Privacy Policy

startorstop.now ("startorstop", "we", "us") lets you declare that you're starting or stopping something, track daily check-ins, and choose whether that record is private or public. This page explains what we collect, why, and what control you have over it.

What we collect

Account information. Your name and email address, and a hashed (never plain-text) password if you sign up with email/password. If you sign in with Google instead, we receive your name, email, and profile picture from Google — we never see or store your Google password.

Content you create. The activities you start or stop, your daily check-ins, any category or note text you add, and reactions or support messages you post on public activities.

Technical data. Session cookies to keep you signed in, and, per sign-in session, the IP address and browser user-agent string used to create it (used only for security — detecting abuse and unusual account activity — never sold or used for advertising).

Aggregate traffic analytics. We use Cloudflare Web Analytics to see overall traffic patterns like page views and referrers. It's cookieless and doesn't track you individually or across other sites.

We do not run advertising trackers or sell your data to anyone, and we do not use your data to train any AI model.

Public vs. private, and what that means

Every activity you create is private by default. It becomes visible to others — on the public feed, your public profile, and a shareable link — only when you explicitly mark it public. Private activities and check-ins are never shown in public feeds, profiles, share pages, or the images you generate. You can change an activity's visibility at any time.

How we use your data

To operate the product: authenticate you, save and show your activities and check-ins, render the shareable images you generate, and show public content to other users exactly as you've chosen to share it. We also use technical data to rate-limit abuse (for example, scripted sign-up or check-in spam) and to keep the service secure.

Who we share data with

We use third-party infrastructure to run the product: a database host, our hosting provider, and, if you choose to use it, Google for sign-in. These providers process data on our behalf under their own security commitments — we don't sell or share your data with anyone for their own marketing purposes. If we ever add the ability to publish directly to a social network (for example, X or Instagram) on your behalf, that will require your explicit, revocable connection, and we'll update this policy before it goes live.

How long we keep it

We keep your account and activity data for as long as your account exists. You can permanently delete your account at any time from Account settings. Deleting your account immediately signs you out everywhere, removes your name, email, username, and profile image, and replaces your email with a placeholder that can't be traced back to you — this cannot be undone. For product-integrity reasons, the activities and check-ins themselves are kept but are no longer associated with any visible name, email, or public profile.

Security

Passwords are stored using a salted, one-way hash — never in plain text. Session cookies are HTTP-only and restricted to this site. Sign-in and sign-up are rate-limited to slow down automated abuse. If we ever store third-party access tokens (for a social publishing connection you set up), they are encrypted at rest and never sent to your browser.

Your rights

You can access and edit most of your data directly in the app. You can delete your account and personal data at any time, as described above. If you have a question or request about your data that isn't covered by the in-app controls, contact us using the details below.

Children

startorstop is not directed at children, and we don't knowingly collect data from anyone under 13 (or the minimum age required in your country).

Changes to this policy

If we make a material change to how we handle your data, we'll update the date at the top of this page and, where appropriate, let you know directly.

Contact

Questions about this policy or your data: [contact email placeholder].