Privacy

AllDayBits is a private, non-commercial website for its operator and invited family members and friends. There is no public sign-up; accounts are created by invitation only. There are no ads and no tracking.

If you have questions about your data, contact the person who invited you.

Account: email address, password (stored only as a one-way hash, never in plain text), optionally a name, your language and default currency. Purpose: providing your account and the tools. Legal basis: Art. 6(1)(b) GDPR (contract / terms of use).

Content in the tools: e.g. in the “Subscriptions & fixed costs” tool your expenses (name, amount, currency, billing cycle, dates, category, notes and, if you enter them, contract details such as minimum term, notice period, trial end and a cancellation link). You enter this data yourself; only you can see it (access control at database level). Legal basis: Art. 6(1)(b) GDPR.

Emails: we send you emails to confirm your email address and to reset your password. For this, your email address is passed to our email provider. Legal basis: Art. 6(1)(b) GDPR. There are no newsletters or marketing emails.

Server logs: when you visit the website, our hosting providers process technically necessary data (IP address, time, requested URL, browser identifier) to deliver the website and protect it against abuse. These logs are kept only briefly and are not combined with your account. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service).

We use the following providers, each under a data processing agreement:

• Vercel (Vercel Inc., USA) – website hosting. Server functions run in Frankfurt am Main; pages may be delivered through Vercel’s global network.
• Supabase (Supabase Inc.) – database and sign-in. The database is located in Frankfurt am Main (region eu-central-1).
• Resend (USA) – sending the confirmation and password emails via the Ireland region (eu-west-1).

As these companies are based outside the EU, a transfer to third countries (in particular the USA) cannot be ruled out. It is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, where the provider is certified, the EU-US Data Privacy Framework (Art. 45 GDPR).

We only use cookies that are strictly necessary to run the service:

• sb-…-auth-token – keeps you signed in. Deleted when you sign out.
• NEXT_LOCALE – remembers your chosen language (1 year).

No consent is required for these (§ 25(2) no. 2 TDDDG). We use no analytics, tracking or advertising cookies, which is why there is no cookie banner.

We keep your account and tool data for as long as your account exists. You can delete your account yourself at any time under “Profile → Delete account”; this immediately deletes the account and all related data in every tool. Server logs are deleted automatically by the providers after a short time.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Much of this you can do directly in the app: edit your data in the profile and the tools, export it (CSV, PDF, JSON) e.g. under “Costs → Data”, delete it under “Profile → Delete account”. For anything else, a message to the person who invited you is enough.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the state or country where you live.

An email address and password are required for an account; without them you cannot use the tools. All other information is voluntary. There is no automated decision-making or profiling.