← DesignerSystemsDigital

Privacy Policy

Effective: 1 July 2026 · DesignerSystemsDigital

This Privacy Policy explains how DesignerSystemsDigital ("we," "us," or "our") collects, uses, discloses, and safeguards information when you use our websites and applications (collectively, the "Services"). By using the Services, you agree to the practices described here.

1. Who we are

DesignerSystemsDigital is a sole-trader operation based in New Zealand. We build and operate the Services listed below. For privacy enquiries, contact [email protected].

2. Services covered

3. What we collect

The data we collect depends on which Service you use.

3.1 All Services (auth only)

• Email address — used to sign in and contact you about your account.
• Password — stored as a one-way hash (Supabase Auth; we never see the plaintext).
• Auth session token — stored in a first-party cookie (sb-<project-ref>-auth-token) to keep you signed in.

3.2 Pawprint

• Profile data — display name, username, bio, avatar URL (all optional).
• User-generated content — posts (text, video, audio), hashtags.
• Engagement signals — uppaws (likes), downpaws, follows.
• Notifications — generated from engagement, stored server-side.
• Subscription state — Stripe customer ID, subscription ID, status (managed by Stripe; we don't see card details).

3.3 NoteTree

• Files and folders — content you upload, folder names, organisation metadata.
• Storage usage — bytes consumed, used to enforce plan limits.

3.4 StatsIRL

• Workout data — exercise logs, sets, reps, durations, calendar history.
• Social graph — friend connections, follow state.
• Push notification tokens — via OneSignal (so we can send you friend activity updates).

3.5 Marketing site (designersystemsdigital.xyz)

We do not collect personal data on this site. Cloudflare may collect aggregated, non-identifying analytics (request counts, country-level geo) for performance and security. No cookies, no third-party trackers.

4. How we use your data

• To provide the Service you signed up for.
• To authenticate you and keep your account secure.
• To process subscription payments (via Stripe — stripe.com/privacy).
• To send transactional emails (verification, password reset, receipts).
• To send push notifications you have opted into.
• To respond to support requests.

We do not sell your data. We do not serve third-party advertising.

5. Third-party processors

Provider	Purpose	Data shared
Supabase (database + auth)	All app data and authentication	All data listed in §3
Cloudflare (hosting + CDN)	Web hosting, DDoS protection	HTTP request metadata
Stripe (payments)	Subscription processing (paid apps only)	Email, payment method (tokenised)
OneSignal (push)	StatsIRL push notifications	Device token, user ID

6. Cookies and local storage

• Supabase auth cookie — first-party, strictly necessary for sign-in. Expires on sign-out or 1 year idle.
• SharedPreferences (mobile/web) — used by apps to store user preferences (e.g. theme). Never leaves your device.
• No advertising cookies. No third-party analytics cookies.

7. Data security

All data is encrypted in transit (HTTPS / TLS 1.3) and at rest (Supabase default disk encryption). Access to production data is limited to the operator. Passwords are hashed with bcrypt via Supabase Auth. Supabase Row-Level Security (RLS) is enabled on every table — clients can only read or modify rows they own.

8. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (edit in-app where available).
• Delete your account and all associated data — use the in-app delete option or email [email protected]. Deletion is permanent within 30 days.
• Export your data in a portable format (JSON; email us to request).
• Opt out of push notifications via your device settings.
• Lodge a complaint with the New Zealand Privacy Commissioner (privacy.org.nz) or your local supervisory authority.

9. Data retention

We retain your account data for as long as your account is active. If you delete your account, all associated data is permanently deleted within 30 days, except where retention is required by law (e.g. tax records for paid subscriptions, retained for 7 years per NZ Inland Revenue).

10. Children

The Services are not directed to children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided data, contact us and we will delete it.

11. International transfers

Data is stored in the United States (Supabase us-east-1, Cloudflare global edge). By using the Services, you consent to transfer of your data to the US. Supabase and Cloudflare participate in standard contractual clauses for EU/UK data transfers.

12. Changes to this policy

We may update this policy. Material changes will be announced via in-app banner and/or email at least 14 days before they take effect. The "Effective" date at the top will always reflect the latest version.

13. Contact

Privacy enquiries: [email protected]
General support: [email protected]
DesignerSystemsDigital · New Zealand

Effective 1 July 2026. Previous versions available on request.