Privacy policy

Data controller

[your name], Denmark, is responsible for the personal data processed in Steen. Contact: [your contact email].

What we store

• Account: your email address and sign-in records, so you can log in. If you sign in with Google or Apple, they confirm who you are and share your email address with us (Apple can share a private relay address instead). Legal basis: providing the service you asked for (GDPR art. 6(1)(b)).
• Your work: sessions, tasks, activities and settings. They are kept in your browser so the timer works offline, and saved to your account so they are there on every device. Same legal basis.
• Payments: Stripe handles payments. We receive a customer reference, your subscription status and billing country, never your card number. We keep payment records for as long as bookkeeping law requires (art. 6(1)(c)).

Signing out clears the copy in that browser. Deleting your account (Account → Delete account) erases your data from our database straight away, apart from payment records we must keep.

Who processes data for us

• Supabase: database and sign-in.
• Stripe: payments.
• Vercel: hosting the website.
• Our email provider: sending sign-in links.
• Google and Apple: only if you choose to sign in with them.

Each acts on our instructions under a data processing agreement. Where data leaves the EU/EEA, it is covered by the EU's standard contractual clauses or an adequacy decision.

Cookies and tracking

We use only the cookies needed to keep you signed in, and your browser's local storage to save your work. There are no ads, no analytics trackers and no selling of data.

How long we keep it

Account and synced data are kept until you delete your account; email us and we'll erase it within 30 days. Payment records are kept for the period bookkeeping law requires.

Your rights

You can ask for access to, correction, deletion or a copy of your data, and object to or restrict its processing. Most of it you can export yourself from Settings → Data. If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency, Datatilsynet.