← Back to home

Privacy Policy

Last updated: April 27, 2026

This privacy policy describes how [APP_NAME] ("we", "us", "the Service"), operated at procrastination.fans, collects, uses, stores, and protects your personal data. We take your privacy seriously and comply with the EU General Data Protection Regulation (GDPR) and applicable Spanish data protection law.

1. Data Controller

The data controller is the individual operator of procrastination.fans, contactable at support@procrastination.fans. If you have any questions about this policy or your data, please use this address.

2. What Data We Collect

Data type	When collected	Purpose
Email address	Registration	Account identification, login, transactional emails (verification, password reset)
Password (hashed)	Registration (email/password path)	Authentication. Stored as an Argon2id hash — we never store or see your plaintext password.
Google account profile (name, email, profile photo URL)	Google OAuth login	Account creation, display name, avatar
Google Calendar data (event titles, times, calendar list)	When you enable Google Calendar sync	Two-way calendar sync: displaying your existing events alongside your tasks, and creating calendar events for scheduled tasks. See Section 3 for details.
Tasks, sub-tasks, buckets, tags	Normal app usage	Core functionality — managing your tasks
Subscriptions (names, amounts, renewal dates)	Normal app usage	Subscription tracking and renewal reminders
Timezone and display preferences	Settings	Displaying dates and notifications at the correct local time
Telegram chat ID	When you link a Telegram account	Sending notifications via Telegram bot

We do not collect analytics, tracking data, advertising identifiers, or any data beyond what is listed above. We do not use cookies for tracking. The only cookies used are strictly necessary session cookies for keeping you logged in.

3. Google Calendar Data — Limited Use Disclosure

[APP_NAME]'s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We access Google Calendar data only to provide the calendar sync feature you explicitly enable in Settings.
• We read your calendar event data (titles, start/end times, calendar list) to display your existing events in the app's calendar view, so you can see busy/free slots alongside your tasks.
• We create, update, and delete Google Calendar events only when you explicitly schedule, reschedule, or complete a task in the app.
• We store a Google OAuth refresh token, encrypted at rest, solely to maintain the sync connection without requiring you to re-authenticate.
• We do not use Google Calendar data for advertising, market research, or any purpose unrelated to providing the Service.
• We do not share Google Calendar data with any third party.
• We do not allow humans to read your Google Calendar data unless you explicitly request support and provide access.

You can disconnect Google Calendar sync at any time from Settings. When you disconnect, we delete your stored Google refresh token and stop accessing your calendar data. Previously synced event references are removed from the app.

4. Legal Basis for Processing (GDPR)

• Consent — for Google Calendar data access (you explicitly grant this via the OAuth consent screen and can revoke it at any time).
• Contract performance — for account data, tasks, and subscriptions (processing is necessary to provide the Service you signed up for).
• Legitimate interest — for transactional emails (verification, password reset) and session cookies (necessary for the Service to function).

5. Where Your Data Is Stored

All data is stored on a self-hosted server located in Spain (European Union). Data does not leave the EU except when communicating with third-party services you choose to integrate (Google Calendar, Telegram), which are governed by their own privacy policies.

We use the following third-party services:

• Cloudflare — DNS, TLS termination, and DDoS protection. Cloudflare may process request metadata (IP addresses, headers) under their own privacy policy.
• Google APIs — for OAuth login and Calendar sync, only when you use these features.
• Resend (or equivalent) — for sending transactional emails (verification, password reset). Only your email address is shared with this provider.
• Telegram Bot API — only if you link your Telegram account.

6. Data Retention

• Your account and task data are retained for as long as your account exists.
• When you delete your account, all associated data (tasks, subscriptions, settings, tokens) is permanently deleted within 30 days.
• Backups that contain deleted data are rotated and overwritten within 90 days.

7. Your Rights (GDPR)

As an EU resident or user of an EU-based service, you have the right to:

• Access your personal data — request a copy of all data we hold about you.
• Rectify inaccurate data — correct any data that is wrong.
• Erase your data ("right to be forgotten") — request deletion of your account and all associated data.
• Export your data (portability) — receive your data in a machine-readable format.
• Restrict processing — ask us to stop processing your data while a concern is resolved.
• Object to processing — object to processing based on legitimate interest.
• Withdraw consent — revoke consent for Google Calendar access at any time via Settings or your Google Account permissions page.

To exercise any of these rights, email support@procrastination.fans. We will respond within 30 days.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD).

8. Security

We protect your data with:

• TLS encryption for all data in transit.
• Argon2id password hashing (passwords are never stored in plaintext).
• Encrypted storage of OAuth refresh tokens.
• Server-side session management with HTTP-only secure cookies.
• Regular security updates and dependency auditing.

9. Children

The Service is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe a child has created an account, please contact us and we will delete it.

10. Changes to This Policy

We may update this policy to reflect changes in the Service or legal requirements. Material changes will be communicated via the app or email. The "last updated" date at the top of this page indicates the most recent revision.

11. Contact

For any questions, concerns, or data requests:
support@procrastination.fans