Privacy Policy

Play Light is a life management and productivity application developed and operated by Light Technologies. This Privacy Policy applies to the Play Light mobile application and any associated website (together, the “Service”).

By creating an account and using the Service, you confirm that you have read and understood this policy. If you do not agree, please discontinue use immediately.

We apply a strict principle of data minimisation: we collect only what is necessary to make the Service work for you. Nothing is collected for advertising or profiling purposes.

2.1 Account Information

Collected when you register an account:

• Email Address: Used to identify your account, enable login, and send essential service notifications. We do not use your email for marketing without your explicit consent.
• Display Name: The name you choose to appear in the app. Used solely to personalise your in-app experience.
• Age Verification: We ask you to confirm you are 13 years of age or older. We record only a confirmation of eligibility — we do not store your date of birth or age as a number.
• Authentication Credentials: Your password is stored in a securely hashed, unreadable format. We never have access to your plain-text password.

2.2 User-Generated Content

The content you voluntarily create inside the app:

• Tasks: titles, descriptions, due dates, priority levels, and completion status.
• Project Goals: names, descriptions, milestones, and progress records.
• Any notes, reflections, or other content you choose to input.

This content belongs entirely to you. We do not read it, analyse it, or use it for any purpose other than storing it securely and displaying it back to you. It is never shared with third parties for advertising or research.

2.3 Technical and Device Data

Collected automatically to keep the app stable and reliable:

• Device Type and Model: Helps us understand which devices need optimisation.
• Operating System Version: Used to diagnose compatibility issues.
• App Version: Used to identify which version of the app generated a crash report.
• Crash Reports and Error Logs: Automatically generated when the app encounters an error. Contains technical details only — not your personal content.

Important: This technical data is used exclusively for debugging and performance improvements. It does not include your tasks, goals, or any content you have created. It is never used to profile your behaviour or target you with advertising.

We use your data for three purposes and three purposes only:

• To Provide the Service: Storing your tasks, goals, and account information so the app functions as intended. Without this we cannot operate. Legal basis (GDPR): Performance of a contract (Art. 6(1)(b)).
• To Secure Your Account: Using your email and authentication credentials to verify your identity and protect your account from unauthorised access. Legal basis (GDPR): Performance of a contract and legitimate interests (Art. 6(1)(b) and (f)).
• To Maintain App Stability: Using crash reports and device data to identify and fix technical errors. Legal basis (GDPR): Legitimate interests (Art. 6(1)(f)).

We do not sell your data. We do not share it with advertisers, data brokers, or any third party for commercial purposes. The only company that receives your data is our database infrastructure provider, who acts strictly as our data processor:

• Supabase: We use Supabase to host our secure database, manage our backend infrastructure, and handle user authentication. Supabase processes your data only on our instructions and is contractually prohibited from using it for any other purpose. Data is stored on Supabase’s infrastructure, which is hosted on Amazon Web Services (AWS). For Supabase’s own privacy practices, see: supabase.com/privacy

We may also disclose your information if required to do so by law, court order, or a valid request from a governmental authority, or where we believe in good faith that disclosure is necessary to protect our rights or the safety of our users.

Light Technologies operates internationally. Your data is stored on Supabase’s infrastructure, which may be located in the United States or other countries outside your own. These countries may have data protection laws that differ from those in your jurisdiction.

Where required by applicable law — including the GDPR for users in the European Economic Area — we ensure that appropriate safeguards are in place. These include reliance on Supabase’s data processing agreement and, where applicable, Standard Contractual Clauses (SCCs) approved by the European Commission.

6.1 How We Protect Your Data

We implement the following security measures to protect your information:

• All data transmitted between your device and our servers is encrypted using TLS/HTTPS.
• Passwords are stored in a securely hashed format using industry-standard algorithms. Plain-text passwords are never stored or accessible.
• Database access is restricted to authorised personnel only, using role-based access controls.

No method of electronic transmission or storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security against all threats.

6.2 How Long We Keep Your Data

• Account and Content Data: Retained for as long as your account remains active. If you delete your account, your data is permanently removed from our active database within 30 days.
• Crash Reports and Technical Logs: Retained for a maximum of 90 days, after which they are automatically purged.
• Backup Copies: Encrypted backup copies may persist for up to 30 additional days after account deletion before permanent erasure.
• Legal Holds: We may retain specific data for longer periods where required by applicable law or a valid legal order.

You own your data. Depending on your location, you have the following rights. We will respond to all verifiable requests within 30 days.

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct any inaccurate or incomplete information.
• Deletion: Request permanent deletion of your account and all associated data. You can also do this directly inside the app under Settings → Account → Delete Account.
• Data Portability: Request a structured, machine-readable copy of the data you have provided to us.
• Restriction: Request that we limit processing of your data under certain circumstances.
• Objection: Object to processing based on our legitimate interests.
• Withdraw Consent: Where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Lodge a Complaint: If you are in the EEA or UK, you have the right to lodge a complaint with your local Data Protection Authority. We encourage you to contact us first so we can resolve your concern directly.

To exercise any of these rights, contact us at hello@playlight.app.

Play Light does not use cookies, advertising identifiers, or third-party tracking technologies to monitor your behaviour. The Service uses only the minimum local storage required to keep you signed in and to remember your in-app preferences. We do not track you across other apps or websites.

Play Light is not intended for anyone under the age of 13, or under 16 in the European Economic Area. We enforce this through an age eligibility confirmation at account registration. Users who do not confirm eligibility cannot create an account.

We do not knowingly collect personal data from children below these thresholds. If we discover that such data has been inadvertently collected, we will delete it immediately. If you believe a child has registered, please contact us at hello@playlight.app.

In the current version of Play Light, we confirm the following:

• The app contains no advertisements of any kind.
• We do not use any third-party advertising SDK or ad network.
• We do not collect or share data for advertising or marketing profiling purposes.
• We do not use any AI or machine learning processing on your personal data in this version.
• We do not use any third-party analytics service. No behavioural tracking occurs.

Future versions of Play Light may introduce AI-powered personalisation features, subscription options, and analytics tools. Any such additions will be accompanied by a full update to this Privacy Policy and an in-app notification before they take effect. We will never activate new data practices silently.

We may update this Privacy Policy as the Service evolves. When we make material changes, we will:

• Update the “Last Updated” date at the top of this document.
• Publish the revised policy at our designated public URL before the changes take effect.
• Send an in-app notification for any change that affects your rights or introduces new data practices.

Your continued use of the Service after notification constitutes acceptance of the updated policy. If you do not agree, you may delete your account and discontinue use.

For any questions about this policy, to exercise your data rights, or to request account deletion, please contact us: