Privacy: what is stored, where and for how long

Where it is kept

Your clients, packs and sessions are kept in one Cloudflare D1 database that belongs to this site. Cloudflare chooses where the database lives; the region is not pinned, so it may be outside your country. The pages themselves are static files served by Cloudflare Pages.

What is stored for an owner

The owner is the coach who signs in.

• A random account id, the account name you chose for your passkey manager (or Sessionstub owner), and when the account was made.
• For each passkey: its public key, its id, a signature counter, the name you gave it and when it was added and last used. Never a fingerprint, a face or any biometric data: those stay on your device.
• A scrambled form (SHA-256) of your recovery code. The code itself is shown to you once and not kept.
• For each signed in device: a scrambled form of its session id, and when it was made, last used and when it expires (90 days after the last use, counted a day at a time).
• Your details as a coach: the name your clients see, your time zone, your Low mark and your expiry warning.
• Your email address, only if you add one, whether you have confirmed it, and a scrambled form of the confirmation link for 24 hours. It is the one place an email address is ever stored, and it is used only for the Monday email.
• Each Monday list, sent or shown, which names client labels and counts: kept 90 days, and a deleted client's label is taken out of it when you delete them. A record of each email sent is kept 30 days.

What is stored about your clients

• Each client: the label you typed, whether they are an adult or under 18, and when they were added, archived or deleted. No email address, phone number or account.
• Their link: a scrambled form (SHA-256) of its secret, plus a sealed copy that only this server can open with its own secret key, so you can copy the link again, and the scrambled forms of any links you replaced.
• Each pack: its label, size, start date, expiry rule and whether it is closed.
• Each session: its date, when it was logged, whether it was over the pack or after expiry, your note if you wrote one and whether you shared it, and the one-time key that stops a double tap counting twice.
• Your pack templates, if you save any.

Your client gets no cookie and gives nothing: opening their link stores nothing about them.

Limits on how fast requests come

To stop the server being flooded, it counts sign in steps per network address and writes per account in hourly buckets. The address is stored only as a keyed scramble that cannot be turned back into the address, and each bucket is deleted after 2 hours. Network addresses are never written to logs.

How long it is kept

• Your account, clients, packs and sessions: until you delete them.
• A removed session (the undo): kept out of every count, then deleted for good after 90 days.
• A deleted client, with their packs and sessions: 7 days, while you can restore them, then deleted for good. Their link stops working the moment you delete them.
• A deleted account and everything in it: 7 days, while you can sign in and cancel, then deleted for good.
• Sessions on a device: until 90 days after the last visit on that device, or until you sign out.
• Passkey sign in requests: 5 minutes. Rate limit buckets: 2 hours. Email records: 30 days.

What stays on your device

A tap that has not reached the server yet, and what you are typing into a new client's label, are kept in your browser's local storage under keys beginning with packcount until the server confirms them, so a dropped connection loses nothing. The secret part of a client's link sits after the # sign, which browsers do not send to any server in the address.

How to see and delete it

On your account page, Download everything gives one file with all of it, with no link secrets. Delete my account removes everything after the 7 days above; you can also remove single sessions, delete empty packs and delete single clients. Requests by email go to socialreminderinfo@gmail.com.

Cookies

One cookie, and only for owners who sign in: a session cookie that keeps you signed in. It cannot be read by page scripts and is never sent to another site. Clients who open their link get no cookie.

Page counts

Visits may be counted by Cloudflare's own page counter, which sets no cookie and records that a page was opened, never what you typed or a link's secret. There is no other analytics.

Payments

No paid plan is offered at present; if one is added, this page will describe it.

Email

Only owners can receive email: one confirmation link when you add an address, then the Monday email, and only once you have confirmed the address. Your clients are never emailed. Emails are sent through Resend and carry no tracking images.

Typeface

Headings and printed records are set in Bricolage Grotesque, under the SIL Open Font License 1.1, served from this site. The licence is at /fonts/OFL.txt. A printed record with Arabic, Hebrew, Greek or Cyrillic in a label also embeds Noto Sans (SIL Open Font License 1.1), loaded only when you print; emoji and other scripts are drawn by your own browser.

Changes and contact

If this policy changes in a way that affects what is stored, the change will appear on this page. Questions go to socialreminderinfo@gmail.com.