Privacy Policy

1. Data controller

Responsible for processing personal data in connection with WinitDay:
Mladen Grgic, [STREET AND NUMBER], [POSTAL CODE AND CITY], Austria
Email: kontakt@winitday.com

WinitDay is a privately operated online service, currently offered free of charge and without advertising.

2. What data we process

Depending on which features you use, we process the following categories of personal data:

• Account data: email address, name, password (stored only as a hash).
• Account and session events (e.g. sign-ins, password changes) for account management — see section 9.
• ToDos: title, description, due date, priority, subtasks, recurrence.
• Calendar: appointments, date/time, description, category, recurrence.
• Habits: self-created habits and daily check-ins.
• Goals: goal name, deadlines, notes, and milestones.
• Training: a simple weekly checklist with free-text entries you write yourself.
• Workflow/time log: morning and evening checklists, plus time-range and free-text entries about what you did when.
• Focus timer (Pomodoro): completed focus and break sessions, optionally a free-text label.
• Finance tracker: manually entered income, expenses, and labels. There is no bank connection and no access to bank accounts.
• Network/contacts: details you yourself enter about contact persons (e.g. name, lists, time of last contact) — see section 6 for what this means for your own obligations.
• Supplements: which supplements you take, dosage, frequency, time of day, and your own effect rating — see section 7, this is handled separately.
• Technical data required for security, troubleshooting, and operation.
• Product analytics events (page views, individual feature-usage events) — only if you explicitly enable this in Settings, see section 12.
• Data for managing a cookie/analytics consent.

3. Purposes and legal bases

We process personal data in order to:

• set up and manage your account;
• provide the features you use and associate your entries with your account;
• send verification and password-reset emails;
• secure the service, detect abuse, and fix technical errors;
• comply with legal obligations;
• statistically evaluate use of the public website, where you have consented.

Where processing is necessary to fulfil the usage contract, we rely on Art. 6(1)(b) GDPR. Security measures rely on our legitimate interest (Art. 6(1)(f) GDPR). Google Analytics, in-app product analytics (PostHog), and the separate Supplements consent each rely on explicit consent (Art. 6(1)(a) GDPR, and for Supplements additionally Art. 9(2)(a) GDPR).

4. Registration, consent, and age limit

When you register, we collect your email address, name, and a password (stored only as a hash). Email verification is required before your first login; password resets use time-limited, single-use tokens. Login itself is maintained via a technically necessary session cookie set by our authentication service (Better Auth) — see section 13 on cookies.

Registration requires you to confirm you are at least 16 years old (Art. 8 GDPR) and to explicitly agree to the Terms of Service and this Privacy Policy via a checkbox that is never pre-selected. Your date of birth is used only for this age check and is not stored afterward. We record the time and version of the terms you accepted as evidence of your consent.

5. Content within the app

Tasks, appointments, goals, habits, training entries, time logs, and other content you enter are processed to provide the respective features. The content of your account is not made available to other users and is not used for personalised advertising. Please do not enter unnecessary confidential information or personal data about other people in free-text fields, beyond what the Network feature described in section 6 is specifically for.

6. Network/contacts — data about third parties

The Network feature lets you store details about your own contacts (e.g. name, list, time of last contact). That is personal data about other, real people, not about you. Please only enter information you are entitled to store, and keep it to what you actually need — do not enter particularly sensitive data about third parties (e.g. health data) there. This data is not made available to other users and is not used for any other purpose.

7. Supplements — potentially health-related data

The Supplements feature stores which supplements you take, their dosage and frequency, and your own rating of their effect (e.g. “strong effect”, “side effects”). This may constitute health-related data under Art. 9 GDPR. This feature is entirely optional — the rest of WinitDay works without it. Before first use, we obtain your separate, explicit consent for it (Art. 9(2)(a) GDPR), distinct from the general agreement at registration. You can withdraw this consent at any time with future effect by deleting your account or contacting us; we delete already-stored entries on request.

8. Hosting and service providers used

The following services are used to operate WinitDay:

• Vercel Inc. (USA): hosting and delivery of the frontend.
• Render Services, Inc. (USA): hosting of the backend API service.
• Neon, Inc.: operation of the PostgreSQL database. The database is currently operated from a data centre in Frankfurt am Main, Germany (EU).
• Resend (USA): sending verification and password-reset emails. No newsletters or marketing emails are sent.
• Better Auth Dashboard (dash.better-auth.com): the management interface for user accounts — see section 9.
• PostHog: only if you enable in-app product analytics in Settings (see section 12) — operated via PostHog’s EU region, where we have configured that region.

Vercel, Render, and Resend may process data outside the EU/EEA, in particular in the USA. Where that is the case, we rely on appropriate safeguards, in particular the respective providers’ EU Standard Contractual Clauses. Data processing agreements under Art. 28 GDPR are reviewed and concluded with all providers where they process personal data on our behalf.

9. Better Auth Dashboard (account management)

For managing user accounts, we use the dashboard provided by Better Auth (dash.better-auth.com), the service our self-hosted authentication system runs on. Account and session events — such as registrations, sign-ins, session creation, and password changes — are sent there, including the associated email address, but not the content you enter inside the app itself (ToDos, Calendar, Finance Tracker, etc.). This processing is necessary for secure operation and management of user accounts and relies on our legitimate interest or performance of the usage contract (Art. 6(1)(b), (f) GDPR), not on separate consent.

10. Server logs

When you visit this website, our hosting providers automatically collect technical information (e.g. IP address, time of access, page requested) to ensure secure operation (Art. 6(1)(f) GDPR).

11. Google Analytics

Only on WinitDay’s public marketing and legal pages (not inside the logged-in app) do we use Google Analytics 4 (Google Ireland Limited) to statistically evaluate use of those pages. Google Analytics only becomes active once you explicitly consent via the cookie banner (Google Consent Mode v2, default “denied”). Rejection and consent are equally easy to access. With consent granted, data may be transmitted to Google servers, including in the USA. You can withdraw your consent at any time via the “Cookie settings” link in the footer.

12. In-app product analytics (PostHog)

Inside the logged-in app (not just the public pages), you can optionally enable usage analytics via PostHog — either through its own, never pre-checked checkbox at registration, separate from agreeing to the Terms of Service, or at any later point via a toggle in account settings. It is off by default — nothing is transmitted until you give that consent at either of those two places. There is no cookie banner inside the app; this consent is the equivalent explicit consent (Art. 6(1)(a) GDPR).

Only page views and individual, deliberately defined feature-usage events are collected, linked to a random account ID (never your email address or name). Automatic capture of every click and form input (“autocapture”) and screen recordings (“session recording”) are technically disabled — the content you enter in ToDos, Calendar, Finance Tracker, Supplements, or any other feature is never captured this way. You can withdraw consent at any time via the same toggle; nothing is transmitted afterward.

13. Cookies and local storage

Inside the logged-in app, our authentication service (Better Auth) sets a technically necessary session cookie (HttpOnly) to keep you logged in. This is strictly required for login to function and therefore does not require separate consent (the technically-necessary-cookie exemption under Art. 5(3) of the ePrivacy Directive). No other cookies are set inside the logged-in app. The public marketing pages set analytics cookies, after consent (see section 11); the in-app product-analytics choice (section 12) is stored by PostHog itself, also in your browser, not as a cookie.

14. Fonts

The Inter typeface is downloaded at build time via Next.js and served from our own infrastructure. No font file is requested directly from Google servers when you visit the website.

15. Retention period and account deletion

We store personal data only as long as necessary for the respective purpose or as required by statutory retention obligations. You can permanently delete your account at any time via account settings. Doing so removes all data linked to your account across every feature area of WinitDay, not just the account itself. Technically necessary backup cycles may delay immediate removal from all backups; expired backups are automatically overwritten after the defined rotation period.

16. Your rights

Subject to the statutory requirements, you have in particular the right to:

• access the personal data processed about you;
• rectify inaccurate data;
• erase personal data;
• restrict processing;
• data portability, where applicable;
• object to certain processing;
• withdraw any consent with future effect.

Contact kontakt@winitday.com for any of this.

17. Right to lodge a complaint

You have the right to lodge a complaint with the Austrian data protection authority:
Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria
www.dsb.gv.at

18. Automated decisions

WinitDay does not make automated decisions that produce legal effects concerning you or similarly significantly affect you. Every evaluation within the app serves only your own personal organisation.

19. Changes to this Privacy Policy

We review and update this Privacy Policy whenever the features, service providers, or data processing change. Contact: kontakt@winitday.com.