Privacy Policy

1. What we store

Your email, a password hash (Argon2id — the password itself is never stored on the server), your timezone, your interface language, and the content of your calendar: intentions, notes, mood ratings and uploaded photos.

Technical session data: the IP address and user agent of the device you logged in from — used only to protect your account (the active-sessions list, detecting suspicious logins).

2. How we use it

Account data is used solely to run the service: authentication, rendering your calendar, and syncing across your devices. We do not sell or share your data with advertising networks.

3. Storage and protection

Logging in creates a server-side session: your browser receives a cookie that JavaScript cannot read (`HttpOnly`), not a token that could be stolen through XSS. Passwords are hashed with Argon2id.

On registration and password changes we check the password against a breach database (HIBP) using k-anonymity — neither the password nor its full hash ever leaves your device or our server.

4. Third-party services

Password-breach checks use api.pwnedpasswords.com (which only ever receives a partial hash, never the password). Holiday and non-working-day data comes from isdayoff.ru. Neither service ever receives your account's personal data.

5. Data retention and deletion

You can export all of your data (the "Export" section in settings) or delete your account entirely. Deletion erases your intentions, notes, series, images (every stored size), sessions and feeds; the deletion event is logged with no personal data in it.

6. Cookies

The service uses exactly two cookies, both required to stay logged in: `__Host-sid` (your session, unreadable by JavaScript) and `__Host-csrf` (cross-site request protection). Neither is used for tracking or advertising.

7. Your rights

You can request a copy of your data, or its deletion, from your account settings at any time. For questions about this policy, write to us at support@websanya.example.