Privacy policy

Who we are

Fairshare is run by Johannes van der Merwe, a sole trader in the United Kingdom. He is the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). "We" on this page means him.

Contact: support@pangolin.technology. A person reads every message.

What we hold, and why

Your account

• Your name and email address, and whether you have confirmed the address.
• If you set a password: a one-way bcrypt hash of it, never the password itself. We also count failed sign-ins and lock the account for 15 minutes after 10 in a row, to stop guessing.
• When you agreed to these documents, and which version.
• Your sessions: a random token per signed-in browser, which expires after 30 days.
• Personal access tokens you create for the command-line tool: we keep a hash of each, its name and when it was last used, never the token.

Why: to run your account and keep it secure. Legal basis: performing our contract with you (the terms).

Signing in with Google

If you use Google, Google tells us your name, email address, your Google account id and a link to your profile picture, and gives us sign-in tokens, which we store. Your picture is not copied: it is loaded from Google when Fairshare shows it to you or your team. Legal basis: our contract with you.

Your teams and the work you log

• The teams you belong to, your role in each and when you joined.
• Tasks, categories, schedules and who each task is assigned to.
• Every completion: who did the task, when, how much effort it took, any notes, and any later edit or skip.
• Email addresses you send invites to.

Taken together, this is a record of who does what in your household or team. That is the point of Fairshare, and it is also the most personal thing we hold, so we treat it that way. Everyone in a team can see that team's tasks and completions, including names and notes. Write notes on that basis.

Legal basis: our contract with you. When you enter someone else's name or email address (an invite, or a member you add), we process it in our and your legitimate interest in running a shared list, and you should only add people who know they are being added.

Email you forward to a team address

A team can have its own address. Email forwarded to it becomes a task. For each message we keep the sender's address, the address it was sent to, the subject, when it arrived and what we read out of it: a title, notes, a due date, a category and a person to assign. We do not keep the full message. Our email provider, Resend, receives it and we read it from there.

Forwarded mail can hold other people's personal data, and they did not agree to send it to us. Only forward mail you are entitled to share with your team. We process it in your legitimate interest in turning it into a task, and we keep what we read out of it with the team.

Notifications and email we send

• In-app notifications, and your choices about which ones you get by push or email.
• For each device you turn push notifications on for: the address your browser's push service gives us, its encryption keys and the browser name. The message is encrypted, so the push service (run by your browser's maker, for example Apple, Google or Mozilla) cannot read it.
• A log of every email we send you: the address, the subject, when, and whether it was delivered or bounced.

Legal basis: our contract with you.

Google Drive, if you connect it

A team admin can connect Google Drive to export a team report there. We then hold the Google account id and email address that connected it, and Drive tokens, which are encrypted before they are stored. We ask only for access to files Fairshare creates, not the rest of your Drive. Legal basis: our contract with you.

Logs and traffic numbers

Our host, Vercel, logs each request (including your IP address and browser) to keep the service running and to investigate faults. We also use Vercel Web Analytics and Speed Insights to count page views and measure how fast pages load. Neither sets a cookie or follows you to other sites. Legal basis: our legitimate interest in running a reliable service.

What we do not do

We do not sell your data, show advertising or share data with advertisers, or build profiles of you for anyone else. We use your data only to run Fairshare.

Who else processes it

These companies process personal data for us, under contract, only to provide their service:

• Vercel: hosting, request logs, Web Analytics and Speed Insights.
• Prisma (Prisma Postgres): the database everything above is stored in.
• Google: sign-in with Google, and Google Drive if you connect it.
• Resend: sending our email and receiving email forwarded to team addresses.

Some of them process data outside the UK, including in the United States. Where they do, the transfer relies on UK adequacy regulations or the safeguards in their data processing terms. This list can change. The current list is always this page, and the version at the top changes when it does.

Within Fairshare, the people in your teams see what is described above. The person who runs Fairshare can see every team, to fix problems and answer support requests.

How long we keep it

• In-app notifications: 90 days, then deleted.
• Sessions: 30 days. Email confirmation and password reset links expire.
• Everything else: until you delete your account, or until the team it belongs to is deleted.

When you delete your account, some records stay, because they belong to a team or are our record of what we sent:

• Completions in a team you shared stay with that team, credited to nobody. They are the team's record of work done. Before you leave a team you can also choose "Remove my name from it", which does the same without deleting your account.
• Our log of email sent to you keeps the address and subject, no longer linked to an account.
• Mail you forwarded to a team address stays with that team, with the sender's address.
• Invites you sent stay with the team, no longer linked to you.

Your rights

You can, at any time:

• See what we hold and download a copy as a JSON file, from your account page (in the menu, signed in).
• Delete your account from the same page. If you own a team, it passes to the longest-standing admin, or to the next member, who becomes admin. A team where you were the only member is deleted with you.
• Ask us to correct, restrict or stop processing your data, to object to it, or for a copy or erasure if you cannot sign in. Email support@pangolin.technology. We reply within 30 days.

If you are unhappy with how we handle your data, tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.

Cookies

We set one cookie to keep you signed in. While you sign in with Google, and when you connect Drive, we also set short-lived cookies that protect that step from forgery, and one that carries your "I agree" across to Google and back. They are all strictly necessary, so we do not ask for consent and there is no cookie banner. There are no analytics or advertising cookies. If that ever changes, this page will say so first.

If you install Fairshare as an app or turn on push notifications, your browser also stores a small script from us (a service worker) that makes that work.

Age

You must be 16 or over to have an account. Other people, children included, can still be named in a team's tasks and notes. The account holder who writes their names is responsible for that.

Changes

When this policy changes, we update it here and change the date and version at the top. If a change affects what we do with your data, we will email you before it applies.