This policy explains what Papertray collects, why, who else handles it, and the choices you have. In short: we keep what's needed to run your to-do lists, we record how the app is used so we can improve it, and we never sell your data or show you ads.
Who is responsible
Papertray is run by , a sole trader in Portugal (NIF , ). They are the data controller for the personal data described here. Contact for anything about privacy: .
What we collect
- Your account: your email address, your password (stored only in hashed form by our authentication provider), your first and last name, and your profile photo if you add one.
- What you write: your areas, projects, headings and to-dos, with their dates, tags and who they're assigned to.
- Sharing: who you share projects and areas with, and the email addresses you send invites to.
- Visits and device type: each time you open Papertray while signed in, we log when the visit started, how long the app was open and visible, whether you used the website, the installed web app or the Mac app, and the kind of device: phone, tablet or computer, operating system, browser, window size, time zone and language. We use this to see how Papertray is used, for example how many people use it each day and on which devices. It never includes the text of your to-dos.
- Error reports: when something breaks in the app, it sends the error message, a technical trace, the page it happened on and your browser's identification string, so we can fix it. Never the text of your to-dos.
- Team activity log: in projects and areas shared under a Team plan, the app records who added, completed, assigned, renamed, moved or deleted which to-do, and who joined or left. Only the owner of the shared project or area can see this log.
- Payments: when paid plans launch, payments will be handled by our reseller (see below). We will receive your plan, billing country and a record of payments, never your card details.
Why we use it, and on what basis
- To provide Papertray (your account, lists, sharing, sync between devices, support): necessary to perform our contract with you.
- Visits, device type and error reports, to understand how Papertray is used, fix problems and decide what to improve: our legitimate interest in running and improving the service. You can turn this off at any time in Settings → Privacy (“Share usage statistics”).
- Billing records: to meet our tax and accounting obligations under Portuguese law.
We don't sell personal data, use it for advertising, or use your to-dos to train any AI model.
Who else handles your data
We use a small number of service providers who process data only on our instructions:
- Supabase: database, sign-in and file storage, where everything above is stored. Hosting region: .
- GitHub Pages (GitHub, Inc.): serves the website and app files. Like any web server it processes your IP address to deliver them.
- Our email provider, to send sign-up confirmations and password resets.
- Paddle, once paid plans launch: Paddle sells the subscription to you as merchant of record and handles payment, invoices and sales tax under its own privacy policy.
Some of these providers are based in, or may access data from, outside the European Economic Area. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
- Your account, content and visit log: for as long as you have an account. When you delete your account, they are deleted within 30 days.
- Error reports: 90 days.
- Team activity log: 180 days.
- Billing records: as long as Portuguese tax law requires (currently 10 years).
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. To delete your account or exercise any of these rights, write to ; we answer within one month. You can object to visit logging and error reports yourself, in Settings → Privacy.
If you think we've mishandled your data, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or the authority where you live.
Storage on your device
Papertray stores your sign-in session and a few preferences in your browser's local storage so you stay signed in. It uses no advertising or third-party tracking cookies, so there is no cookie banner.
Children
Papertray isn't meant for children under 13, and we don't knowingly collect their data.
Changes
If we change this policy in a way that matters, we'll tell you in the app or by email before the change applies. The date at the top shows the latest version.