Privacy

This instance of Huedo is run by MouseTimer FlexCo, 9073 Viktring, who is the data controller for everything described here. For anything on this page, or to exercise any of the rights below, write to b.wright@mouse-timer.com.

What is stored

• Your account: username, email address, an optional display name, and — if you set a password — a bcrypt hash of it. The password itself is never stored and cannot be recovered, only replaced.
• Your lists: list names and colours, todo titles, sub-tasks, deadlines, priorities, and whether something is done. This is whatever you typed; nothing is inferred from it.
• A theme preference and the timestamp your account was created.
• Social sign-in: if you sign in with Google, the provider’s account identifier and the tokens issued for it, plus the avatar URL and display name they hand over. Signing in that way tells the provider you used this site.
• Password resets: a hash of the reset link, deleted once used and invalid after an hour.

What is not

No analytics, no advertising, no tracking pixels, no third-party fonts or scripts, and no profiling. Your todos are not read by anyone operating this instance as a matter of routine, and are not fed to any AI service. The theme setting lives on your account rather than in a cookie, so there is nothing to consent to there either.

Cookies

One cookie holds your signed-in session and lasts seven days. Signing in also sets a handful of short-lived cookies that exist only to make the sign-in itself safe against forgery. All of them are strictly necessary for a site with accounts; there are no others, so there is no cookie banner to click away.

IP addresses

Sign-in and registration attempts are counted per address to stop password guessing. Those counters live in memory, are never written to the database, and are gone when the server restarts.

Who else sees it

• The company hosting the server this runs on.
• The mail provider that delivers password-reset emails.
• Google, but only if you choose to sign in with it.
• Nobody else. Your data is not sold, shared, or handed over for advertising.

Why it is allowed

Your account and your lists are processed to give you the service you asked for (Article 6(1)(b) GDPR). Counting failed sign-ins is done in the legitimate interest of keeping other people out of your account (Article 6(1)(f)).

How long

Until you ask for the account to be deleted. Deleting it removes the account row and, with it, every list, todo, sub-task and sign-in record attached to it — the database enforces that, so nothing is left orphaned behind. Backups age out on the operator’s own schedule.

Your rights

You can ask for a copy of your data, have it corrected, have it deleted, have it handed to you in a portable form, restrict or object to its processing, and complain to your national data protection authority. Ask at b.wright@mouse-timer.com. Deletion you can also do yourself, immediately, from your profile page.