Privacy Policy

1. Overview

This policy explains how Simple Checklist processes personal data. It is written to provide clear notice for users, including users covered by the EU/UK-style GDPR framework and India's Digital Personal Data Protection Act, 2023.

2. Data We Collect

• Account data: email address, password hash, optional first and last name, admin status, verification state.
• Security data: sessions, CSRF/session cookies, OTP codes, mobile access tokens, password reset and email verification records.
• User content: template names, checklist names, checklist items, order, item statuses, custom statuses, timestamps, and related metadata.
• Import/export data: CSV or Excel files you upload for import and files generated for export.
• Operational data: IP address, browser/device information in server logs, error diagnostics, and email delivery metadata.

3. Why We Use Data

• To create and secure accounts.
• To provide checklist creation, import, export, editing, and status tracking.
• To send verification, password reset, account, and service emails.
• To prevent abuse, investigate errors, maintain security, and operate the service.
• To comply with legal obligations and respond to user rights or grievance requests.

4. Legal Bases and Lawful Purposes

Where GDPR applies, we generally process account and checklist data to provide the service you request, process security and diagnostic data based on legitimate interests in operating a secure service, and process legally required records where necessary to comply with law. Where consent is used, you may withdraw it, although this may affect your ability to use some features.

Where the DPDP Act applies, we process digital personal data for lawful purposes connected with providing and securing the app, based on consent or other permitted legitimate uses where applicable.

5. Providers and Transfers

We use service providers to operate the app. Current key providers include:

• Hetzner for server hosting and infrastructure. See Hetzner's data protection and DPA information and terms.
• Resend for transactional email delivery, including verification and account emails. See Resend's legal documents, DPA, privacy policy, and terms.
• Google Fonts for loading the Inter font in the web interface. Your browser may send technical request data such as IP address, user agent, and requested font files to Google when these assets are loaded.

These providers may process data such as email addresses, IP/log data, browser/device data, and email delivery metadata as needed to provide their services.

Your data may be processed in countries other than where you live. Where required, we rely on appropriate contractual, technical, and organizational safeguards.

6. Cookies

The app uses essential cookies for login sessions, CSRF protection, and security. These cookies are necessary for the app to work and are not used for advertising.

7. Retention

We keep account and checklist data while your account is active or as needed to provide the app. Verification codes, sessions, logs, backups, and diagnostic records may be kept for limited operational, security, and legal reasons. We do not promise exact deletion timelines unless a specific deletion process is implemented and monitored.

You may request deletion or anonymization of your account and personal data by contacting privacy@practicalpm.pro.

8. Your Rights

Depending on the law that applies to you, you may request access, correction, deletion, export/portability, restriction, objection, withdrawal of consent, or grievance review. To make a request, email privacy@practicalpm.pro and include your account email. For grievance matters, email grievance@practicalpm.pro.

We may need to verify your identity before acting on a request. We will respond according to applicable law.

9. Security

We use reasonable technical and organizational safeguards, including HTTPS in production, app-specific secure cookies, server-side access controls, database-backed authentication state, environment-based secrets, and restricted server access. No system is perfectly secure, so please use strong passwords and keep your account credentials private.

10. Children

The app is not directed to children. If you are a minor under the laws that apply to you, use the app only with consent and supervision from a parent or legal guardian.

11. Contact

Support: support@practicalpm.pro
Privacy/data rights: privacy@practicalpm.pro
Grievance/legal compliance: grievance@practicalpm.pro