Privacy Policy

This Privacy Policy explains what data Stackt (the “Service”) collects, why, and your rights over it. It is written to align with the EU General Data Protection Regulation (GDPR).

1. Data controller

The data controller is Paul Marchiset. For any privacy request, contact stackt@paulmarchiset.me.

2. Data we collect

• Your email address — used to create your account and sign you in (one-time email code, or Google sign-in).
• Content you create — the projects, cards, versions/phases, dates and notes you enter. Please keep out of it anything listed in section 3 of the Terms of Use.
• Who you share with — for each project, the list of its members and their email addresses, plus any invitation you have sent and not yet had claimed. An invitation holds only the address it was sent to, and is deleted once claimed or expired.
• Your preferences — reminder settings, favourites, ordering, and how you have arranged your board.
• Technical data — essential session/authentication cookies required to keep you signed in. We do not use advertising or third-party tracking cookies, and we run no analytics.

3. Why we use it (legal bases)

• To provide the Service and your account — performance of our agreement with you.
• To let you share a project and to tell an invited person they have been invited — also performance of our agreement with you, and our legitimate interest in the Service being usable by more than one person.
• To send the daily reminder email — only if you switch it on, and only for the projects you pick.
• To secure the Service and prevent abuse — our legitimate interest.

If you were invited and have no account: we hold your email address because someone entered it to invite you, on the basis of our legitimate interest in delivering that invitation. The invitation email itself is how we inform you of this (Article 14 GDPR). We use the address for nothing else, it is deleted once the invitation is claimed or expires, and you can ask us to remove it immediately at stackt@paulmarchiset.me.

4. What other people can see

A project is private to its members. When you invite someone to one, they can read, add, edit and delete everything in that project, and they will see your email address; you will see theirs. Projects you have not shared remain visible to you alone. We have no way to control what a person you invited does with what they can see — deciding who to invite is yours to make.

5. Processors, and where data is stored

These are the only third parties that touch your data, and what each one gets:

• Supabase (Supabase, Inc.) — authentication and database hosting. Holds your account and all of your content. Stored in the European Union (Ireland).
• Vercel Inc. — serves the application. Handles requests; does not store your content.
• Brevo (Sendinblue SAS, France) — sends the reminder and invitation emails. Receives the recipient’s email address and the message itself.

Because email leaves our infrastructure and stays in an inbox for years, our emails are written to carry as little as possible. The daily reminder contains counts and dates only — never a task title, a project name or a version name. An invitation email names the person who invited you and nothing else — not the project. Brevo therefore never receives the contents of your boards.

These providers process data on our behalf under their own data-processing terms. No data is sold, mined, used to train models, or shared for marketing.

6. Retention

We keep your account and content for as long as your account is active. Deleting your account (from the settings page, or on request) removes your projects, cards, groups and preferences from the live Service promptly. Where a project you own has other members, the project itself survives and passes to the longest-standing member — your membership and your account are removed, their work is not. Residual copies are fully purged from backups within a maximum of 2 years, except where the law requires us to keep certain records. Unclaimed invitations expire on their own.

7. Security

Transport encryption, encryption at rest by our hosting providers, row-level access control in the database so a project is reachable only by its members, and a content security policy in the browser. The application source code is public under the GPL, so these claims can be inspected rather than trusted.

No service can promise it will never be breached. If a personal data breach occurs, we will notify the CNIL within 72 hours where the law requires it, and we will inform you directly, without undue delay, whenever the breach is likely to result in a high risk to your rights and freedoms (Articles 33 and 34 GDPR).

8. Your rights

Under the GDPR you have the right to:

• access the data we hold about you;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• export your data (portability);
• object to or restrict certain processing;
• withdraw consent at any time, where processing rests on it.

To exercise any of these, email stackt@paulmarchiset.me. You may also lodge a complaint with your data protection authority (in France, the CNIL — cnil.fr).

9. Changes

We may update this policy; the “Last updated” date above reflects the latest version.