Privacy Policy

1. Introduction

With this Privacy Policy, we inform you about the type, scope, and purpose of the processing of personal data ("Data") within the scope of using the service Super Productivity Sync. This policy also explains your rights under the General Data Protection Regulation (GDPR).

2. Data Controller

Johannes Millan
Hauptstraße 4H
10317 Berlin
Germany

Email: contact@super-productivity.com

A Data Protection Officer has not been appointed as the statutory requirements for this are not met (fewer than 20 persons constantly involved in data processing).

3. What Data We Process

(1) Inventory Data

Email address
Password (stored exclusively as a cryptographic hash)
Registration date
Account status information (e.g., Active, Inactive)

(2) Content Data

This includes all data you save in the "Super Productivity" app and synchronize via the Service:

Tasks
Projects
Notes
Time tracking entries
Settings

Note: If End-to-End Encryption (E2EE) is activated, this data exists on our server exclusively in encrypted form.

(3) Meta and Log Data

Technically necessary when accessing the server:

IP address
Time of access
App version / Browser type
Operating system
Error and diagnostic information

4. Legal Basis for Processing

We process your data based on the following legal bases:

(1) Performance of Contract (Art. 6(1)(b) GDPR)

Storage of your account
Synchronization of your content
Technical provision of the Service
Sending security-relevant system emails (e.g., password reset)

(2) Legitimate Interest (Art. 6(1)(f) GDPR)

Server and service security
Detection and defense against misuse (DDoS, brute force attacks)
Error analysis and stability improvement

(3) Legal Obligations (Art. 6(1)(c) GDPR)

This applies to tax retention obligations for paid plans or official requests for information.

5. Hosting and Infrastructure

The Service is hosted by:

Alfahosting GmbH, Ankerstraße 3b, 06108 Halle (Saale), Germany

Where this provider processes personal data on the controller's behalf, Art. 28 GDPR requires a Data Processing Agreement between them. Details of that arrangement, and of the location of processing, are available on request from the controller named in Section 2.

6. Data Processing during Synchronization

A) Standard Synchronization (without E2EE)

Your content data is transmitted via TLS/SSL transport encryption.
It is stored in our database on the server. No end-to-end encryption is used here.
Access by the Provider is technically possible but occurs exclusively if required for maintenance, diagnosis, or defense against technical disturbances.

B) End-to-End Encryption (E2EE – optional)

If you enable E2EE in the app:

Your data is encrypted locally on your device before transmission.
The server stores only encrypted data blocks ("Blobs").
We have no access to your keys and cannot restore, decrypt, or view the data.
Loss of the key results in permanent data loss.

7. Email Sending

We send exclusively transactional emails (e.g., password reset, email address confirmation, security-relevant system messages). Data processing is carried out based on Art. 6(1)(b) GDPR (Performance of Contract).

Service Provider: Emails are dispatched via the mail infrastructure configured by the controller named in Section 2. No email marketing providers are used, and no email address is passed on for advertising purposes.

8. Storage Duration and Deletion

(1) Account Deletion

If you delete your account via the app settings, we will delete your inventory data and content data immediately, but no later than within 7 days from all active systems.

(2) Inactivity (Free Accounts)

We reserve the right to delete free accounts that have not been used for more than 12 months. This will only occur after prior notification to the registered email address.

(3) Server Log Files

Log data (IP addresses) are automatically deleted after 7 to 14 days, unless security-relevant incidents require longer storage.

(4) Statutory Retention Obligations

Where the Service is offered against payment, invoice-relevant data is retained for as long as statutory retention obligations require (in Germany, up to 10 years). If no paid plan is offered, no such data arises.

9. Transfer to Third Parties

Data is generally not transferred to third parties unless:

You have expressly consented (Art. 6(1)(a) GDPR),
It is necessary for the performance of the contract (e.g., where a paid plan is offered, transfer to the payment service provider handling that payment),
It serves the technical provision (see Hosting),
Or we are legally obliged to do so (e.g., to law enforcement agencies).

We never sell your data to third parties or advertisers.

10. Your Rights

Under the GDPR, you have the following rights at any time:

Right of Access to your data stored by us (Art. 15 GDPR)
Right to Rectification of incorrect data (Art. 16 GDPR)
Right to Erasure of your data (Art. 17 GDPR)
Right to Restriction of Processing (Art. 18 GDPR)
Right to Data Portability (export of your data) (Art. 20 GDPR)
Right to Object to processing (Art. 21 GDPR)
Right to Withdraw Consent (Art. 7(3) GDPR)

To exercise your rights (e.g., deletion), a simple email is sufficient: contact@super-productivity.com

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority — in particular in the Member State of your habitual residence or place of work, or of the establishment of the controller named in Section 2.

The authority responsible for the controller is:

Sächsischer Datenschutzbeauftragter, https://www.saechsdsb.de/

12. Cookies and Tracking

The SuperSync service uses only technically necessary session cookies for authentication. We do not use tracking cookies, analytics services, or advertising technologies.

13. Automated Decision-Making

We do not use automated decision-making or profiling as defined by Art. 22 GDPR.

14. Contact

If you have any questions about data protection, please contact us:

Email: contact@super-productivity.com