Privacy Policy

01

Who is responsible for your data

The controller of your data is [legal entity name and address]. Questions about privacy go to [privacy email], and we answer them ourselves rather than through a form robot.

This policy covers the website and the web application. It does not cover sites we link to — their own policies apply there.

02

What you give us on purpose

Account: your email address, your name if you enter one, and a password stored only as a cryptographic hash — we never see the password itself.

Your content: projects, flows, incomes and expenses, notes, attachments, members you invite, and anything else you type into the product. This is the heart of the service and it is yours.

Messages: what you write in the contact form — your name, email and the text — so that we can answer.

Payment data: handled by [payment provider]. We receive the fact of payment, the plan and the period; card numbers never reach our servers.

03

What the site collects by itself

Analytics on this site is first-party: we run it ourselves, and it never leaves for an advertising network. It records page views, the page address, the language, the referring site, UTM tags from campaign links, a coarse device type and browser family, and the country as reported by our hosting edge.

Counting visits needs no cookies at all. The visitor identifier is derived on our server from the request itself — the IP address, the browser string and a secret that changes every day — and neither the address nor the browser string is kept: they live only long enough to compute a hash. Yesterday’s secret is gone, so yesterday’s visits cannot be tied to today’s. The honest cost of that: if you come back tomorrow, you are counted as a new visitor.

We do not build browser fingerprints, do not track mouse movements or keystrokes, do not record form contents and do not use advertising or social network trackers.

IP addresses are not stored. The country is derived from a request header at the moment of the visit and kept only as a two-letter code.

Performance metrics (page load and responsiveness) are collected in the same anonymous way, so we can tell whether a page is slow for real people rather than in theory.

The cookies this site does set remember your own choices and nothing else: ff365.lang the language you picked, ff365.langhint that you dismissed the offer to switch language, ff365.consent your answer about third-party services. Your light-or-dark preference is not a cookie at all: it stays in the browser’s local storage under ff365.theme. None of it is ever sent anywhere.

We load no third-party service on this site today. If one is ever added, it stays inert until you accept it, and you can change that answer at any time from the link in the footer.

04

Why we process it

To provide the service you asked for: keeping your records, showing them back to you, running shared projects and public pages you publish. Legal basis: performance of our contract with you.

To keep the service safe and working: security, abuse prevention, diagnostics, backups. Legal basis: our legitimate interest in a service that works.

To understand what people find useful on the site: aggregate statistics with no personal profile and no cookies. Legal basis: our legitimate interest. Where a third-party service would set cookies, we ask first and load nothing until you agree.

To meet accounting and tax obligations for payments. Legal basis: legal obligation.

We do not use your financial records to profile you, and we do not sell data to anyone, in any form. There is no advertising business here to feed.

05

Who else sees it

Hosting and infrastructure: [hosting provider], where the application and database run.

Payments: [payment provider], which processes cards and holds the payment details we never receive.

Email delivery: [email provider], used to send account and support mail.

AI features, where a plan includes them, send only the text of the request you initiate to [AI provider]. They are never triggered on their own, and nothing is posted to your project without your action.

Each of these acts on our instructions under a data processing agreement. Beyond that we disclose data only when the law compels us, and we push back on requests that overreach.

06

How long we keep it

Your content lives as long as your account does. Delete a record and it goes; delete the account and everything goes with it.

After deletion, data disappears from the working system immediately and from backups within 30 days, when the backup rotation overwrites them.

On the Free plan, data waits 100 days without a sign-in; paid plans wait longer, per the pricing table. We email a warning before anything is removed.

Raw site analytics is deleted after 90 days automatically. Only aggregate counts — how many views a page had on a given day — are kept longer, and they identify nobody.

Payment records are kept as long as accounting and tax law requires, typically several years.

07

Your rights

You can see and change most of your data yourself, inside the product, at any moment.

You may also ask us to: give you a copy of your data, correct it, delete it, restrict or object to processing, or hand it to another service in a machine-readable form.

Write to [privacy email]. We answer within 30 days and do not charge for it.

If you think we handle your data wrongly, you may complain to your data protection authority. We would rather you told us first: it is usually faster and we can actually fix it.

08

Where data is stored, and security

Data is stored in [region], and where it crosses borders we rely on the safeguards the law requires, such as standard contractual clauses.

Traffic is encrypted in transit. Passwords are stored as hashes. Access to production data is limited to people who need it for support and operations, and such access is logged.

No system is perfectly safe. If a breach puts you at risk, we will tell you and the authorities within the deadlines the law sets, and we will say what actually happened.