Template. Have it reviewed by a lawyer and adjusted to your actual providers before launch.

Privacy policy

Last updated 12 October 2026

Who is responsible

[Company name GmbH], [Street and number], [Postcode City], Germany. Contact: [hello@your-domain.com].

What we store and why

• Account data: your email address and name, to sign you in and address you (Art. 6(1)(b) GDPR).
• Your content: objectives, key results, weekly reviews and sparring responses. We store them only to provide the service to you (Art. 6(1)(b) GDPR). Reflections can be personal; nobody at the company reads them except when you ask for support and grant access.
• Settings: time zone, review day and reminder preference.
• Technical logs: kept by our hosting providers for security and troubleshooting (Art. 6(1)(f) GDPR).

We use no advertising, no tracking cookies and no analytics that profile you. The only cookies are the ones that keep you signed in.

Processors

• Supabase (database and sign-in), hosted in the EU region [Frankfurt, eu-central-1].
• Vercel (application hosting), EU functions region [fra1].
• Anthropic (the sparring feature): when you press “Spar with me”, the review for that week, your objectives and a short history are sent to Anthropic's API to generate a response. Under Anthropic's commercial terms, API inputs are not used to train models. Transfers to the US rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
• Resend (reminder emails), only if you keep reminders switched on.

We have data processing agreements with each provider.

How long we keep it

Until you delete your account. Deletion removes your account and all content immediately; backups roll over within [7 days].

Your rights

You can access, correct, export (Settings → Download my data) and delete (Settings → Delete account) your data at any time. You can also object to processing, restrict it, and complain to a supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information.