Privacy policy

Last updated 29 October 2026

things & events is a private log: what you put in it is yours. This policy says what we collect, why, who else sees any of it, and how to take it with you or delete it. It's run by [Your company's legal name], [Your company's postal address] ("we"). Questions go to hello@example.com.

What we collect

• Your account: your email address, and your password stored only as a one-way hash, which can't be turned back into the password.
• What you enter: logs, things, people, places, types, notes, journal entries, tags, reports, dashboards, and any photos or files you upload.
• Location, if you allow it: when your browser is allowed to share your location, a log records where it was made. You can deny this in your browser and still use everything else.
• Sign-in records: for each device you sign in on, its IP address and browser name, so a session can be recognised. They're deleted when you sign out of that device or delete your account.
• Billing status: your plan, whether you're on a trial, and the ids Stripe uses for you. Not your card details: see Stripe, below.
• Server logs: like any website, our servers log requests (including IP addresses) to keep the service running and secure.

How it's kept

Each account has a SQLite database of its own, in a separate file from every other account's, with your uploaded files in a folder beside it. Nobody else's account can read it. We look at your data only when you ask us to (to help with a problem, say), or where the law requires it.

What we don't do

• No advertising, and no analytics or tracking scripts. Every script, font and image the app uses is served from our own servers.
• We never sell your data, share it with advertisers, or use it to profile you.
• We don't use what you enter to train AI models.

Who else is involved

• Stripe takes payments. You enter your card on Stripe's own page; it never reaches us. Stripe keeps your email, card and billing details under its own privacy policy, and sends your receipts.
• Open-Meteo, a weather service, is sent a log's coordinates and time, but only if you turn on weather in Settings. It's off by default, and nothing else about the log is sent.
• AI assistants and programs you connect with a token from Settings can read and add to your data, as far as you let them. What an assistant reads goes to whoever runs it (Anthropic for Claude, say), under their terms. Nothing is connected unless you make a token, and revoking it cuts it off.
• Our email provider delivers the emails we send you: confirming your address, and resetting your password.
• Our hosting provider runs the servers your data is stored on.

Cookies and browser storage

We use only what the app needs to work. Nothing tracks you across other sites.

• session_id: keeps you signed in.
• A Rails session cookie: carries messages between pages, such as "Saved".
• time_zone: your browser's time zone, so times show on your clock.
• theme: light or dark, if you chose one.
• Browser storage: a journal entry you're writing is kept in your browser until you save it.

Taking your data with you

Any time, even after you stop paying: Settings → Your data downloads everything you've entered as one SQLite database file, which opens in any SQLite tool, and every report as CSV.

Deleting it

Settings → Delete account deletes your account, your database and your uploaded files straight away, and cancels your subscription. If you stop paying without deleting your account, your data is kept so you can come back to it; ask us at hello@example.com if you'd like it deleted instead. Stripe keeps its own payment records, as the law requires of it.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to how it's used. Most of this you can do yourself in the app. For anything else, email hello@example.com and we'll answer within 30 days. You can also complain to your local data protection authority.

Changes

If we change this policy in a way that matters, we'll email you before it takes effect.