Privacy notice
This notice explains what personal data this site keeps, why, who else handles it, and how to use your rights. Contact: support@my-first-app-studio.com.
What we keep and why
| Data | Why | How long |
|---|---|---|
| Create and secure your account; send confirmation, password reset and inactivity-warning emails | While your account exists | |
| Password (stored only as a hash, by Supabase) | Sign in | While your account exists |
| Phone (optional) | Stored for a future feature. We use it only if you choose to give it | Until you clear it on your account page, or while your account exists |
| Sign-in provider identity (provider id, name, avatar), only if you sign in with Google, GitHub or Microsoft | Sign in with that provider | While your account exists |
| IP address and browser (user agent) in server logs | Security and abuse prevention | Up to 30 days in our logs; Supabase keeps its own logs according to its plan |
| Audit log of account changes | Accountability and investigating incidents | 12 months |
We collect nothing else. No analytics, no tracking cookies and no marketing emails.
Inactive accounts
Accounts unused for 24 months are deleted after three warning emails (30, 15 and 3 days before).
Support staff
Our support team can look up your account by email to help you, and can correct your phone number or sign you out of your devices when you ask. Every access is recorded.
Who else handles your data
- Supabase: database and sign-in service. It holds all account data.
- Hostinger: server hosting and the mailbox that sends our emails. It holds server logs with IP addresses.
- Cloudflare (Turnstile): bot protection on the sign-up and sign-in forms. It sees your IP address and browser signals.
- Google, GitHub or Microsoft: only if you choose to sign in with them. They handle their own accounts under their own terms.
- Healthchecks.io and UptimeRobot: monitoring. They receive no personal data.
Where your data is stored
The database is in the United States (Supabase, us-east-1) and the server is in Boston, United States. For people in the EU/EEA and Brazil this is a transfer to another country. We rely on the Standard Contractual Clauses in Supabase's data processing agreement. Privacy laws follow the person and the operator, not the server, so GDPR (EU), LGPD (Brazil) and others may apply to you.
Cookies
Only what is strictly necessary: the sign-in session cookies that keep you signed in (they cannot be read by scripts), and Turnstile's bot-protection cookies and signals on the sign-up and sign-in forms. Because they are strictly necessary, there is no consent banner.
Your rights
We answer within 30 days. We only reply to the email address of the account.
- Access and a copy of your data: see your account page, or ask by email for a full export.
- Correction: change your phone number on your account page; ask by email to change your email address.
- Deletion: ask by email and we delete your account.
- Withdraw consent for the phone number: clear the phone field on your account page.
- Object or restrict how we use your data: ask by email.
Write to support@my-first-app-studio.com. You can also complain to your data protection authority. For the owner of this installation that is the Informacijski pooblaščenec (Slovenia); for users in Brazil, the ANPD.