Introduction

This Privacy Policy explains what information Paxalia collects, why we collect it, how we use and share it, and the choices you have about your information. It applies to our website, desktop and mobile applications, and related services (collectively, the “Services”).

By using the Services, you agree to the practices described in this policy. If you do not agree, please do not use the Services. We respect your privacy and are committed to protecting your personal data.

What We Collect

We collect only the information necessary to provide and improve the Services:

  • Account information: When you create an account, we collect your username, email address, and a hashed password. We do not store passwords in plain text.
  • User content: We store the content you create in the app — notes, pages, goals, timelines, timings, summaries, events, alarms, and chat messages. This content belongs to you and is stored securely.
  • Workspace data: We store information about your workspaces, including workspace names, icons, colours, member lists, and member roles.
  • Timer data: We store timer sessions, including start times, stop times, durations, and associated timelines.
  • Usage and diagnostic data: We collect anonymised usage data to improve the app. This includes information about how you interact with the app, performance metrics, and crash reports. We do not sell or share this data.
  • Device information: We collect information about the devices you use to access the Services, including device type, operating system version, and IP address. This helps us optimise the app for different platforms and detect abuse.
  • Payment and billing information: When you purchase Pro features, we collect payment information through our third-party payment processors. We do not store credit card numbers or full payment details on our servers.

Public content: If you make a note or page public, the content becomes visible to anyone with the link. Public content may also appear in the Community Feed, visible to all Paxalia users. You can change the visibility of your content at any time.

How We Use Your Data

We use your data for the following purposes:

  • To provide and improve the Services: We use your data to authenticate you, sync your content across devices, deliver the features you use, and continuously improve the app based on usage patterns and feedback.
  • To display public content: If you make content public, we use your data to generate shareable links and display your content in the Community Feed.
  • To provide support: We use your data to respond to support requests, troubleshoot issues, and assist you with using the app.
  • To detect and prevent abuse: We use your data to monitor for suspicious activity, prevent fraud, and enforce our Terms of Service.
  • To send important messages: We send you essential service messages, such as security alerts, billing notifications, and product updates. You cannot opt out of essential messages.
  • For analytics and performance: We use anonymised data to understand how the app is used, identify performance bottlenecks, and prioritise improvements. We do not use individual data for analytics.
  • For marketing (with consent): With your consent, we may send you marketing emails about new features, events, and special offers. You can opt out at any time.

Cookies & Tracking

We use cookies and similar technologies to enhance your experience, analyse usage, and provide essential functionality:

  • Essential cookies: These cookies are necessary for the website to function. They enable user authentication, session management, and security features. Essential cookies do not require consent.
  • Analytics cookies: We use analytics cookies to understand how visitors interact with our website and apps. This data helps us improve the user experience. These cookies are only set with your consent.
  • Marketing cookies: We use marketing cookies to deliver relevant advertisements and measure campaign effectiveness. These cookies are only set with your consent.

You can manage your cookie preferences through your browser settings or through our cookie consent manager. Disabling certain cookies may affect the functionality of the Services.

For more details, see our Cookie Policy.

Sharing & Third Parties

We do not sell your personal data. We share your data only in the following circumstances:

  • Service providers: We share data with trusted third-party service providers who help us operate the Services, including hosting providers, payment processors, and analytics providers. These providers are contractually obligated to protect your data and use it only for the services they provide.
  • Public content: If you make content public, it may be viewed by anyone with the link and may appear in the Community Feed. You control the visibility of your content.
  • Legal requirements: We may disclose your data if required by law, such as to comply with a court order, subpoena, or other legal process.
  • Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

Data Security

We implement robust security measures to protect your data:

  • Encryption: All data is encrypted in transit using TLS 1.3. Passwords are hashed using bcrypt. Data at rest is encrypted using disk-level encryption.
  • Access control: Access to user data is strictly limited to authorised personnel. We follow the principle of least privilege, and all access is logged and audited.
  • API security: All API endpoints are protected by authentication and authorisation. User-generated HTML content is sanitized to prevent XSS attacks.
  • Infrastructure security: Our servers are hardened, patched regularly, and protected by firewalls and DDoS protection.
  • Regular testing: We conduct regular security reviews, vulnerability scans, and penetration tests to identify and fix issues.

While we take every reasonable precaution to protect your data, no system is completely secure. We encourage you to use strong, unique passwords and enable two-factor authentication to further protect your account.

Data Retention

We retain your personal data only as long as necessary to provide the Services or as required by law:

  • Account data: Your account data is retained while your account is active. If you delete your account, we will delete your data within 30 days, subject to our backup retention schedule.
  • Backups: Encrypted backups are retained for disaster recovery purposes for up to 30 days after deletion.
  • Logs: Access logs, error logs, and audit logs are retained for up to 90 days for security and debugging purposes.
  • Anonymised data: We may retain anonymised usage data for analytics and improvement purposes indefinitely. This data cannot be used to identify you.

You can request deletion of your data at any time by contacting us at [email protected].

Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

  • Right to access: You can request a copy of the personal data we hold about you.
  • Right to rectification: You can correct inaccurate or incomplete data.
  • Right to deletion: You can request that we delete your personal data (subject to our backup retention schedule).
  • Right to data portability: You can request a copy of your data in a machine-readable format.
  • Right to object: You can object to certain processing activities, such as direct marketing.
  • Right to withdraw consent: You can withdraw your consent at any time for processing based on consent.
  • Right to restrict processing: You can request that we restrict processing of your data in certain circumstances.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within the timeframe required by law. We may need to verify your identity before processing your request.

Children's Privacy

Our Services are not intended for children under the age of 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children. If we discover that we have inadvertently collected personal data from a child, we will delete it promptly.

If you believe we may have data from a child, please contact us at [email protected].

International Transfers

Paxalia operates globally. Your data may be processed in countries outside your country of residence, including countries that may have different data protection laws than your jurisdiction.

When we transfer data across borders, we rely on appropriate safeguards, including the use of standard contractual clauses approved by the European Commission. We ensure that your data is treated with the same care and protection regardless of where it is processed.

By using the Services, you consent to the transfer of your data as described in this policy.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. Material changes will be posted with a new "Last updated" date at the top of this page.

For registered users, we will provide notice of material changes via email or in-app notification. Continued use of the Services after the effective date constitutes acceptance of the updated policy.

Contact Us & Data Requests

For privacy questions, data subject access requests, or any other privacy-related matters, please contact us:

For security disclosures, please use [SECURITY] in the subject line. For general inquiries, please use the contact page.