Privacy Policy - PrimePace

1. Introduction

This Privacy Policy explains how PrimePace ("we", "us", or "our"), based in Warsaw, Poland, collects, uses, and protects your personal information when you use the PrimePace application and related services (the "Service").

For any privacy-related questions, you can reach us at support@timeflowapp.app.

2. What Data We Collect

Account data - your email address and name.
Profile information - optional details such as avatar, bio, and preferences you add.
Usage data - the content you create in the app (tasks, goals, notes, etc.) and basic activity needed to operate the Service.
Payment information - handled entirely by Stripe. Your card never reaches us: we hold no card number, no expiry date and no security code, not even the last four digits. What we keep is a record of each payment - the amount, the currency, the date and which plan it was for.
Wishlist reservations - if someone shares a wishlist with you and you reserve an item, the name you type and, briefly, the email address you give. See section 6.
Error reports - when something in the app fails, your browser sends us what broke: the message, the address of the page you were on, which stage of loading it happened at, and which release you were running. It is cleaned before it is sent and again when it arrives - email addresses are replaced with <address>, long keys with <token>, and anything after a ? in a web address is removed. It is capped in length and in how often it can be sent. We do not need you to be signed in for this, because the failure most worth hearing about is the one that stops the app starting at all. See section 8 for how long it is kept.
Your IP address - used to limit how often the same source can call our server, which is what keeps the app usable when somebody tries to flood it. It is never used to identify you or to sign you in, and it is not stored in our database.
The country your account was opened in - two letters, worked out by our hosting provider from the network your browser was connecting through at the moment you created the account. We keep the two letters; the address they came from is not stored, and the country is never looked at again after that first moment, so it does not follow you about. We use it to understand where PrimePace is being taken up.

3. How We Use Your Data

To provide, maintain, and improve the Service.
To process payments and manage subscriptions.
To send you essential service-related emails (e.g., account, billing, and security notices).
To send one confirmation message to anyone who reserves an item on a wishlist shared with them, containing the link that lets them change or cancel it.
To find out that something is broken, and to protect the Service from abuse.

4. Data Storage

Your data is stored securely in Supabase, hosted on servers located within the European Union. We apply appropriate technical and organizational measures to protect it against unauthorized access, loss, or misuse.

The app also keeps a copy of your data in your own browser, so that it opens without waiting and keeps working when your connection drops. That copy stays on the device you are using, belongs to your account, and cannot be read by any other website. We cannot read it either - it is never sent anywhere except back to your own account.

It is erased when you sign out. If you use a shared or public computer, signing out is what removes your data from it.

5. Third-Party Services

We rely on a small number of trusted providers to operate the Service:

Supabase - database and authentication.
Stripe - payment processing.
Cloudflare - hosting and content delivery.
Resend - transactional email delivery (e.g. account and trial notifications, and wishlist reservation confirmations).

Each provider processes data only as needed to deliver their function.

Nothing else is contacted. The typeface the pages are set in, and the two open-source libraries the app is built with, are served from this domain - so no other company sees the address your browser is connecting from, and no request leaves here before you have chosen to do anything.

When you add a link to a wishlist item, our own server - not your browser - visits that page to fetch its title and picture. The site you linked to therefore never sees who asked.

6. Shared Wishlists

A wishlist can be shared as a link. Anyone holding that link can open the list without an account and reserve an item, so that two people do not buy the same gift. If you do that, this is what happens to what you give us:

The name you type is stored with the item and shown to everyone else who opens the link, so they can see it is already taken. It is not shown to the person whose wishlist it is - they see only that the item is reserved.
Your email address is used once, to send you a link that lets you change or cancel your reservation from any device. It is not stored: we keep no record of it once that message has been sent, and we do not use it for anything else.
We also store a one-way fingerprint of a random secret. That secret is what proves a reservation is yours, and it exists only in the message we send you - it is never published on the page and cannot be recovered from what we store.

A reservation ends when you cancel it, or when the owner of the list stops sharing it, at which point the name and the fingerprint are deleted. Because we do not keep your email address, we cannot find you by it - to remove a reservation, use the link in the message we sent you, or write to support@timeflowapp.app.

7. Your GDPR Rights

If you are in the EU/EEA, you have the right to:

Access - request a copy of the personal data we hold about you.
Rectification - correct inaccurate or incomplete data.
Erasure - request deletion of your data ("right to be forgotten").
Portability - receive your data in a portable, machine-readable format.
Objection - object to certain processing of your data.
Restriction - request that we limit how we process your data.
Complaint - lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact support@timeflowapp.app.

8. Data Retention

We keep your personal data for as long as your account is active. If you delete your account, your associated data is permanently deleted within 30 days, except where we are required to retain certain records to comply with legal obligations.

One thing outlasts that deletion, and it is not your email address. When an account is erased we keep a one-way fingerprint of the address it used - a fixed string that the address produces but that cannot be turned back into it, made with a secret key we hold. It is used for one purpose only: so that the same address is not given a second free trial. It tells us nothing about who you are, and we cannot read an address out of it.

Wishlist reservations are not tied to an account. The name on a reservation is kept only while that reservation stands; the email address given to receive the confirmation is not retained at all.

Emails we owe you are written down before they are sent, so that one which fails is tried again rather than lost. Thirty days after a message has been delivered, the address it went to and the message itself are erased; what remains is a note that it was sent, which is what stops you receiving the same message twice. If your account is erased, its messages are deleted outright at the same time.

Error reports live in our hosting provider's log, which expires on its own. They are not kept in our database and are not linked to your account.

9. Cookies

PrimePace uses only what it needs to work: keeping you signed in, remembering the choices you make, and the copy of your own data described in section 4 - which is the largest part of it. There is no advertising, no analytics and no tracking of any kind. What is stored, and why, is set out in our Cookie Policy.

10. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@timeflowapp.app.

PrimePace - Warsaw, Poland