Trust & Compliance

We audit other apps for GDPR compliance — so we hold ourselves to the same standard. Here is exactly how we handle your data.

EU data residency

All account and audit data is stored in the EU (Supabase, Frankfurt region). It never leaves the EEA without Standard Contractual Clauses in place.

Data is encrypted in transit with TLS and at rest with AES-256. Secrets are never exposed to the client.

Audit reports are automatically deleted after 30 days unless you explicitly choose to keep them — data minimisation by default (Art. 5(1)(e)).

Download every piece of data we hold about you as a JSON file, any time, from your My Data page (Art. 20).

Delete your account and we permanently erase all your data immediately — no soft-delete, no recovery (Art. 17).

Every export, deletion, and retention change is logged for accountability (Art. 5(2)).

We use a minimal set of GDPR-compliant providers, strictly to operate the service: