Privacy Policy | Penholder

This page explains what we know about you, why we need it, who helps us run Penholder, and what you can ask us to do. The short version: we keep what Penholder needs to work, we never sell anything, and there is no tracking.

1. Who looks after your data

ZOOMERS NETWORK LGTM S.R.L. (CUI 51548084) is responsible for your personal data in Penholder. For any question or request, write to privacy@penholder.app. Our full details are on the company details page.

2. What we keep

Your account: your name, your email address, an optional photo, and your password, which we never store as you typed it, only as a scrypt hash.
Signing in with Google: if you choose it, Google tells us your name and email address and confirms the address is yours. We never see your Google password.
Your team's work: teams, projects, topics, items, reasons, fields, flags, images and logos, and who is assigned to what.
History: who did what in a team, like moving an item or the line, so your team can see how the order came to be.
Invitations: the email address you invite, and who sent the invitation.
Your review: if you write one in your profile, we keep what you wrote, how many stars you gave, and whether you asked for your name to go with it. We publish some of them on the front page: with your name and picture if you ticked that box, and as "Someone on a small team" if you did not. You can change it or take it down in your profile, and it comes off the page at once.
Payments: for teams that pay, Stripe's customer and subscription IDs, the plan and when it renews. Your card details go straight to Stripe, and we never see them.
Technical details: to stop abuse, like guessing passwords or flooding Penholder with requests, we count requests per IP address for a short time in memory and never save them. Our hosting providers keep ordinary server logs, which include IP addresses, for a limited time.

When you upload a photo, we save a fresh copy of it, which also removes hidden details such as where it was taken.

3. Why we use it

To run Penholder for you: your account, your teams, signing in, the emails that confirm your address or reset your password, and invitations.
To send a weekly email about what is assigned to you and what is waiting in your teams. Every one has a link to stop it, and you can turn it off or back on in your profile.
To keep Penholder safe and working, with limits on repeated requests, logs and backups.
To take payments and keep the records the law asks a business to keep.

In GDPR terms, running Penholder is based on our agreement with you (Article 6(1)(b)), the weekly email and security on our legitimate interests (Article 6(1)(f)), and payment records on our legal obligations (Article 6(1)(c)).

We never sell your data, we do not show ads, and we do not use analytics or tracking.

4. Cookies and storage

Penholder only keeps what it needs to work, or what remembers a choice you made. None of it tracks you, so there is nothing to accept and no cookie banner.

session cookie: keeps you signed in. Scripts cannot read it, it only travels over HTTPS, and it lasts 30 days or until you sign out.
session1 to session4 cookies: the same thing for the other accounts you are signed in to in this browser, one per account, with the same 30 days.
verify cookie: set for 48 hours when you sign up, so the confirmation link opens in the browser that asked for it. Its path is the confirmation address and nothing else.
google_oauth cookie: only while you sign in with Google, to check that Google's answer belongs to your attempt. It lasts at most 10 minutes and is removed when you come back.
Cloudflare Turnstile: on the sign-in, sign-up and password pages only, Cloudflare's human check may set its own short-lived cookie for that check. It is there to keep bots out of your account, and it is gone from every other page.
Which account this tab uses: your browser's own storage remembers which of your signed-in accounts this tab belongs to, so two tabs can be two accounts.
Light or dark: your browser's own storage remembers the appearance you chose, so the page does not flash the wrong one while it loads.
Install reminder: your browser's own storage notes that you already saw the offer to install Penholder as an app, and when you chose Not now, so it does not keep asking.
Offline copy: your browser keeps the offline page, the stylesheet and the app icon, so Penholder can show something without a connection.
Last pages you saw: your browser's own storage keeps a copy of what your pages showed last, so they open instantly. Signing out clears it.
Notifications: if you turn them on for a device, your browser holds the subscription our server uses to reach it. Turning them off removes it.

There are no analytics, advertising or third party cookies. Even our font is served from penholder.app, so opening a page does not tell Google or anyone else that you were here.

5. Who helps us run Penholder

These companies handle data on our behalf, only so that Penholder works:

Cloudflare delivers the website and stores uploaded images and backups. When the sign-up or sign-in page shows a quick human check, that is Cloudflare Turnstile, which looks at signals from your browser for that one check.
FastAPI Cloud runs our application server, in the United States.
Supabase hosts our database, in the United States.
Brevo sends our emails, from the European Union.
Google confirms who you are, only if you choose to sign in with Google.
Stripe, and Link when it sells the plan, handle payments for teams that pay.

When data goes to the United States, it is protected by the EU-US Data Privacy Framework where the company is certified under it, or by the European Commission's Standard Contractual Clauses.

If you use Penholder for a company or a team, your company decides what goes in and we only carry it out. The Data Processing Agreement is the GDPR contract for that, and the sub-processors page is the same list with what each company receives and where.

6. How long we keep it

Your account and your team's work stay until you delete them. Deleting a team removes its projects, topics, items, images and history. The history of who did what is kept for the last 12 months; older entries are deleted every day. Deleting your account removes your profile, your photo and any team where you were the only member. In teams you shared, your past actions stay in the history, without your name.
Images are deleted from storage as soon as you remove or replace them, or delete what they belong to. The picture on a finished item is deleted 30 days after it was finished, once it no longer shows in the app.
Backups are made every day and deleted after 30 days, so something you delete can live on in a backup for up to 30 days.
Invitations that nobody accepts expire.
Payment records stay for as long as Romanian accounting law requires.
Server logs are kept for our hosting providers' usual period.

7. What you can ask for

You can ask to see your data, get a copy to take elsewhere, correct it, delete it, or limit how we use it. You can also object to the weekly email, or to anything else we do based on our legitimate interests. A lot of this you can do yourself: edit your profile, delete your account, or export a topic's items and history as CSV. For everything else, write to privacy@penholder.app from your account's email address, and we will reply within a month.

If you are unhappy with how we handled something, you can complain to the Romanian data protection authority, ANSPDCP, at dataprotection.ro, or to the authority in your own country.

8. Keeping it safe

Passwords are stored only as scrypt hashes, sessions are signed, everything travels over HTTPS, and any request that changes data needs a header other websites cannot send. No system is perfect, so if you spot a security problem, please tell us at support@penholder.app.

9. Children

Penholder is a tool for work and is not meant for anyone under 16.

10. Changes to this page

If we change something that matters, we will tell you by email or in the app before it takes effect.