LEGAL / BETA-P0-1

Privacy Policy

⚠️ DRAFT — requires legal review before publication. This page describes the fair.ninja beta as engineering understands it today. It is not legal advice and has not yet been reviewed by a lawyer or approved by the owner. Bracketed items like [COMPANY NAME] are still placeholders. The full source with a Polish summary for the owner lives at docs/legal/privacy-policy.md in the repository.

1. Who is the controller

[COMPANY/INDIVIDUAL NAME, ADDRESS, COUNTRY] ("we", "us") is the data controller for fair.ninja (Tomato, the account portal, and the MCP server) during this beta. Contact for privacy matters: [PRIVACY CONTACT EMAIL].

2. What we collect and why

Data	Why	Legal basis
Email, Firebase UID, sign-in provider	Sign you in, secure your account	Contract (Art. 6(1)(b))
Display name	Shown in the UI	Contract
Tasks, projects, focus sessions, time entries	The service itself	Contract
Device list & sessions (platform, last seen, truncated IP)	Let you see/revoke your own devices	Contract; security interest
Wallet balance, usage receipts, ledger	Show what you used and what it costs (beta rate: $0)	Contract
Payment records (pack, amount, Stripe session id, status) — never your card number	Process top-ups (Stripe test mode in beta)	Contract
Server request logs (request id, trace id, route, status, truncated IP)	Operate and secure the service	Legitimate interest
Client error/performance telemetry (Faro), only once configured	Find and fix bugs	Legitimate interest
OAuth/MCP grants, if you connect an AI assistant	Let the assistant act with the scopes you approved	Your consent

We do not collect card numbers, government IDs, precise location, biometrics, or advertising identifiers, and we do not sell your data or use it for ad targeting.

3. Where your data is stored

Account, tasks, wallet and session data: a server we operate (slotify1, PostgreSQL) — [region to be confirmed by the owner].
Sign-in identity: Firebase Authentication (Google Cloud).
Payments: Stripe, Inc. — test mode only during the beta, no real charge is possible.
Telemetry (server + client errors/web-vitals): Grafana Cloud — [region to be confirmed by the owner].
Your local diagnostics ring buffer never leaves your device unless you copy/export it yourself.

4. Retention

Sync operations log: 90 days by policy (automatic cleanup is not live yet — see the full policy).
Account data: for as long as your account exists.
Data export files: 24 hours, then deleted automatically.
Deleted account: a 7-day grace period, then your records are purged and your sign-in removed.

5. Cookies

Exactly two, both strictly necessary — no advertising or tracking cookies: fn_session (keeps you signed in) and fn_csrf (cross-site request forgery protection).

6. Payments during the beta

Every new account gets a welcome grant of 25 chips. The pilot rate is $0, so usage doesn't reduce your balance. Top-ups run through Stripe Checkout in test mode — test card 4242 4242 4242 4242, no real money moves. See the Terms for what changes once real payments are enabled.

7. Your rights

Access and export your data — Account portal → Data → "Export your data".
Correct your display name — Account → edit profile.
Delete your account — Account portal → Data → "Delete account" (7-day grace period).
Object, restrict, or withdraw consent — contact us; revoke an AI assistant's access any time via "Sign out everywhere".
Lodge a complaint with your national data protection authority.

Full draft with sources and a Polish summary for the owner: docs/legal/privacy-policy.md. Last drafted 2026-09-26.