Privacy Policy

What we collect

When you create an account, we store your name, email address, and password (hashed). If you sign in with Google or Microsoft, we receive your name, email, and profile photo from those services.

When you use the app, we store the projects, issues, photos, and annotations you create. Photos are stored on Cloudflare R2 (encrypted at rest). Your data belongs to you.

What we don't do

• We don't sell your data to anyone.
• We don't run targeted advertising.
• We don't share your data with third parties except as needed to run the service (hosting, email, payments).
• We don't track you across other websites.

Third-party services

We use these services to run the app:

• Cloudflare R2 — image storage
• Stripe — payment processing (we never see your card number)
• Resend — transactional email
• Apple App Store / Google Play — mobile app subscriptions
• Bugsnag — crash reporting and app diagnostics. Reports may include device and app information, error details, and your account ID, name and email to help us investigate faults. We also store authenticated app error reports on our server.
• Hetzner — hosting in a German data centre. Established in 1997, Hetzner provides professionally operated infrastructure with redundant network connections and an ISO/IEC 27001-certified information security management system.

Your data

You can export all your data at any time from the app. To delete your account and all associated data, see our account deletion page. We'll complete the deletion within 30 days.

Public website analytics

We use our own analytics service, Pulsinator, to measure visits to our public marketing pages. We record the page, referring website, basic browser/device category and campaign tags. We do not include your name, email, page titles, query strings or customer project information. Signed-in users and private app, report and sharing pages are excluded.

A random identifier in session storage groups page views within a browser tab. A daily changing hash of the site, IP address and browser information estimates daily visitors; raw IP addresses are not stored in the analytics records. We do not send your IP address to a geolocation service. Known bots are filtered from the dashboard.

We respect Do Not Track and Global Privacy Control. You can also turn off public-page analytics in this browser, or turn it back on. The choice is stored locally in your browser.

Cookies

We use session cookies to keep you logged in. No tracking cookies, no advertising cookies.

Contact

If you have questions about this policy, email chris@fantata.com.

Fantata Ltd, Norwich, UK.