← DesignerSystemsDigital

Privacy Policy

Effective: 5 August 2026 · DesignerSystemsDigital

This Privacy Policy explains how DesignerSystemsDigital ("we," "us," or "our") collects, uses, discloses, and safeguards information when you use our websites and applications (collectively, the "Services"). By using the Services, you agree to the practices described here.

1. Who we are

DesignerSystemsDigital is a sole-trader operation based in New Zealand. We build and operate the Services listed below. For privacy enquiries, contact privacy@designersystemsdigital.xyz.

2. Services covered

3. What we collect

The data we collect depends on which Service you use.

3.1 All Services (auth only)

• Email address — used to sign in and contact you about your account.
• Password — stored as a one-way hash (Supabase Auth; we never see the plaintext).
• Auth session token — stored in a first-party cookie (sb-<project-ref>-auth-token) to keep you signed in.

3.2 NoteTree

• Files and folders — content you upload, folder names, organisation metadata.
• Storage usage — bytes consumed, used to enforce plan limits.

3.3 StatsIRL

• Workout data — exercise logs, sets, reps, durations, calendar history.
• Social graph — friend connections, follow state.
• Push notification tokens — via OneSignal (so we can send you friend activity updates).

3.4 Marketing site (designersystemsdigital.xyz)

We do not collect personal data on this site. Cloudflare may collect aggregated, non-identifying analytics (request counts, country-level geo) for performance and security. No cookies, no third-party trackers.

4. How we use your data

• To provide the Service you signed up for.
• To authenticate you and keep your account secure.
• To process subscription payments (via Stripe — stripe.com/privacy).
• To send transactional emails (verification, password reset, receipts).
• To send push notifications you have opted into.
• To respond to support requests.

We do not sell your data. We do not serve third-party advertising.

5. Third-party processors

Provider	Purpose	Data shared
Supabase (database + auth)	All app data and authentication	All data listed in §3
Cloudflare (hosting + CDN)	Web hosting, DDoS protection	HTTP request metadata
Stripe (payments)	Subscription processing (paid apps only)	Email, payment method (tokenised)
OneSignal (push)	StatsIRL push notifications	Device token, user ID

6. Cookies and local storage

We use strictly necessary cookies only — those required for the Services to function (authentication sessions). We do not use advertising, tracking, or third-party analytics cookies. Because all cookies are strictly necessary (per Privacy and Electronic Communications Regulations and equivalent GDPR Art. 6(1)(f) "strictly necessary" exemption), no consent banner is shown — none would be required under EU/UK "cookie law" or the ePrivacy Directive for this class of cookie.

• Supabase auth cookie — first-party, strictly necessary for sign-in. Expires on sign-out or 1 year idle.
• SharedPreferences (mobile/web) — used by apps to store user preferences (e.g. theme). Never leaves your device.
• Cloudflare cf_clearance — first-party bot-protection cookie on the marketing site only; strictly necessary for Turnstile challenge to function. Cleared when you close your browser or after 30 minutes idle.
• No advertising cookies. No third-party analytics cookies. No Facebook / Google / TikTok tracking pixels.

7. Data security

All data is encrypted in transit (HTTPS / TLS 1.3) and at rest (Supabase default disk encryption). Access to production data is limited to the operator. Passwords are hashed with bcrypt via Supabase Auth. Supabase Row-Level Security (RLS) is enabled on every table — clients can only read or modify rows they own.

8. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (edit in-app where available).
• Delete your account and all associated data — use the in-app delete option or email privacy@designersystemsdigital.xyz. Deletion is permanent within 30 days.
• Export your data in a portable format (JSON; email us to request).
• Opt out of push notifications via your device settings.
• Lodge a complaint with the New Zealand Privacy Commissioner (privacy.org.nz) or your local supervisory authority.

9. Data retention

We retain your account data for as long as your account is active. If you delete your account, all associated data is permanently deleted within 30 days, except where retention is required by law (e.g. tax records for paid subscriptions, retained for 7 years per NZ Inland Revenue).

10. Children

The Services are general audience services — they are not primarily directed to children. Access requires a sign-up with an email address, which acts as a soft age-gate. A user who can provide a valid email address and agree to these terms is presumed old enough to use the Services.

The Services are not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact privacy@designersystemsdigital.xyz and we will delete the account and its data.

11. International transfers

Data is stored in the United States (Supabase us-east-1, Cloudflare global edge). By using the Services, you consent to transfer of your data to the US. Supabase and Cloudflare participate in standard contractual clauses for EU/UK data transfers.

12. Changes to this policy

We may update this policy. Material changes will be announced via in-app banner and/or email at least 14 days before they take effect. The "Effective" date at the top will always reflect the latest version.

13. Contact

Privacy enquiries: privacy@designersystemsdigital.xyz
General support: support@designersystemsdigital.xyz
DesignerSystemsDigital · New Zealand

Effective 5 August 2026. Previous versions available on request.

14. EEA/UK GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, the following additional disclosures apply under Articles 13 and 14 of the GDPR/UK GDPR.

Legal basis for processing

• Consent (Art. 6(1)(a)): We process your data for marketing communications (e.g. email newsletters) only with your explicit opt-in consent.
• Contract (Art. 6(1)(b)): We process your account data, content, and payment information because it is necessary to provide the Services you have signed up for under our Terms of Service.
• Legitimate interest (Art. 6(1)(f)): We process limited technical data (IP addresses, request metadata) for security monitoring, abuse prevention, and service stability. This processing is necessary and proportionate; it does not override your rights.

Data Protection Officer

Contact our DPO at privacy@designersystemsdigital.xyz for any GDPR-related questions, including data access, rectification, erasure, restriction, portability, or objection requests.

EU Representative

As a small New Zealand-based company processing EEA/UK personal data only occasionally and at low volume, we rely on the Art. 27 exemption for organisations that do not process personal data on a large scale. If this changes, we will appoint an EU representative and update this policy.

Complaints

You have the right to lodge a complaint with your local supervisory authority:

• UK: Information Commissioner's Office (ico.org.uk)
• EU: Your national Data Protection Authority (see edpb.europa.eu)
• New Zealand: Office of the Privacy Commissioner (privacy.org.nz)