correct inaccurate or incomplete data
• Delete your account and all associated data
• Export your data in a portable format
• Opt-out of marketing communications
• Object to certain processing activities
• Withdraw consent where processing is based on consent

To exercise these rights, please contact us at support@nocrast.app. We will respond to all requests within 30 days.

Legal Basis for Processing

We process personal data based on your request, with your consent, to fulfill our contracts with you, based on our legitimate interests in operating our business, or on other lawful bases. The specific basis depends on the services you use, the data being processed, and where you live. If you have questions about our basis for processing your personal data, please contact us at support@nocrast.app.

Children's Privacy

We do not knowingly collect personal data from anyone under 18 without permission from their legal guardian. Please contact us at support@nocrast.app if you believe we have collected information from a minor without appropriate permission.

Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

Changes to This Privacy Notice

We may revise this Global Privacy Notice from time to time. When we make changes, we will post the revised notice on this page and update the "Last Revised" date at the top. For significant changes, we will notify you via email or through a prominent notice in our service. Your continued use of our services after changes become effective constitutes acceptance of the revised notice.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Notice or our privacy practices, please contact us at:

Email: support@nocrast.app

We respond to all inquiries within 30 days.