Privacy notice
This page explains what personal data MancsNaptár (mancsnaptar.hu and the mobile app) processes, why, for how long, who has access to it, and what your rights are under the EU General Data Protection Regulation (GDPR).
1. The controller
<name / company name>
E-mail: info@mancsnaptar.hu
2. What we process
- Account data: your e-mail address and whether you confirmed it, your username, your display name, your profile picture (one you upload, or your Google account's when you sign in with it), your language, and your appearance and e-mail notification settings.
- Sign-in: Supabase Auth signs you in, with a one-time code sent by e-mail or with your Google or Apple account. Supabase stores the sign-in identities and sessions of your account.
- What you do in the app: the requests you send and receive (who to whom, when, the optional message and their status), your notifications, your invite links, the log of the requests' steps, and the record of the e-mails sent to you (address, type, delivery status).
- Technical data: the server logs each request's time, path and status code; the abuse limits use your IP address briefly, in memory.
3. Why, and on what legal basis
- Running your account and the service, signing you in, sending notifications and e-mails: performance of the service (GDPR Art. 6(1)(b)).
- Keeping the service secure, preventing abuse, and the backups: legitimate interest (GDPR Art. 6(1)(f)).
We never use your data for advertising or profiling, and we never sell it.
4. For how long
- Account data: until you delete the account. How the deletion works, and what is kept without your name, is on the Delete your account page.
- Read notifications are deleted 90 days after you read them, and the record of sent e-mails after 90 days; an address that bounced or complained is kept so we never mail it again.
- Database backups are deleted after 30 days, so deleted data can remain in an earlier backup for at most that long. We never restore a deleted account from a backup.
5. Processors
| Provider | Task, where the data is |
|---|---|
| Supabase supabase.com/privacy |
Sign-in and account management (Supabase Auth). Ireland (EU, eu-west-1). |
| Render render.com/privacy |
Hosting of the website, the server and the database. <Render region, e.g. Frankfurt (EU)> |
| Resend resend.com/legal/privacy-policy |
Sign-in codes and notifications by e-mail. Ireland (EU). |
| Cloudflare cloudflare.com/privacypolicy |
The domain's name service (DNS), storage of uploaded pictures (R2, EU jurisdiction) and of the database backups (R2). |
| GitHub docs.github.com/site-policy |
The machine that runs the nightly database backup (it puts the backup into R2 and keeps no copy). United States. |
| Google policies.google.com/privacy |
Only if you sign in with Google: your name, e-mail address and profile picture are passed on for the sign-in. |
| Apple apple.com/legal/privacy |
Only if you sign in with Apple: your e-mail address (or the one Apple hides it behind) is passed on for the sign-in. |
Several providers are US companies. Where data leaves the EU, the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
6. Data stored in your browser
We use no cookies. Your browser's local storage (localStorage) keeps your sign-in session, your language and your appearance settings; they stay on your device and go away when you clear the browser's data. There is no analytics or advertising tracker on the site.
7. Your rights
- Access and portability: on request we send you your data in a machine-readable (JSON) form.
- Correction: you can change your name, profile picture and settings on the Profile page at any time.
- Erasure: you can delete your account yourself on the Profile page (Delete your account).
- Restriction, and objection to processing based on legitimate interest.
- Complaint to a data protection supervisory authority — in Hungary the NAIH (naih.hu) — or to a court.
Write to info@mancsnaptar.hu from the e-mail address you signed up with; we answer within one month.
8. Security
Every connection is encrypted (HTTPS). The server accepts only sign-in tokens signed by Supabase, limits the rate of requests, and lets everyone reach their own data only.
9. Changes
When this notice changes materially, the date at the top changes too. The terms of using the service are in the Terms of use.