Política de Privacidade

Pockytap Organizer is an app for tasks, calendar, notes, goals and habits, part of the Pockytap suite. It is built and operated by iOLABS ("we", "us"). This policy explains in plain words what data we collect, why, where we store it and what rights you have. We wrote it to be read, not to intimidate.

In short: the app is a free test version (beta) and the account is optional. Without an account, whatever you write stays only on your device and is not sent to our servers, with one exception: external calendars, if you add one (section 2). If you sign in with an account, a copy is synced to our servers as described below.

1. Who is responsible

The data controller is iOLABS | DERVOS ALEXANDROS AND SIA EE (iolabs.gr), with registered office at Kleisthenous 53, 153 43 Agia Paraskevi (Stavros), Attica, Greece. For any privacy matter you can write to dervos@iolabs.gr.

2. What data we collect

We collect only what the app needs to work. Specifically:

Data	What exactly	When
Data you enter	Tasks (including repeating tasks), notes, goals, habits, groups, settings. Whatever you type into the app.	While you use the app. It is stored on your device. It is synced to our servers only if you sign in with an account.
External calendars	The address (ICS link) of a calendar you add, e.g. the private link of a Google, iCloud or Outlook calendar.	Only if you add a calendar, each time it is refreshed. Our server does not store it (see below). With an account, it is synced together with the rest of your data.
Account details	Email address and password. The password is stored only as a cryptographic hash. Not even we can see it. It is the same account for all Pockytap apps. We send to this address the email verification and password reset emails, and important notices about the service. No advertising.	Only if you create an account or sign in with an existing Pockytap account. The account is optional.
Device and session details	Device/browser type, operating system, a random identifier of the installation, date of last sync.	Only with an account, on every sign-in and sync, so you can manage your connected devices and for security.
Server logs	IP address, time, which page or function was requested. Never the contents of your tasks or notes.	When your browser loads the website or the app, or requests an external calendar, as with any website.
Purchase details	If you buy Organizer Pro or the Pockytap suite: a transaction identifier from the payment provider, date and product. We never see or store card numbers.	Only if you make a purchase, once purchases are switched on.
Support email	Whatever you send us when asking for help.	Only if you contact us.

External calendars. The servers of Google, Apple or Microsoft do not let a browser read an ICS calendar directly. So when you add or refresh a calendar, the app asks our server to download it on its behalf. The link is sent in the body of the request (not in the address, so that it is not written to the logs). The server downloads the calendar, returns it to your device and stores neither the link nor the events. The events are kept only on your device and the app only reads them: it changes nothing in your calendar. The calendar provider sees a request from our server, not from your device.

Notifications. The morning summary and task reminders are local notifications that the app creates on your device. The permission is requested by the browser and you can withdraw it whenever you want.

We do not ask for and do not collect: full name, phone number, postal address, contacts, location, photos, or data from other apps. If you import tasks from a CSV file (e.g. from Todoist or TickTick), the file is read only on your device.

3. Why we use it

• To run the app (performance of a contract, Art. 6(1)(b) GDPR): loading your external calendars and, with an account, your account, sync between devices, restoring your data on a new device, unlocking Pro.
• For security (legitimate interest, Art. 6(1)(f)): detecting abuse, protecting accounts, server logs.
• To reply to you when you write to us.
• For legal obligations (e.g. tax records for purchases).

The app's assistant (suggestions, reminders, morning summary) works locally on your device. We do not send your tasks or notes anywhere for "analysis".

4. Where it is stored

• On your device: the app is offline-first. All your data is stored locally, in the browser's storage (IndexedDB). If you do not sign in with an account, it stays only there.
• On our servers: if you sign in with an account, a copy of your Organizer data (tasks, notes, goals, groups, repeating tasks, external calendars including their links) is synced to servers operated by iOLABS and located in the European Union. It is kept separate from your Pockytap data. Transfer is always encrypted (HTTPS/TLS).

We do not transfer your data outside the EEA. Should that ever change (e.g. a new provider), we will update this policy and apply the required safeguards (standard contractual clauses).

5. What we do not do

• We do not sell or rent your data to anyone.
• We do not show ads and we do not use advertising SDKs, analytics tools or trackers.
• We do not share your data with third parties, other than the technical providers listed in section 10 or where the law requires it.
• We do not profile you for commercial purposes and we do not make automated decisions with legal effects on you.

6. How long we keep it

• Data on your device: for as long as you keep it. We have no access to it.
• External calendar links and events on our server: not at all. They pass through the server only at the moment of the refresh.
• Account and Organizer data: for as long as you have an account. After deletion they are permanently erased from active systems within 30 days and from backups within 90 days.
• Server logs (IP, time, endpoint): up to 90 days.
• Purchase records: as long as tax law requires (up to 10 years), not linked to what you enter in the app.
• Support emails: up to 2 years after the last message.

7. Deleting your data and account

Without an account, your data exists only on your device and is under your control: it is removed from Settings (Delete all data), when you clear the site's data in the browser or when you uninstall the app. Before that you can export it as JSON or CSV from Settings.

With an account, you can delete your account from inside the app (Settings → Account & sync → Delete account) or by emailing us at dervos@iolabs.gr from your account's email address. Because the account is shared by all Pockytap apps, deletion erases the account and the data of every app in the suite: both the Organizer and Pockytap (e.g. wallets and transactions). Deletion is permanent and cannot be undone. Before deleting you can export your data from the Settings of each app.

8. Your rights (GDPR)

Under the General Data Protection Regulation (EU) 2016/679 you have the right to:

• Access the data we hold about you.
• Rectify inaccurate data.
• Erasure ("right to be forgotten").
• Restrict processing.
• Portability: receive your data in a machine-readable format (the JSON and CSV export in the app does this).
• Object to processing based on legitimate interest.
• Lodge a complaint with the Hellenic Data Protection Authority (dpa.gr) or the supervisory authority of your country.

To exercise any right, email dervos@iolabs.gr. We reply within 30 days at the latest, free of charge. For data that exists only on your device there is nothing we can do, because we never have it.

9. Security

Passwords are stored only as hashes using a modern algorithm. All communication with our servers uses TLS. Access to systems is limited to the minimum necessary personnel. Data on your device is as protected as the device itself: anyone with access to it and to your browser can see it. No system is 100% secure; if a breach affecting you ever occurs, we will notify you without undue delay, as the law requires.

10. Third-party providers

We use a small number of technical providers, only to run the service:

• Server hosting in a data centre in the EU.
• The providers of your external calendars (e.g. Google, Apple, Microsoft): only if you add a calendar. They receive from our server the request for the calendar they themselves gave you, and nothing else from the app.
• Web payment provider (Paddle, once purchases are switched on): processes your card directly; we never see its details.
• Google Fonts on this website (not in the app): your browser requests the Inter font from Google's servers, which can see your IP address.

The app contains no third-party analytics, crash reporters or advertising SDKs.

11. Children

The app is not directed specifically at children and contains no content unsuitable for any age. To create an account, anyone below the age of digital consent in their country (13 to 16 depending on the country; 15 in Greece) needs the consent of a parent or guardian. We do not knowingly collect data from children without that consent. If you believe a child has given us data, write to us and we will delete it.

12. Changes to this policy

If we change something material, we will update the date at the top and notify you in the app or by email before the changes take effect.

13. Contact