GDPR Policy

What is GDPR?

GDPR stands for General Data Protection Regulation. A new law enforced by the EU to protect end users' personal data. This law enforces several aspects of data security. Here we want to give a guideline on how we protect your data, what is our responsibility, and what is your responsibility. We strongly suggest you read all our documentation or other articles about GDPR and take a decision on whether you want to use our application or not. We are not responsible for any negligence or fault on data protection on your side or any third party's side. Take your time to read documentation and act wisely, stay safe.

Definition of Personal Data

Any data owned by an individual is his or her personal data. It could be someone's name, image, email address, physical address, social media post, location, computer IP address, etc. The ownership of a user's personal data is absolute. That means wherever and however the data is saved, it belongs to the user solely. The data collector or data user (Facebook, YouTube) cannot show, save, share, or perform any other activity with a user's personal data without the user's explicit or implicit permission. If a user gives permission to use his or her data for a specific type of action (data storing, data viewing, etc.), then it can be used by the admin of the application.

To visualize this, consider a hypothetical situation. You post a status on social media. Here you have given implicit permission to show the post to your public or private contacts. The application admin is not responsible for any abusive comment made on your post by your contacts. This means that if you made your data public, then it is your responsibility. But the application admin does hold responsibility for any data sharing with third parties. If any data is shared, it must be stated explicitly in advance. So we see how data uploading and showing depends on both the app admin and the user. Further details you will get upon reading the full documentation.

Responsibility of Developer

The safeguard of user personal data on the application back end is the responsibility of the developer. The developer is responsible for how user data (name, telephone no., email, etc.) and other info (like logs of user interaction with the application) is stored on the database and server. We will describe in detail how the data you submit directly (name, email, etc.) and indirectly (browser name, computer IP, etc.) are saved on the database and server. Once any data is uploaded to the server, the security of the data depends on the security of the server and sometimes the admin of the application.

Users will be notified about all temporary (cookie and session) and permanent (data saved to database) data saving. Users will get the option to have all their personal data erased permanently upon account deletion or service cancellation. We assure you that we do not keep logs of user activity or any other backdoor to extract user data.

Sometimes cPanel access and other credentials of the app admin are needed by the developer to support and maintain the application for a short time before the application goes fully online. We strongly recommend that the app admin change these credentials after the job is done. The developer cannot be held responsible for any credential leak on this ground. The developer also cannot be held responsible for any unintentional security glitch on the application. After all, data shared online always carries the risk of getting leaked. So we strongly suggest not sharing any data that can compromise you or any other individual.

Responsibility of Application Admin

The application admin has unrestricted access to user personal data. The admin can access the database, server logs, and any other info within the admin's reach. The app admin can see and copy the data saved on the database and server, and can share a user's personal data with third parties. How the user's data is used must be announced by the app admin explicitly before user registration. The admin should not allow anyone to extract data openly or under the disguise of a survey, form, or any other means. The app admin enjoys the most privilege on the application, so the admin has the highest responsibility for safekeeping the user's personal data.

User's Responsibility

It all depends on the user. If a user does not submit data, then there will be no data breach — but this is not really an option. The top priority for a user is to read all the documentation from both the app developer and app admin before submitting data. Safekeeping of a user's own credentials is the sole responsibility of the user. Passwords and usernames may be encrypted in the database, but a dictionary word or too predictable a password for a specific user can give a hacker easy access to the user's account. Change your credentials at any sign of suspicious activity by an unauthorized person, or in case you share your credentials with others for some unavoidable reason. Always think before you submit.

Our Action on GDPR

• Collect as little data as possible. Tell the user the necessity of collecting specific data.
• Enforce HTTPS.
• Destroy all sessions and cookies after logout.
• Do not track user activity for commercial purposes.
• Tell users about any logs that save computer IP and location.
• Clear terms and conditions.
• Inform users about any data sharing with third parties.
• Create clear policies about data breaches.
• Delete data on cancelling a subscription or account deletion.
• Patch web vulnerabilities.

Supported GDPR Features

Adios, Application

Once you cancel your subscription or delete your account, we give you the option to delete all your data existing or related to your account. Note that this action is irreversible — the moment you say yes to deleting your data, it will be erased from the database and server forever. You can back up your data before deletion in case you re-subscribe or re-register.

Secrecy is My Right

We encrypt most of your personal data in the database. If a data breach occurs, the hacker will get an encrypted hash, not your personal data in plain text — so your secrecy stays intact even in the case of a breach. Note that some data cannot be encrypted because we need to show it upon login to your account (like username). We will hide all your personal data as much as possible.

No Cookie and Session Saving

We give you the option to save or not save cookies and session data. Even if you save cookies and session data, these will be destroyed after logout. We strongly suggest you do not save your credentials in the browser. Please memorize your credentials or use a tool like LastPass to manage them.

Destroy Footprints

We do not save or track any of your activity for commercial purposes. We may store your login time or IP for security purposes only. When you delete your account, every single piece of your data will be deleted from the server.

Social Engineering is Bad

We do not record any of your personal activity on the application. Recording a user's personal activity, analyzing it, and trying to sell a product or steer the user's thinking based on that analysis is becoming a malpractice. We do not do such things.

Notify Me

Get notified about all activity relating to your account (account creation, password change) by email. We suggest you change your credentials if anything unusual occurs.

Policy Update Notification

You will get notified of any privacy policy or disclaimer updates. Read your email regarding this matter and decide on your action. Feel free to reach out to us on this matter.

Connect Without Worry

We enforce HTTPS everywhere, so data sniffing is not possible. Even if it were, the sniffer would only get an encrypted hash. So feel safe using our application.

No Data Collecting

We do not collect any extra data on users. No backdoor, no hidden option to collect data. Once the application is uploaded to the server, even we cannot enter the application without the app admin's password. So do not worry about any hidden data leak.

Data Breach Policy

We implement all reasonable security measures to store your data carefully in the database (data encryption, MySQLi, SQL injection prevention, input checking, etc.). But we do not take responsibility for data breaches originating from the server, because it is the total responsibility of the app admin and server admin to secure your data from breaching. Any weak or too predictable a password from the app admin or server admin could compromise the database. Any inherent fault in database configuration can expose the database (e.g. MongoDB security misconfiguration). Any security flaw on the server can lead to data leaking. Please contact your app admin regarding this.