Privacy Policy

1. Data we collect

We collect the following categories of data:

• Account data. When you register, we collect your email address and password, and your name if you choose to provide one. Your password is never stored in readable form; it is hashed with bcrypt before it is saved, and we cannot retrieve or view your original password.
• Task data. Any task you create through the API, including its title, description, status, and other fields you submit, is stored against your account so the Service can return it to you.
• Authentication data. When you log in, we issue a signed JSON Web Token (JWT) that your client sends back on later requests. We do not use cookies for authentication; the token itself is held by your client, not by us, though the server verifies it on each request.
• Password-reset data. If you request a password reset, we generate a single-use token, store a hashed version of it with an expiry time, and send a reset link to the email address on your account.
• Technical and rate-limiting data. To protect the Service from abuse, we temporarily record counts of requests to sign-in related endpoints, keyed to your IP address and, for login and password-reset attempts, a hashed version of the email address involved. We also process standard technical data that any web server or API sees as part of a request, such as IP address, timestamp, and user agent, mainly in operational logs.
• Newsletter data. If you subscribe to news and updates, usually from the form in the footer of the website, we collect the email address you submit. Subscribing does not require an account, and having an account does not subscribe you automatically; the two are independent. We also keep a hashed, single-use unsubscribe token for each subscriber, the same way we handle password-reset tokens, so that every email we send can include a working unsubscribe link.
• Website usage data. The Service does not use analytics or advertising cookies. If you use the in-page API playground, the requests you make are sent to the same API endpoints described above and are treated the same way.

2. How we use your data

We use the data described above to:

• create and secure your account, and authenticate your requests;
• store and return your tasks, and support features such as version checks, idempotent creates, and offline sync;
• send transactional email, specifically password-reset links, when you ask for one;
• send newsletter email, specifically news and updates about the Service, only to addresses that have subscribed and have not unsubscribed;
• detect and limit abusive or automated behavior, such as credential-stuffing attempts against the login endpoint or bulk newsletter sign-up abuse;
• maintain the security, integrity, and availability of the Service, including through logging and debugging; and
• comply with legal obligations, and respond to lawful requests from public authorities.

We do not use your task content or account data to train machine-learning models, and we do not sell or share your email address, including your newsletter subscription, with any third party for their own marketing purposes.

3. Legal basis for processing

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar requirements, our legal bases for processing your personal data are: performance of a contract (to provide the Service you sign up for), consent (for the optional newsletter, described below), our legitimate interests (to secure the Service, prevent abuse, and operate it reliably, balanced against your rights), and compliance with a legal obligation where applicable.

The newsletter is processed on the basis of your consent, given when you submit your email address to the subscription form. That consent is separate from, and not a condition of, creating an account or using the API. You may withdraw it at any time, free of charge, by using the unsubscribe link included in every newsletter email, without needing to sign in or contact us, though you are welcome to do either instead.

4. Who we share data with

We do not sell your personal data. We share it only with the service providers who help us run the Service, and only to the extent needed for that purpose:

• Database hosting. Account and task data is stored in a managed Postgres database. The database provider processes this data on our behalf and does not use it for its own purposes.
• Application hosting. The API and website run on a cloud hosting and deployment platform, which processes requests to the Service and may retain request-level logs for a limited period.
• Email delivery. Password-reset emails are sent through a third-party email service. Sending a reset email requires sharing the recipient's email address with that provider.

We may also disclose personal data if required to do so by law, in response to a valid legal process, or where necessary to protect the rights, property, or safety of iamsupreme developers, our users, or others. If the Service, or substantially all of its assets, is transferred as part of a merger, acquisition, or sale, personal data may be transferred as part of that transaction, subject to this Privacy Policy or a successor policy of which you will be notified.

5. International data transfers

Our service providers may process and store data in countries other than your own, including outside the European Economic Area or the United Kingdom. Where we transfer personal data internationally, we rely on the provider's own compliance mechanisms, such as standard contractual clauses or an equivalent safeguard, where applicable law requires one.

6. How long we keep data

We keep your account and task data for as long as your account remains active, and for a reasonable period after that to allow you to recover your account or as required to meet legal, accounting, or security obligations. If you delete a task, it is initially retained in a deleted state (a "tombstone") so that other clients can learn about the deletion during offline sync, and is permanently removed on a regular cleanup schedule, typically after 30 days. Password-reset tokens expire after one hour and are invalidated once used. Rate-limiting counters are short-lived and are cleared automatically once the relevant time window passes. If you subscribe to the newsletter, we keep your email address for as long as you remain subscribed, and retain a record that you unsubscribed, without further mailing you, once you do.

If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records by law, or where data has already been fully anonymized or aggregated such that it no longer identifies you.

7. Security

We apply technical measures designed to protect your data, including password hashing with bcrypt, parameterized database queries, signed and expiring authentication tokens, rate limiting on sign-in endpoints, and transport encryption (HTTPS) for data in transit. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident that affects your personal data, we will notify you and any applicable authority as required by law.

8. Your rights and choices

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, request its deletion, object to or restrict certain processing, or receive a copy of it in a portable format. You can access and update most of your account data, and create or delete tasks, directly through the API. For anything the API does not cover, including account deletion, contact us at iamsupremedevelopers@gmail.com, and we will respond within a reasonable time and in accordance with applicable law. If you subscribed to the newsletter, the quickest way to exercise your right to withdraw consent is the unsubscribe link included in any newsletter email you received from us.

If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority. If you are a California resident, you may have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect and the right to request its deletion; we do not sell personal information as defined by that law.

9. Children's privacy

The Service is not directed to, and is not intended for use by, anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at the address below and we will take reasonable steps to delete it.

10. Cookies and local storage

The Service does not use tracking or advertising cookies. Authentication is handled with a bearer token that your own client is responsible for storing, not a cookie we set. If the in-page API playground uses your browser's local storage to hold a token between page loads for your convenience, that data stays on your device and is not transmitted to us except as part of an API request you make.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Service or to applicable law. We will update the "Last updated" date above when we do, and where a change is material we will make reasonable efforts to notify account holders, for example by email, before it takes effect.

12. Contact

For any question about this Privacy Policy or how we handle your data, contact us at iamsupremedevelopers@gmail.com. You can also read more about who operates the Service on the About page.