Privacy Policy

Version 1.0 — July 2026
Controller: Stanislav Matsukatov, Herrenhausstrasse 17, 12487 Berlin, Germany — support@doomtax.app

1. What we collect and why

Data	Purpose	Legal basis (GDPR)
Email address	Account login (one-time codes), essential service messages	Art. 6(1)(b) contract
Per-app usage durations, opens, hourly distribution — only for apps you chose to restrict	Enforcing your limits, your statistics dashboard, goal evaluation	Art. 6(1)(b) contract
Goal/streak results, blocking settings, deposit amount, charity selection	Core service	Art. 6(1)(b) contract
Payment records (amount, time, status, Stripe identifiers)	Charging under your mandate, receipts, dispute handling	Art. 6(1)(b), (c) legal obligations
Device install ID, platform, heartbeat timestamps	Abandonment detection (a core contractual mechanic), security	Art. 6(1)(b), (f)
Consent records (time, IP, terms version)	Proof of contract/mandate	Art. 6(1)(c), (f)

We do not collect: screen contents, messages, notifications, passwords, contacts, precise location, browsing history, or usage of apps you have not restricted. Foreground-app detection runs on your device; only aggregated daily durations per restricted app are transmitted to your account.

We do not sell data or use it for advertising. No third-party analytics or ad SDKs are embedded.

2. Payment data

Card details are entered directly into Stripe's payment interface and processed by Stripe Payments Europe Ltd. We never receive card numbers — only tokens and charge metadata. Stripe acts as processor/independent controller for payment processing; see Stripe's privacy policy.

3. Processors and recipients

Stripe — payment processing (EU entity; standard contractual clauses for any non-EU transfer).
Supabase — database hosting (EU region).
Fly.io — application hosting (region: Frankfurt).
Resend — transactional email (login codes). Resend Inc. is a US company; sending runs from their EU region and any US transfer is covered by standard contractual clauses (Art. 46 GDPR).
Pledge — executing donations (receives donation amount and charity designation only; never your usage data).

4. Retention

Behavioral data (usage, goals, streaks): kept while your account exists; erased on account deletion.
Payment and mandate records: retained for statutory periods (up to 10 years, §147 AO / HGB), then deleted.
Login codes: stored hashed, expire after 10 minutes, purged on account deletion.

5. Your rights

Access, rectification, erasure, restriction, portability, objection (Arts. 15–21 GDPR), and complaint to a supervisory authority. Account deletion is self-service: in-app (Settings → Delete account) or at api.doomtax.app/account/delete — note that deletion triggers the contractual month settlement first (see Terms §7).

6. Security

TLS in transit; access-controlled infrastructure; row-level security on the database; codes and secrets stored hashed or in secret stores. No system is perfectly secure; we notify authorities/users of breaches as required by Arts. 33/34 GDPR.

7. Children

DoomTax is for adults (18+). We do not knowingly process children's data.

8. Changes

We will notify you in the app or by email of material changes.