Privacy Policy

This Privacy Policy explains how Prioritron ("Prioritron", "we", "us", or "our") collects, uses, stores, and protects information when you use our website at https://prioritron.dev and web application (the "Service"). By using the Service, you agree to the practices described here.

1. Information We Collect

Account information

• Name, email address, and profile photo, provided by you or by your chosen sign-in method (Email/Password, Google, or GitHub OAuth via Firebase Authentication and NextAuth).
• Account creation date, last login date, and login streaks.

Content you create

• Tasks (titles, descriptions, due dates, tags, and status).
• Notes (titles and content).
• Fitness data (workout sessions, exercises, sets/reps/weights, templates, and session notes).
• Nutrition data (logged foods, meals, barcode scans, and daily goals).
• Conversations with the AI assistant and its function results.

Usage & device information

• Activity logs of task interactions (created, completed, delayed, deleted) used to power your activity feed, streaks, and achievements.
• Analytics such as session duration, page views, and engagement metrics, used to understand and improve the Service.
• Device/browser information, IP-derived data, and push notification tokens (if you enable notifications on the installed PWA).

Payment information

If you subscribe to a paid plan, payment is processed by Stripe. We do not receive or store your full card details — Stripe handles that in accordance with its own privacy policy. We receive limited billing metadata (e.g., subscription status, plan, and renewal dates) needed to manage your account.

2. Encryption of Your Tasks & Notes

We take the privacy of the things you write seriously. The free-text content you type into tasks (title, description) and notes (title, content) is encrypted at rest using AES-256-GCM, an industry-standard authenticated encryption algorithm:

• Each value is encrypted with its own randomly generated initialization vector, so identical text never produces identical ciphertext, and an authentication tag that detects tampering.
• Data is encrypted before it is written to our database and decrypted only on the server, on demand, when you (or a process acting on your behalf) legitimately requests it.
• The encryption key is kept as a server-side secret and is never exposed to the browser or to third parties.
• This encryption currently covers task and note text content. It does not currently extend to workouts, nutrition logs, or other structured data, which remain protected by our authentication and database access-control rules described below, but are not individually encrypted at the field level.

3. How We Use Your Information

• To provide, operate, and maintain the Service and your account;
• To personalize your experience (e.g., streaks, achievements, and AI recommendations);
• To process payments and manage subscriptions through Stripe;
• To send you notifications you've opted into (task reminders, achievement alerts, and occasional product announcements);
• To analyze usage in aggregate so we can improve features and fix issues;
• To detect, prevent, and address fraud, abuse, or security issues;
• To comply with legal obligations.

4. How We Protect Your Data

• Firestore Security Rules: database rules ensure only you (an authenticated user matching the record'suserId) can read or write your own tasks, notes, workouts, and other records.
• Field-level encryption for task/note content, as described above.
• Encrypted sessions: authentication sessions use signed, encrypted JWTs stored in httpOnly cookies, so they can't be read or tampered with by client-side scripts.
• Security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and rate limiting to reduce common web attack surface.
• Least-privilege admin access: elevated, server-only database access is isolated to specific backend modules and never exposed to the client.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. We continuously work to improve our safeguards.

5. Who We Share Data With

We do not sell your personal information. We share data only with the service providers necessary to operate Prioritron, including:

• Firebase / Google Cloud — authentication, database (Firestore), and push notifications;
• Stripe — payment processing and subscription management;
• GitHub — OAuth sign-in, if you choose that option;
• AI providers (e.g., OpenAI, Anthropic, Google, and providers accessed via CrayonAI, ThesysAI, or OpenRouter) — only when you actively use the AI assistant, to process your prompt and generate a response;
• Analytics/infrastructure providers (e.g., Vercel) — for hosting, performance monitoring, and aggregate usage analytics.

These providers only receive the data necessary to perform their function and are bound by their own privacy and security obligations. We may also disclose information if required by law or to protect the rights, property, or safety of Prioritron, our users, or others.

6. Data Retention & Account Deletion

• We retain your data for as long as your account is active, so the Service can function as intended.
• Anonymous/guest accounts and all associated tasks, notes, notifications, workouts, and health data are automatically deleted after a short period of inactivity (currently three hours).
• You may request deletion of your account and associated data at any time by contacting us at ultrabrzitranzijent@gmail.com. We will delete or anonymize your data within a reasonable time, except where we must retain certain records for legal, billing, or security purposes.

7. Your Rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can access and edit most of your data directly within the app, or contact us to exercise these rights.

8. Cookies & Local Storage

We use essential cookies for authentication (httpOnly session cookies managed by NextAuth) and local/IndexedDB storage on your device to support offline functionality (e.g., caching your tasks so the app works without an internet connection). We do not use third-party advertising cookies.

9. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

10. International Data Transfers

Our service providers (such as Firebase/Google Cloud and Stripe) may process and store data in countries other than your own. By using the Service, you understand your information may be transferred to and processed in such locations, which may have different data protection laws than your jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in-app or by email.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at ultrabrzitranzijent@gmail.com.