Privacy policy
This policy covers Ainoova Tools at tools.ainoova.com: ten small web tools (Notes, Tasks, Later, Habits, Journal, Renewals, Subs, People, Forms and Short) that you can use yourself and connect to an AI assistant such as Claude. The controller is Gabriel Rosinol Vidal, trading as Ainoova, Barcelona, Spain. Contact: privacy@ainoova.com.
What we keep
- Account: email, name, password hash (never the password), time zone, and whether your email is confirmed.
- Your content: what you put in the tools. It is used only to run the tools for you.
- Billing: handled by Stripe; we store your Stripe customer id and subscription status, never card numbers.
- Activity log: who changed what and when, kept 180 days.
- Forms you publish: the answers people send, plus a hashed IP (for rate limiting), referrer and browser, so you can triage spam. You are the controller for those answers.
- Short links: a click counter and the time of the last click. No cookies, no IPs.
- Cookies: one session cookie to keep you signed in, and a short-lived one during Google sign-in. No analytics or advertising cookies.
Signing in with Google
If you choose “Continue with Google”, we ask Google only for the basic sign-in scopes openid, email and profile. From your Google Account we receive and store:
- your email address, and the fact that Google has verified it;
- your name, to greet you and label your account;
- Google's account identifier for you, so the same Google login reaches the same account next time.
We use this information only to create your account, sign you in and keep that account secure. We do not ask for or access your Gmail, Contacts, Drive, Calendar or any other Google data, and we don't keep Google access or refresh tokens after sign-in. We don't sell Google user data, use it for advertising, or share it with anyone, except the hosting and database providers listed below that store your account for us.
Ainoova Tools' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove this data at any time: Account → Delete account erases your account, including the Google identifier, name and email, immediately. You can also revoke our access from your Google Account under Security → Third-party connections.
Why (legal basis)
To provide the service you signed up for (contract), to bill you (contract, legal obligation), and to keep it secure (legitimate interest). No advertising, no selling data, no third-party trackers.
Who processes it
Vercel (hosting), Neon (database), Stripe (payments), Resend (account emails such as password resets and email confirmation) and Google (only when you choose Google sign-in). When you connect an AI assistant, the data you ask it about is sent to that assistant's provider under your own agreement with them.
How we protect it
All traffic is encrypted (HTTPS). Passwords are stored as salted scrypt hashes, API keys and session tokens as hashes. Each account only ever sees its own records, and every change is logged with who made it.
How long
Until you delete it or your account. Trashed items are erased after 30 days. Deleting your account erases everything immediately, apart from invoices we must keep by law.
Your rights
Access, rectification, erasure, portability (Account → Export), restriction and objection: write to the address above. You can also complain to the Agencia Española de Protección de Datos (aepd.es).