Privacy policy
Super Secretary is productivity software: PDF and office tools, design, construction calculations and business management. This policy explains what data we handle, what for, and for how long.
1. Who is responsible
Diego Molina. For any privacy question or to exercise your rights, write to support@supersecretary.online.
2. What data we handle
- Account data. Your email address and an encrypted version (a "hash") of your password. We never store your password in the clear. If you sign in with an external provider, we store the identifier that provider gives us. You need an account to use Super Secretary, in the app and on the web, including the free Office tools. To verify your email and to sign in from a new device, we email you a code.
- Device data. Device identifier, operating system, app version and, if you allow it, the push notification token. We use these to send you the reminders you set in the Agenda, to understand which tools get used, and to detect abuse. For each signed-in device we also store whether it is a phone or a computer and a descriptive name (for example "Android · Chrome"), to show you your devices and apply the 1 phone + 1 computer rule.
-
Data for account security and fraud prevention. The following
data is not stored in the clear: it is stored transformed with
a keyed hash function (HMAC-SHA256), which lets us compare ("have we seen this
value before?") but not recover the original:
- the app installation identifier, or the browser identifier on the web (a random value created by the app or page itself);
- a technical device fingerprint: on Android, a SHA-256 of the ANDROID_ID; on the web, a SHA-256 of the screen resolution, time zone, language, platform and number of processor cores;
- the IP address;
- your normalized email (lowercase, without the "+tag" and, for Gmail, without dots);
- for the card used to pay on the web, the brand, last 4 digits and expiry date that Paddle or Polar sends us, depending on who processes your payment. We never receive the full number or the security code.
- Files you upload. Only those for tools that need the server (Office to PDF conversion and back). They are encrypted in transit and deleted automatically after 2 hours.
- Images for background removal. In high quality, the image is processed on our own server by a segmentation model (BiRefNet) that separates the subject from the background; it does not create or alter the content of the image. The image is not sent to third parties and is not stored: it is processed and the result is returned to you.
- Unit counter photos. The photo you choose, and the name of what you want counted if you type it, are sent to our image-analysis provider to get the count. We do not store the photo.
- Usage and billing data. Which tools you use and how many server processes you run per day, so we can apply the daily fair-use limits. Whether you have Premium or are on the free trial, and when it starts and ends. Your subscription status is reported to us by the app store or the payment gateway.
3. What we do NOT handle
- We don't handle data from the tools that work offline: those files never reach our servers.
- We don't store your card number, its security code or the credentials of any payment method. Payments are handled entirely by the app store or, on the web, by Paddle or Polar (Polar Software Inc.). From the card we only keep the hash described in section 2.
- We don't sell or rent your data to third parties.
4. What we use the data for
- Providing the service and running the tasks you ask for.
- Keeping you securely signed in and applying the 1 phone + 1 computer signed-in rule.
- Knowing whether you have Premium and applying the daily fair-use limits.
- Sending the reminders you set yourself in the Agenda.
- Emailing you verification codes and security notices about your account.
- Preventing fraud (for example, repeated free trials) and abusive or shared use of accounts.
- Showing ads to people who use only the free tools.
Legal basis. Performance of the contract you accept when you create your account (providing the service, managing your subscription and your session) and compliance with legal obligations (billing records). The hashed data in section 2 is processed on the basis of our legitimate interest in preventing fraud and protecting account security; you can object by writing to us, but without it we cannot offer you the free trial.
5. Who we share data with
Only with the providers the app needs to work:
- Image-analysis provider for the Unit counter (OpenAI). It receives the photo you want counted and returns the count. Under its business terms, it does not use this data to train its models and may keep it for up to 30 days for abuse monitoring; after that it deletes it.
- Hosting. Our database and our file server, on infrastructure contracted from professional providers.
- App store and subscription gateway (Google Play and, on the web, Paddle or Polar). To validate your purchases and know whether you have Premium or an active trial.
- Email delivery (Resend). It receives your email address and the content of the message to deliver your verification codes and account security notices.
- Advertising. People who use only the free tools see ads. Premium shows none.
6. How long we keep the data
- Files uploaded to the server: 2 hours.
- Background-removal images and Unit counter photos: we do not store them; the image-analysis provider may keep counter photos for up to 30 days for abuse monitoring.
- Account and device data: for as long as the account is active.
- Codes sent by email: they expire after a few minutes and work only once.
- Free trial record (hashed values only, without your email or name in the clear): kept even if you delete your account, for as long as needed to prevent the trial from being repeated.
- Billing records: for as long as applicable tax law requires.
7. Your rights
You can access your data, correct it, ask us to delete it, object to certain processing and request a copy. To exercise these rights, write to support@supersecretary.online. You can delete your account yourself from inside the app: see the Delete account page.
8. Children
The app is not aimed at children under 13 and we do not knowingly collect their data. If you find that a child has created an account, write to us and we will delete it.
9. Security
We encrypt communications with the app, store passwords using hash functions and restrict access to the database. No system is foolproof, but we work to reduce the risk.
10. Changes to this policy
If we change it, we will update the date in the header. If the change is significant, we will let you know inside the app.