Privacy policy

Who is responsible

DANIEL WĄTOR SOFT (Daniel Wątor) decides how the data described here is handled. The registered address and contact details are at the bottom of every page, and privacy questions go to [email protected].

What is collected

The categories below are written as categories on purpose, not as a record-by-record inventory. Each one covers everything of that kind that AskPugu keeps, so a new feature adds to a category instead of quietly falling outside a list that looks complete.

• Your account: your e-mail address, so that you can log in and so that we can send the account e-mails described below; your password, kept only as a hash, never as the password itself; and your confirmation that you are 18 or older, together with the moment you gave it, and (recorded the same way) the moment you accepted the terms of service when you signed up. If you sign up with Google, the name on your Google account is kept as your display name.
• Your agreements and consents: which version of the terms of service you accepted when you signed up, and every decision you make on the optional consent for sensitive information in chat (given or declined when you signed up, then given or withdrawn in Settings), each with the version of the wording you were shown and when you made it.
• What you tell us about yourself: the answers you choose to give while signing up, the preferences you set afterwards such as which Pugu you prefer and which model you default to, and a sign-up answer you left unfinished, which is your own text and is kept until it expires.
• Your conversations: the messages you send and the answers you receive, and whether you marked an answer helpful or not helpful. That mark is one of those two values. There is no free-text comment to leave.
• Your credit history and usage accounting: what was granted, what was spent, on which model, and the daily awareness limit if you set one. Alongside it there is one record per request to a model (which model and provider, whether it succeeded, how many tokens it used, what it cost and when), and that record carries none of the text of your message or of the answer.
• Your progress: your daily streak and the streak freezes you hold, every daily refill you have claimed, recurring goal completion marks with the goal code, period and completion time so active daily and weekly goals can show a truthful completed state, and the awards your collection is built from (achievements, streak milestones, Prompt Forge mastery, Pugu Vault artefacts and the seasonal mark), together with the capstone sets you have revealed, the records that make revealing one repeatable, and the Pugu accessory you have equipped. While a new recurring mark is being delivered, a content-free retry record briefly keeps only the kind of activity and when it happened.
• What you do in the Play features: your Prompt Forge rounds, including every attempt you make, the choices you pick and the full response each round produced; your practice in the Prompt Forge exercises: which variant of an exercise you were assigned, what you chose in it, how each attempt ended and which mastery marks you earned, without the text of the exercises themselves; your saved Play path: which of Signal Hunt, Concept Connect and Tone Mixer you completed and when each was first saved, kept until you delete your account; and the free reward draws and crafts that completing a round earns (no credit and no purchase can enter them), including how each draw was worked out, the counter that guarantees a rare reward eventually, and the model access you earn and spend.
• The goals board, if you switch it on: the fact that you opted in, and the public name you chose for it.
• E-mail reminders, if you switch them on: the fact that you switched them on, the record of which reminder step was sent to you and when, and a hash of the turn-off link each message carries, never the link itself.
• What you write to us, and what an operator does on your account: the e-mails you send to our address (questions, complaints, reports and requests about your data), together with our replies, kept in our mailbox; and the audit record of an action an operator takes on your account, such as removing a goals-board name, which names the case and the reason but never the removed name.

Signing in and account security

Keeping you signed in, and keeping other people out, needs records of its own. These are not cookies. AskPugu keeps one record per sign-in session (never the session value itself, only a hash of it), with when it began, when it expires, when it was last used, and whether it has been ended. A password reset link and an e-mail verification link are kept the same way, as a hash that can recognise the link we sent you but cannot reproduce it. Failed sign-in attempts are recorded with their time, so that an account can be slowed down and locked after repeated failures. If you sign in with Google, AskPugu keeps one record per linked Google account: which provider it is, the provider's identifier of your account, the e-mail address the provider asserted when it was linked, and when it was linked. You can see them under Settings and unlink any of them as long as another way to sign in remains, and they leave with your account when you delete it.

What is worked out rather than stored

Some of what you see has no record behind it. Your collection view is one: the artefacts you own and the accessories open to you are worked out each time the collection is shown, from the awards listed above, and those awards are stored. Your progress through the five lifetime goals is another: it is counted from your activity at the moment you look at it, and no lifetime goal is stored as a field of its own.

Your usage tier splits into two facts that are easy to confuse. The tier you are at is worked out from the credits you have spent on messages and is stored nowhere. The tier you were last shown a celebration for is stored, so that the same celebration is not repeated.

The goals board is the only place where anything about you is shown to other AskPugu users, and only while you have it switched on. They see the public name you chose and how many of the five lifetime goals you have completed, and nothing else. Your completed-lifetime-goal count and your position are worked out for each request; only the opt-in and the name are stored.

No date of birth is collected, there is no identity check, and no advertising profile is built. Your IP address, your browser's user agent, and any device fingerprint are not stored at all.

Why it is processed, and on what legal basis

Everything listed above is processed for one of the purposes below, and each purpose names its legal basis under the GDPR.

• To provide the service you signed up for: the account, the conversations, the credits and their history, the progress and Play features, the account e-mails you receive without asking, the record of which version of the terms you accepted, and the export and deletion you can run yourself. Legal basis: performance of the contract with you, article 6(1)(b).
• To answer you when you write about your health or other sensitive matters in chat, if you have given the optional consent for it. Condition: your explicit consent, article 9(2)(a). The section on sensitive information below explains it.
• To keep the accounting straight: the credit history, the per-request accounting and the purchase, refund and settlement records. Legal basis: our legal obligations under accounting and consumer law, article 6(1)(c), and for records the law does not itself require, our legitimate interest in being able to show what happened on an account, article 6(1)(f).
• To keep accounts and the service secure: session records, hashed links, failed sign-in attempts and the one-person-one-account rule. Legal basis: our legitimate interest in preventing abuse and protecting accounts, article 6(1)(f).
• To be able to restore the service after a failure: the encrypted backups of the whole database, described under how long things are kept. Legal basis: our legitimate interest in keeping the service and your data available and intact, article 6(1)(f), which is also how we meet the security duty of article 32.
• To support you and run the service: looking up the facts of your account when you ask us for help, handling what you write to us, and keeping the audit record of what an operator did on your account. Legal basis: our legitimate interest in running and supporting the service, article 6(1)(f).
• To meet our legal obligations: answering your requests about your data, your complaints and your reports of illegal content within the deadlines the law sets, and answering a public authority where the law requires it. Legal basis: legal obligation, article 6(1)(c).
• To see whether the product works: the measurement described below. Legal basis: our legitimate interest in improving the product, article 6(1)(f). You can object by switching product measurement off in Settings, under Privacy and account. Deleting your account also stops it.
• To show you on the goals board, or to send you e-mail reminders, if you switch either on: the public name you chose and your completed-goal count, shown to other users; and, for reminders, the reminder setting itself, the record of which step was sent, and the turn-off link each message carries. Legal basis: your consent, article 6(1)(a), which you withdraw by switching the board off, or reminders off.

Apart from the goals board, e-mail reminders and the optional consent for sensitive information in chat, we do not rely on consent for any of the above. Each of those three can be withdrawn at any time, as easily as it was given, and withdrawing does not make what happened before it unlawful. A purchase has one more checkbox (the request that we start the service before the 14-day withdrawal period ends, described on the refunds page), and it concerns the contract, not your data. Your confirmation that you are 18 or older is a condition of the contract, recorded so that we can show it was given.

An e-mail address and a password are necessary to hold an account; without them there is no contract. Everything else you can leave out.

What reaches the AI provider

To produce an answer, the provider of the model you chose receives your current message, a limited set of recent saved messages and answers from this chat, and the model identifier. When Pugu in Chat is enabled and a helper is needed, that bounded context and the answer may also go to one existing helper model to supply Pugu's reactions and a proposed next message, not a second answer. For an OpenAI answer, the helper is Anthropic Haiku; other supported helper routes use the same provider as the answer. We do not add your e-mail address or account identifier to these requests, or include other chats or memory from them. The text goes as written, so it can identify you if you include identifying facts.

Model providers are reached only from our own backend. No provider key and no provider call ever exists in your browser.

What each provider does with a message is set by the terms it publishes for business customers:

• OpenAI does not use it to train its models. We ask OpenAI not to store the answer; OpenAI still keeps an abuse-monitoring log of every request for up to 30 days.
• Anthropic does not use it to train its models. It deletes messages and answers within 30 days; if its safety systems flag a conversation, it may keep them for up to 2 years.
• Google does not use it to improve its products, under the terms that apply to customers in the European Economic Area. It logs messages and answers for a limited period, only to detect and prevent prohibited use and for disclosures the law requires.

Health and other sensitive information in chat

What you write in chat can include special categories of personal data: information about your health, your sex life, your beliefs, your origin and similar details. The GDPR allows us to process that information only with your explicit consent, article 9(2)(a), and that is the condition we rely on for it.

The consent is optional. You are asked for it once, in its own unticked box when you sign up (on the e-mail form, or on the screen that completes a sign-up with Google), and your account is created whether you tick it or not. Refusing it changes nothing about chat: the same models, the same limits, the same history, export and deletion. The only difference is that with the consent on you also see conversation ideas about health.

It covers the health and other sensitive information you choose to write in chat, and it is used for nothing but answering you, including the Pugu reactions and next-message proposals described above, and keeping your conversation history. The bounded context and answer reach the selected provider and any disclosed helper, including Anthropic Haiku for an OpenAI answer, as described under what reaches the AI provider. We replace message text 90 days after it was written, or straight away when you delete your account.

Please do not include sensitive information in chat without consent. We do not screen messages for sensitive information before sending them to providers.

To withdraw it, switch off “Allow sensitive information in chat” in Settings, under Privacy and account. One press withdraws it, with no confirmation and no delay, and you can give it again there at any time. After you withdraw it, we offer to delete the conversations that were active while it was on: you choose “Delete these conversations” or “Keep them”, and withdrawing alone deletes nothing. Withdrawing does not make what happened before it unlawful.

We keep a record of each decision (given, declined or withdrawn) with the version of the wording you saw and when, so that we can show what you agreed to. It is deleted with your account.

Who else receives data, and where it goes

Some companies process data for us, as our processors: they act on our behalf under the data processing terms they publish, and receive no more than the category named here.

• Model providers: OpenAI, Anthropic and Google. The selected model's provider receives your current message, a limited set of recent saved messages and answers from this chat, and the model identifier to produce the answer. When Pugu in Chat is enabled and a helper is needed, one existing helper may also receive that context and the answer to supply Pugu's reactions and a proposed next message, not a second answer. For an OpenAI answer this additional recipient is Anthropic Haiku; other supported helper routes use the same provider. All three are American companies, and AskPugu sets no limit on where they process a message.
• Hosting, backups and e-mail: OVHcloud, in the European Union: the servers and the database, the encrypted backups described below, and the mailbox every e-mail described below is sent from and every e-mail you send us arrives in.
• Network delivery and protection: Cloudflare, Inc., in the United States. Requests to asktalo.com and asktalo.pl, including their www and app addresses, pass through Cloudflare. It sees your IP address, the requested URL, headers, and request and reply content in transit, including chat messages, and processes connection logs for security under its data processing terms. Those terms limit retention to when it is needed to provide the service or the agreement ends, whichever comes first, subject to legal retention duties. Its network is global; we set no regional processing limit. Cloudflare is certified under the EU-U.S. Data Privacy Framework, with standard contractual clauses as a fallback for restricted transfers. It does not host our database, backups or mailboxes.

Others receive data as independent controllers, deciding for themselves how to handle it:

• The payment institutions the checkout uses, PayU S.A., Tpay (Krajowy Integrator Płatności S.A.) and Przelewy24 (PayPro S.A.): each is an independent controller of the payment data it collects on its own pages and under its own privacy policy. The next section describes what they receive and what we receive.
• Google, if you choose to sign in with Google: Google confirms who you are under its own terms and tells us your Google account identifier, your e-mail address and your name. We send Google nothing about you.
• Other AskPugu users, if you switch the goals board on: they see your public name and how many lifetime goals you have completed.
• A public authority, only where the law obliges us to disclose data to it.

Sending message text to a model provider established in the United States is a transfer of personal data outside the European Economic Area. For Google it rests on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which Google LLC is certified. OpenAI and Anthropic are not certified under that framework. Under the terms they publish, a business customer in the European Economic Area contracts with their Irish companies, OpenAI Ireland Ltd. and Anthropic Ireland, Limited, and those companies pass the data on outside the European Economic Area under the standard contractual clauses adopted by the European Commission.

Nobody else receives data about you. There are no advertising networks, no analytics vendors and no data brokers.

Payments

Payment happens on the payment institution's own page, not on ours. The institution collects what the chosen payment method needs as an independent controller and under its own privacy policy. To register the payment we send it the amount and currency, the order number, a description of the pack and the IP address the order was placed from, what registering a payment requires. We do not send it your e-mail address; if it needs one, it asks you on its own page. For a refund we send it the order, the amount and a refund reference. AskPugu never receives your card number or any other payment credential.

What AskPugu receives and keeps is a purchase record: which pack, the amount and currency, the provider's reference for the transaction, and the status of the payment, including any refund or chargeback. A purchase through our own checkout also keeps the version of the purchase agreement you accepted, the statements you ticked and when, and the order confirmation we sent you, without your e-mail address. These are accounting records: they are kept until 31 December of the sixth year after the year of the purchase, their amounts and identity are never changed and their status only ever moves forward. They survive account deletion attached to the same pseudonymised account row as your credit history, and so does the record that we owe you a refund if you delete an account that still holds unused paid credits.

The institution receives only what the payment needs, as listed above. It receives nothing about what you do inside AskPugu: not your conversations, not your credit history, and not your progress.

How long things are kept

Message text is replaced 90 days after the message was written. A conversation's title is replaced once that conversation has gone 90 days without activity, so a conversation you keep using keeps its title for longer. The structure around them (when it happened and what it cost) stays, because the accounting has to remain checkable.

Your account and what belongs to it are kept for as long as the account exists, unless a shorter period is given here. A session record is removed 90 days after it stops being usable, a failed sign-in attempt 90 days after it happened, a reminder turn-off link 180 days after it was issued, and an unfinished sign-up answer when it expires.

Recurring goal completion marks are kept for as long as your account remains active. A content-free delivery record is removed as soon as detection succeeds; if detection needs a retry, it remains only until that retry succeeds or the account is deleted.

Accounting, purchase, refund and settlement records and the audit record of operator actions are kept until 31 December of the sixth year after the year of the transaction they belong to: tax and accounting law requires the accounting, purchase, refund and settlement records, and the audit record is kept because a claim about those actions can be raised until then.

E-mails you send us and our replies are kept while the matter they concern is open. When it closes we delete the working copies and keep the case record itself for a period that depends on the kind of matter: a complaint until 31 December of the sixth year after the year it closed, so that we can still answer a claim arising from it; a report of illegal content and a request about your data for three years from closing, so that we can show how we handled it. The record of personal data breaches is one the law requires us to keep so that the supervisory authority can check how we handled them, and it names no end date, so we keep it for as long as we run the service. If a matter reopens, or an authority asks about it, we hold that one case back from deletion until it closes again. The server's technical log is kept for at most 14 days.

The measurement records described further down are written only while measurement is switched on; switching it off stops new ones rather than removing those already written. They are rotated rather than kept to a date: the log holds at most seven daily archives, with 20 MB per file and 100 MB total, and reaching that total can remove an older archive sooner. The hourly totals worked out from them carry no reference to anybody, and those totals we keep.

Encrypted backups are kept on a rolling schedule, so content can survive in a backup for up to roughly three months after it left the live database. If a backup is ever restored, our restore procedure applies every account deletion made since it was taken again before the restored copy serves anyone.

Deleting and exporting

You can delete your account yourself. Deletion overwrites the identity held on the account (it replaces the stored e-mail address, removes the display name and makes the stored password unusable), ends every session, and redacts your conversation content straight away rather than waiting for the 90 days.

You can also export your data yourself, as a file containing your profile, your wallet, your full credit history, the record of AI requests, your conversations, your collection, your recurring goal completion history, your progress through the Prompt Forge exercises, your saved Play path completions and their first-save times, which reactions you have already seen, and the sign-in providers linked to your account: for each linked provider, its name, the provider's identifier of your account, the e-mail address it asserted at linking, and when it was linked. Before the file is assembled, any pending content-free delivery record is applied to that completion history and is not exported as a separate record. Your wallet in that file means the balance and its unit: the daily awareness limit you may have set, and the tier you were last congratulated on, are not part of it. Your exercise progress means which exercise and which of its variants were assigned to you, what you chose in it, how each attempt ended, which mastery marks you earned, and when; the text of the exercises themselves is not in the file. Which reactions you have already seen means the name of each celebration or acknowledgement the app has shown you, how many times it has occurred and when it first did, so that the app can tell a first time from a repeat; none of what you wrote or received is part of it.

The file is a convenient copy, not everything we hold. It leaves out, among other things, your consent decisions and the version of the terms you accepted, your purchase, refund and settlement records, your goals-board name, your Prompt Forge rounds, your reward and draw records, your streak and daily refill records, your session and failed sign-in records, the reminder steps sent to you, and the audit record of operator actions. For those, write to us, as described under your rights.

Deletion does not erase every trace of the account, and it would be wrong to tell you otherwise. It is not anonymisation: the account row itself survives, because the records below are attached to it. The row no longer carries your e-mail address or your name, but it can still be connected to you from an encrypted backup taken before the deletion, for as long as that backup is kept, about three months, and, if you bought a pack, through the payment institution's own record of the transaction.

• On the account row itself: when the account was created, and the moments you confirmed you are 18 or older, accepted the terms of service and verified your e-mail address.
• Your wallet, your credit ledger and the per-request accounting attached to it, so that the accounting stays checkable.
• Your daily refill history and the streak milestones you earned, because each of them granted credits recorded in your ledger.
• The reward records: every draw and how it was worked out, the crafts you made, and the model access you earned and spent.
• If you bought a pack, your purchase, refund and settlement records, described under payments above, including the record that we owe you a refund for unused paid credits.
• The audit record of any action an operator took on your account.
• Nothing from the sign-in machinery: session records and the times of failed sign-in attempts are deleted with the account, and a scheduled job also clears them once they pass their retention period.

The accounting, purchase, refund, settlement and audit records are kept for the period given under how long things are kept. The reward records stay attached to the account row; the record of each reward draw is kept for the same period as the accounting records above.

The rest goes. Recurring goal completion marks are deleted outright, together with any pending content-free delivery records and alongside your streak and the days its freezes covered, the achievements you earned, the counter behind the reward draws, conversation content, your helpfulness marks, your Prompt Forge rounds, your Prompt Forge and Vault and seasonal awards, the capstone sets you had revealed, your goals-board profile, your linked Google sign-ins and the record of your consent decisions. Any password reset, verification or reminder turn-off link still outstanding is deleted with them, so a link sent before you deleted the account cannot be used afterwards.

E-mail

AskPugu sends two kinds of e-mail that you do not have to switch on: one to verify your address (unless you signed up with Google, which has verified it already) and one when you ask to reset your password. There is no newsletter, and nothing is sent for marketing to an account that has not asked for it.

A third kind is sent only if you ask for it. In Settings you can switch on invitations to learn and practise using AI with Pugu. Absence is measured from your last credit spend, daily-bonus claim or streak milestone, or from registration if you have none. With the new wording accepted, reminders arrive on exact absence days 1, 2, 3, 5, 7, 10, 14, 21, 30, 45, 60, 90, 120, 150 and 180: at most one a day and 15 per break, then silence until you return. A consent given to an earlier wording is not carried over: until you agree to the current wording in Settings, no reminders are sent. Each message offers an everyday practice idea, your selected Pugu appearance and a link to Today. It may also state your credit balance and an available welcome-back bonus. Nothing switches this on for you: the setting starts off, registering does not change it, and no reward, purchase or campaign can set it.

You can turn reminders off in Settings, or straight from a message: your mail programme's own unsubscribe turns them off in a single click, and the link inside the message opens a page with one button that does the same. Neither asks you to sign in. Reminders carry no tracking pixel, no open or click measurement, and no advertising. The only thing recorded is that a given step was sent once. Every reminder names who we are and how to reach us. Turning reminders off makes the links in messages you already received stop working, and deleting your account removes the setting, the links and the record of what was sent, together.

A purchase adds one more kind: the confirmation of your order and of the request you made at checkout, sent to your account's verified e-mail address. Nothing else is added. A purchase does not put you on any list.

Beyond these, a person at AskPugu writes to you only in reply to a message of yours, or to tell you about a decision on your account or your public name, as the terms describe.

Cookies and browser storage

The AskPugu application sets no cookie for reading alone, including on public pages and the sign-in screen. Cloudflare, which protects the connection, may use security cookies such as cf_clearance and run a browser security check, even before you sign in. These are separate from the application cookies below and are not advertising or audience measurement. The first time you send something, a cookie appears carrying a token that protects submissions against cross-site request forgery; it can do nothing else and it lasts until you close the browser. Signing in adds the session cookie, which cannot be read by scripts. It ends with the browser session unless you tick “Keep me signed in” when you log in with your e-mail and password, in which case it lasts up to 30 days and ends after 14 days without use. Signing out deletes it either way.

Signing in with Google adds one more, briefly. Your browser is handed a server session identifier that carries the sign-in request and its one-time security values to Google and back. It holds none of your account data, the server discards its contents the moment the sign-in finishes, and the cookie itself ends with the browser session.

One more thing is kept on your device, and only if you ask for it: when you pick a language yourself, AskPugu remembers that choice for the rest of this browser session, so that the next pages open in it. The entry is a single value that is either English or Polish. It holds nothing else (no identifier, no account, no record of what you did), and it is gone when you close the browser. If you have an account, the language you pick is saved to the account as well, and that is what follows you to another device.

That language entry is the only thing the AskPugu application keeps in browser storage. There are no advertising cookies or third-party analytics scripts. Cloudflare's security checks are the exception to our use of only our own scripts; we leave its optional bot and script-injection features off. AskPugu leaves nothing in this browser's local storage.

• Cloudflare security cookies and their lifetimes

Measurement

First-party measurement is enabled on the production service, and it records only the approved, fixed list of product events described below.

The software itself ships with measurement switched off, and local and test builds run with that default. That is a build-time default, not the state of the service you are using.

There is no third-party analytics tool in AskPugu, and nothing we measure leaves our own systems. The pages and screens you use send no measurement request of their own: what is measured is recorded by our server from the requests you make to use AskPugu.

What can be measured is a fixed list of product events: that something happened, plus a short set of allowed values describing it. The text of your conversations, your e-mail address, and your account identifier are never part of it, and the time is recorded only to the hour.

Some of those events carry no reference to anybody at all. The rest carry a short reference derived from your account with a secret key held only by us. It is not your account identifier and it cannot be turned back into you without that key. No cookie, no device fingerprint, no IP address and no browser identifier is involved.

What we keep in the database is narrower still, and it is not the whole stream: hourly counts for a fixed subset of e-mail verification events, and a per-hour coverage counter marking the hours that carried any activity. Other approved events remain only in the bounded rotating event log described above and are not copied into these tables; what the database keeps is a count for an hour, never a record per person. Those tables have no column for any user reference, so a question about one person cannot be asked of them.

We measure this to see whether the product reaches people and works for them. In Settings, under Privacy and account, switch off “Allow product measurement” to object without closing your account. Once the change is saved, new optional events about your account stop. You can switch it back on there. Necessary security, account and credit records continue; earlier measurement records follow the retention rules above. Deleting your account also stops new events about you.

Your rights

You can ask for a copy of your data, ask for it to be corrected, ask for it to be erased, or object to how it is handled. The export described above gives you a copy of what the file holds straight away, and the deletion erases what it can straight away, both without asking anyone; the records the file leaves out, and why and with whom your data is processed, you get by writing to us. Deletion keeps only the records listed above, which the law or a claim requires us to keep.

For anything else, write to [email protected]. We reply to the e-mail address of your account, which is how we know the request is yours, within one month; if a request is complex we may take two more months, and we tell you why within the first month. It costs nothing. You may also complain to the Polish data protection authority, the President of the Personal Data Protection Office.

Your preferences, the reminder setting, the goals-board name and the accessory you wear you can change yourself in the app; to correct your e-mail address, your display name or a sign-up answer, write to us.

You can also ask us to restrict processing while a question about it is settled, and you can take your data with you: the export described above is a machine-readable file of the data you gave us and the record of your use. Where processing rests on our legitimate interest (the records the law does not itself require, security, backups, support and measurement), you can object to it on grounds relating to your particular situation.

A consent can be withdrawn at any time: switch the goals board off, switch reminders off, or switch off “Allow sensitive information in chat”, each in Settings. Withdrawing does not make what happened before it unlawful.

No decision about you is made by automation alone. Where the refunds page says an account is routed to review, a person looks at it.

Changes to this policy

When what AskPugu records changes, this page changes with it, and the date below moves. Data is never quietly put to a new purpose: a new purpose means a new entry on this page before the processing starts.

On 18 September 2026 we corrected this page. It had overstated what deleting an account removes and promised that what remains could not be tied back to you; it had miscounted the companies that process data for us; it had said the payment institution receives your e-mail address, when it receives the IP address instead; and it had said purchase records are kept indefinitely. It had also left out three purposes we already had (backups, support and our legal obligations), the optional consent for sensitive information in chat, and what the AI providers keep.

On 18 October 2026 we added Cloudflare as the processor that delivers and protects connections to our public and application addresses. We describe what passes through its network, the transfer safeguards and the security cookies and browser checks it may use.

This version is dated 18 October 2026.