Privacy Policy

Who we are

• ·LiberaMente is a personal productivity application developed by Cristiano Sticca (individual), based in Italy.
• ·For any privacy-related questions, you can reach us at: cristianosticca@gmail.com

Your data is yours

LiberaMente is built with a local-first architecture: all your GTD data (tasks, projects, contexts, references, notes) is stored directly on your device (browser IndexedDB) and works completely offline. We do not collect, sell, or share your data with third parties for advertising or profiling purposes.

Data we collect

• ·Email address — used exclusively for OTP code authentication. We do not use social login (Google, Apple, etc.).
• ·GTD content (Free Plan) — tasks, projects, contexts, references, notes, and recurring templates. This data is saved only on your device and never reaches our servers.
• ·GTD content (Premium Plan) — the same data is synced to a Supabase database hosted in the EU region (Frankfurt) to enable backup and multi-device access.
• ·Media files (Premium Plan) — audio recordings, photos, and videos captured via the capture feature. Stored on Supabase Storage in the EU region.
• ·Google Calendar token (optional) — if you choose to connect Google Calendar, we store the OAuth2 token on Supabase to sync your events in read-only mode. You can revoke access at any time from Settings.

What we do not collect

• ·No behavioural tracking or profiling: we only measure anonymous page visits, without cookies (see below).
• ·No third-party advertising SDKs.
• ·No data sharing with social platforms.
• ·No statistics on what you create or complete in the app. If you open optional chat, Tawk.to may receive technical browsing data as described below.

How we use your data

• ·To provide and maintain the service (authentication, Cloud sync, backup).
• ·To send the OTP code to your email address so you can sign in.
• ·To sync your GTD data across devices (Premium Plan only).
• ·We do not use your data for marketing or profiling purposes.

Third-party providers

• ·Supabase Inc. — authentication, database, and storage. Data is hosted in the EU region (Frankfurt, AWS eu-central-1). Privacy policy: supabase.com/privacy
• ·Vercel Inc. — app hosting and anonymous visit statistics (Vercel Web Analytics). Details: vercel.com/docs/analytics/privacy-policy
• ·Tawk.to — optional support chat, loaded only after your confirmation and when you open support. Details: www.tawk.to/privacy-policy/
• ·Google LLC — only if you connect Google Calendar. Your calendar data is read in read-only mode and is not stored outside your device, except for the access token. Privacy policy: policies.google.com/privacy
• ·Groq Inc. — only if you enable the optional AI suggestion features (they require your explicit consent via Settings; the same consent covers both features below). Privacy policy: groq.com/privacy-policy
• ·· "What should I do now?" — to pick the most suitable action for the moment, only the title, required energy level, estimated duration, and due date of candidate actions are sent to Groq. Notes are never shared.
• ·· "Suggest everything" in the Clarify step — to propose a project, contexts, energy, duration, a possible delegate, and timing, the title AND the notes of the item being clarified are sent to Groq, along with the names of your existing projects and contexts, and the names of people you have recently delegated to. This is a broader sharing scope than "What should I do now?" — consider it before enabling AI suggestions if your notes contain sensitive information.

Anonymous visit statistics (Vercel Web Analytics)

• ·We measure page visits with Vercel Web Analytics to understand which parts of the website and the app are used. It uses no cookies and does not build a profile of you.
• ·For each visit Vercel may record: date and time, the page visited, the referring site, approximate location (country, region, city), operating system, browser and device type. Before sending, we remove query parameters, item identifiers and codes (for example partner codes) from the page address, so only the routes remain.
• ·The data is aggregated and is not linked to your account, your IP address or your GTD content. Vercel tells visitors apart with a temporary code derived from the request, deleted after 24 hours, which cannot be used to reconstruct your browsing on other sites.

Optional support chat (Tawk.to)

• ·Before loading Tawk.to, we explain how it works and ask for confirmation. Without confirmation, we do not load its script or contact Tawk. Even with a saved confirmation, on each new visit the service loads only when you open chat.
• ·Tawk.to may use cookies or similar technologies and receive your IP address, browser and page information, and the messages you choose to send. We do not automatically send your email, profile or GTD content. Do not include sensitive information in messages.
• ·We store confirmation and the preference to hide the launcher locally on this device. You can clear confirmation using Chat preferences in the website footer or app Settings.
• ·Hiding or closing chat does not stop connections from the service already loaded. To stop them, reload the page without reopening chat; clearing confirmation requires a new choice next time you open it. This does not delete conversations or data already received. Contact us for data requests. For the provider's processing, see www.tawk.to/privacy-policy/

Connected AI agents (Premium Plan)

• ·If, with the Premium Plan, you connect an AI agent to LiberaMente (via OAuth or a personal API key), the agent can read and modify your GTD data only with your authorization. This is your own data, not anyone else's.
• ·We record a log of the changes the agent makes: which tool was used, on which item (with its title), when, and through which connection. We do not store the full content.
• ·The log is visible to you in Settings → AI agents, is kept for 90 days, and is then deleted automatically.
• ·You can revoke any connection at any time from Settings.

Data retention

• ·Local data — remains on your device until you uninstall the app or clear your browser data. We have no control over it.
• ·Cloud data — retained while your account is active. Upon a deletion request, data is removed within 30 days.
• ·Email — retained while your account is active. Deleted along with the account upon request.
• ·Supabase Auth logs — retained for a maximum of 90 days for security purposes.

Security

• ·Local-first architecture: your GTD data does not leave your device unless you activate the Premium Plan.
• ·All communications use HTTPS.
• ·Data on Supabase is protected by Row Level Security (RLS): each user can only access their own data.
• ·No passwords stored: authentication uses one-time OTP codes only.

Your rights (GDPR)

• ·Right of access — you can request a copy of the data we hold about you.
• ·Right to rectification — you can ask us to correct inaccurate data.
• ·Right to erasure — you can request deletion of your account and all associated data.
• ·Right to data portability — you can request your data in machine-readable format.
• ·Right to object — you can object to the processing of your data at any time.
• ·To exercise any of these rights, contact us at: cristianosticca@gmail.com

Children

LiberaMente is not intended for users under 16 years of age. We do not knowingly collect personal data from minors. If you believe we have received data from a minor, contact us and we will delete it immediately.

Changes to this policy

If we make material changes, we will update the date at the top of this page. For significant changes that affect data processing, we will notify you by email.

Contact

For questions, requests, or privacy-related reports: cristianosticca@gmail.com