Privacy Policy

1. Controller and contact

Evert Kuus, operating under the Pactune name, is the controller responsible for personal data processed through the Service. For privacy requests, email kuusevert@gmail.com.

2. Adults only

Pactune is intended only for people aged 18 or older. We record your self-confirmation and policy versions, but do not normally request an identity document. If we learn that an account belongs to a minor, we may suspend it and delete the associated personal data.

3. Information we process

• Account: email, username, display name, authentication identifiers, account and acceptance timestamps.
• Profile and settings: optional avatar URL and biography, time zone, searchability, sharing, theme, goals, favourites, and notification choices.
• Activity and wellbeing: selected activities, dates, quantities, optional notes, scores, streaks, and patterns. These may reveal health or substance-use information.
• Social: friend requests, friendships, reactions, shared visibility, and notifications.
• AI requests: a custom description and resulting evaluation only when you request AI assistance.
• Safety: reports, moderation correspondence, and information needed to investigate abuse or illegal content.
• Technical: necessary authentication cookies, request information, security events, and provider logs needed to operate and protect the Service.

4. Purposes and legal bases

5. Explicit consent and withdrawal

Activity and wellbeing information can include special-category data. A separate unselected checkbox records explicit consent, its version, and time. You can withdraw by deleting the account in Settings or emailing the operator. Withdrawal does not affect processing that was lawful before withdrawal. Because this data is necessary for the tracker you requested, withdrawing consent ends access to tracking features.

6. Privacy by default

New and existing profiles are reset to non-searchable, friend visibility is hidden, notes and AI descriptions are hidden, and substance-related categories are disabled. You may deliberately enable individual sharing choices in Settings. Only accepted friends can receive the visibility level you select.

7. Processors and disclosures

Supabase provides authentication and database infrastructure. A deployment provider, such as Vercel when configured, delivers the application. OpenAI processes a custom activity description only after you request AI assistance. We may also disclose limited information where required by law, to protect someone from serious harm, or to establish or defend legal claims. We do not sell personal data.

8. OpenAI data handling

AI requests use the Responses API with storage disabled and a pseudonymous safety identifier. OpenAI states that API data is not used to train models by default, but abuse-monitoring logs may retain customer content for up to 30 days unless stricter account controls apply. Do not include names, contact details, secrets, medical records, or another person’s information in a custom activity. See OpenAI’s API data controls.

9. International transfers

Some processors may handle information outside Estonia or the EEA. Where required, transfers must rely on an adequacy decision, standard contractual clauses, or another lawful safeguard. Provider region and data-control settings should be configured to minimise transfers.

10. Retention

• Account, profile, activity, social, and saved AI-evaluation records remain in the active database while the account exists, unless you delete an editable item earlier.
• Using “Permanently delete my account” removes the authentication account and cascades through linked active personal records.
• Temporary copies may remain in processor backups for the provider’s limited backup cycle and are not restored for ordinary product use.
• OpenAI abuse-monitoring logs may remain for up to 30 days under its default API controls.
• Safety or legal records may be retained only as long as reasonably necessary for an open dispute, legal obligation, or defence of claims, then deleted or de-identified.

11. Your rights

Depending on applicable law, you may request access, correction, a machine-readable export, deletion, restriction, objection, or withdrawal of consent. Settings provides data export and account deletion. Requests sent to kuusevert@gmail.com will be answered without undue delay and normally within one month. Identity may be verified before releasing or changing data.

12. Complaints

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or another competent EEA supervisory authority. Contacting us first is welcome but not required.

13. Security

We use encrypted connections, server-side authentication checks, database Row Level Security, private API keys, limited data access, and rate limits for AI requests. No online service can guarantee absolute security. Use a unique password and report suspected compromise promptly.

14. Cookies

Only necessary authentication and security cookies are used. There are no advertising or optional analytics cookies, so no optional-cookie banner is shown. Read the Cookie Policy.

15. AI and automated decisions

AI suggests an activity name, category, and motivational score. You review it before saving. It is not used to make legal or similarly significant decisions about you, and it is not medical advice.

16. Changes

Material changes are shown in the Service and may require renewed acknowledgment or consent. The current version and acceptance time are recorded with the account.