In short
- We don’t sell your data, don’t show ads and don’t train models on it.
- We don’t look into your data unless you ask us to or the law requires it.
- Deleted items leave the trash after 30 days and the backups 60 days after that.
- You can download everything as one archive and delete your account - in your profile.
Who is responsible for your data
Easy Communications, LLC, 4 Peddlers Row, Unit #323, Newark, DE 19702, USA - the company that provides rewemind. For any question about your data, write to [email protected].
rewemind is in early development
This is an early version of a product that is still being built. Things break, things change, and data may be lost. Please don’t make rewemind the only place where something important lives. Keep your own copies of anything you can’t afford to lose.
What we store
Account. Your email address, display name, password in hashed form (we never see the password itself), your chosen language and settings, and the dates you registered and last signed in.
What you create. Notes, checklists, tasks, events, places, contacts, tags and uploaded files, the links between them and the permissions you give other people. This is your content - we store it so the app can show it to you.
Activity history. For every item we record who created it, edited it, linked it with another item or received access to it, and when. People with access to the item see this history from the moment they got access. The history does not store what exactly was changed. Hiding an item or moving it to the trash is not recorded there - only you see that.
Sign-ins and devices. For every sign-in to your account we record the time, the IP address, the app or browser signature and the approximate place - country and city, which Cloudflare derives from the network (the IP address is not sent to third-party services). The list of devices you have signed in from (device name, first and last appearance: date, IP address, city) is shown to you in your profile. This lets you spot a sign-in that wasn’t you; when someone signs in from a new device or a new country, we send you an email.
Two-step sign-in and consents. If you turn on two-step sign-in, we store its key (with Supabase) and the backup codes in hashed form. We record which version of the Terms and of this Policy you accepted, when, and from which device.
Emails. Service emails (email confirmation, password reset, sign-in and security notices) go to your account email. If you forward emails into rewemind to your capture address, we store them as your content.
The copy on your device. The apps keep an encrypted copy of your data on your device so they can work offline. It stays with you and is erased when you sign out, if you choose so.
Technical records. Our infrastructure providers keep server logs that include IP addresses, timestamps and error traces. We also record anonymous performance measurements (how long an operation took) to find slow spots.
Why, and on what legal basis
| Why | Legal basis |
|---|---|
| Running the service: storing and showing your content, syncing devices, sharing | contract with you (the Terms) |
| Service emails | contract with you |
| Security: sign-in log, new sign-in emails, bot protection at sign-up | our legitimate interest in protecting your account and the service |
| Backups | our legitimate interest in not losing your data |
| Anonymous website visit statistics | our legitimate interest in understanding what people find useful |
| Complying with the law | legal obligation |
None of this needs separate consent. If it ever does - for an optional feature, for example - we will ask first.
Who helps run the service
We use the services of several companies: hosting and database, file storage, sending and receiving email, backups, bot protection, searching places on the map. They process data only on our behalf and only to make the service work. The exact list - who, what for and where - is on the page Who processes data.
Files are stored encrypted, and their keys are kept by a different provider than the files themselves: neither the storage nor the database can decrypt them on its own. The rest of your content (note texts, tasks, contacts) is technically visible to providers; under contract they process it only on our behalf and only to run the service.
When you yourself open the “Refine the point on Google Maps” window or a route, Google receives the place coordinates directly from your device - under its own Privacy Policy.
The mobile apps are distributed by Apple and Google; when you install them, they collect their own data under their own rules.
Transfers outside the EU
The main database is in the EU. Some providers are US companies, and data may be processed there. Such transfers rely on the mechanisms European law allows: the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep data
| What | How long |
|---|---|
| Account and content | as long as the account exists |
| A deleted item | 30 days in the trash, then erased |
| A deleted account | can be restored for 30 days, then erased together with its content |
| Backups | deleted data disappears from them within 60 days after final deletion |
| Sign-in log | 60 days, then deleted automatically |
| Device list | until you remove a device in your profile or delete your account |
| Sent emails in the queue | 30 days after sending |
| An account without a paid plan that no one has signed in to for two years | may be deleted - with email warnings 30 days and one week ahead |
Encrypted backups are made every night. They are used only to recover from a disaster; if we ever have to restore one, anything you deleted in the meantime is deleted again.
Who can see your data
Other users see only what you have explicitly shared, and you can revoke access at any time.
One honest caveat: your content is not end-to-end encrypted. It is encrypted in transit and on disk, but the operator of the service has the technical ability to access the database and the files - as with any hosted product of this kind. We do this only when you yourself ask us to look into a specific problem, or when the law requires it.
Requests from authorities. We disclose data only in response to a valid legal demand, check that it is valid and no broader than necessary, and, where the law allows, tell you about it in advance.
If the company changes hands - for example, in a sale or merger - your data will move with the service, and this Policy will continue to apply. We will tell you about it.
Security
Data is encrypted in transit and on disk, access to it is checked against permissions, sign-in can be protected with a code, and backups are encrypted with keys stored separately. No system is completely secure; if a breach affects your data, we will tell you and, where required, the data protection authority.
Found a vulnerability? Write to [email protected] with the subject “Security”.
Cookies
rewemind does not use cookies. Not on the website, not in the app. We have no advertising trackers.
Website visit statistics. On the rewemind.com website (but not in the app) we count visits with Cloudflare Web Analytics: which pages are opened, where visitors came from, on what device and how long they stayed. These are aggregate numbers without cookies and without IP addresses: no individual can be identified or followed through them. The app has no visit statistics at all.
The app keeps a few things in the browser’s local storage, otherwise it couldn’t work: your sign-in session, your chosen language, theme and date format, and small interface details such as the last page you opened. This is strictly necessary for the service you asked to use; it all stays on your device and is never sent anywhere for tracking.
If this ever changes - for example, if we move the sign-in session into a secure cookie, which we are considering for security reasons - it will be written here, and for anything that isn’t strictly necessary we will ask for your consent first.
Your rights
At any time you can find out what data of yours we hold, get a copy, correct it, delete it, restrict its processing or object to it. Most of this you can do yourself:
- change or delete any item - in the app;
- download everything as one archive in open formats - “Download my data” in your profile;
- delete your account - in your profile.
For anything else, write to [email protected]. We will reply within a month and may ask you to confirm that the request comes from you. If you believe we handle your data incorrectly, you can complain to the data protection authority of your country - see the list on the EDPB website. But please write to us first: we will try to resolve it ourselves.
Children
rewemind is not intended for children under 16. If we learn that an account belongs to a child under 16, we will delete it.
Changes
We will update this page as the product develops; the date at the top shows when. We will tell you about significant changes in the app in advance and ask you to accept the new version. Previous versions are available on request.
Contact
Privacy questions: [email protected]