Privacy
Controller
Not published yet. New accounts stay closed until the controller and their contact appear here.
What we keep
If you create an account: your email address, your password (Supabase stores it hashed; we can't see it) and the studies you save, with their title, notes and the figures they keep. If you write through the privacy form: your email, your name if you give it and your message. If you accept analytics: aggregated visit data (page, country, browser and device type), without cookies or IP.
Why, and on what basis
To give you access to your account, keep your studies, send account emails and answer your privacy requests; the basis is providing the service you ask for (GDPR article 6.1.b) and, for requests, a legal obligation (article 6.1.c). Analytics only runs with your consent (article 6.1.a) and tells us which parts of the site are used. We don't sell or share data and don't use it for advertising.
Who processes it for us
Supabase (database and accounts, servers in Paris), Vercel (website hosting and, if you accept it, usage analytics) and Resend (account emails and request notices, servers in Ireland).
For how long
Account data, for as long as you keep the account; you can delete it from “My account” and your access and all your studies are removed. Privacy requests, for as long as needed to answer them and show they were answered. Aggregated analytics are kept for up to 12 months.
Your rights
You can ask for access, correction, erasure, objection, restriction and portability through the privacy contact form. If you think a request wasn't handled, you can complain to the Spanish Data Protection Agency (aepd.es).
Cookies and storage
We use no third-party cookies. There is a session cookie when you sign in, and your browser keeps your light or dark theme and your analytics choice. Vercel analytics uses no cookies and only loads if you accept; you can withdraw it from “Analytics preferences” in the footer.