Privacy Policy

1. Overview

Fullify is built to be simple and privacy-respecting. We collect only what is necessary to run the service. We do not sell your data, serve ads, or share your information with third parties beyond the infrastructure required to operate Fullify.

Fullify is operated as an independent personal project. For the purposes of data protection law (including the UK GDPR and EU GDPR), the operator of Fullify is the data controller and can be contacted via the details in Section 11.

2. What We Collect

When you use Fullify, we store the following:

• Email address: used to identify your account and send verification codes.
• Password: stored as a one-way bcrypt hash. We cannot recover or read your password.
• Display name (optional): shown in the greeting on your launcher if you choose to set one.
• Shortcuts: the URLs, labels, icons, and ordering you configure in your launcher.
• Preferences: your theme, background, tile style, and other display settings.
• Subscription tier: whether your account is free or Supporter, synced from Buy Me a Coffee.

We do not collect your location, device identifiers, or usage analytics beyond what is needed to operate the service. Our hosting and database providers may retain standard server logs, which can include IP addresses, for security, abuse-prevention, and operational purposes (see Section 4). We do not use this information for advertising, profiling, or tracking.

3. How We Use Your Data

Your data is used solely to:

• Authenticate you and maintain your session.
• Display your launcher with your saved shortcuts and preferences.
• Send one-time verification codes or sign-in links to your email.
• Determine your subscription tier.
• Protect the service against abuse, fraud, and unauthorised access.

Our legal basis for processing your personal data under the UK and EU GDPR is (a) performance of a contract with you when you create an account and use the service, and (b) our legitimate interests in keeping the service secure and operational. We do not process your data for any other purpose without your consent.

4. Data Storage & Infrastructure

Your account data (email, hashed password, shortcuts, preferences) is stored in a PostgreSQL database hosted on Supabase, a managed cloud database platform. Supabase stores data in secure, encrypted infrastructure. You can review Supabase's own privacy and security practices at their website.

Fullify is hosted on Vercel. Vercel processes requests and may retain short-term server logs (which can include IP addresses and request metadata) for security and operational purposes. We do not persist personal data in Vercel's storage beyond what is required to serve the application.

International transfers. Supabase and Vercel operate on global infrastructure, which means your data may be processed or stored in countries outside your own, including the United States. By using Fullify, you acknowledge and consent to your data being transferred and processed in those locations. We rely on the standard protections offered by these providers (including, where applicable, Standard Contractual Clauses) to safeguard your data in transit and at rest.

5. Cookies & Sessions

Fullify uses a single session cookie (next-auth.session-token) to keep you signed in. This cookie is HTTP-only and secure. No third-party tracking cookies are used.

If you choose "Remember me for 90 days" at login, your session cookie will persist for 90 days. Otherwise it expires when you close your browser.

6. Third-Party Services

• Buy Me a Coffee: if you choose to become a Supporter, your payment is handled entirely by Buy Me a Coffee and their payment processor. Fullify does not receive or store any payment details. To activate your Supporter tier, we manually match the email address shown on your Buy Me a Coffee membership against your Fullify account and update your tier in our admin tools. We do not receive any other personal data from Buy Me a Coffee. Buy Me a Coffee's own privacy practices govern the collection and handling of your payment information.
• Google Favicon API: if you use the auto-favicon icon option for a shortcut, your browser fetches a favicon image from Google's public API. This is a client-side request initiated by your browser; Fullify does not forward your account data to Google.

7. Data Retention & Deletion

Your data is retained for as long as your account exists. You can permanently delete your account and all associated data at any time from the Account settings page. Deletion is immediate and irreversible, except where we are required to retain limited records by law or to resolve disputes. Backup copies held by our infrastructure providers may persist for a short period before being overwritten in the normal course of operation.

8. Your Rights

Depending on where you live, you may have rights under the UK GDPR, EU GDPR, CCPA (California), or similar laws, including the rights to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Object to or restrict certain processing of your data.
• Request a copy of your data in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority (in Australia, the Office of the Australian Information Commissioner; in the UK, the Information Commissioner's Office).

In practice, Fullify's account deletion feature satisfies most of these rights by removing everything we hold about you. For any other request, please contact us using the details in Section 11. We will respond within the timeframes required by applicable law.

9. Children

Fullify is not directed at children under 16, and we do not knowingly collect personal data from anyone under that age. If you believe a child has registered for Fullify, please contact us and we will delete the account and any associated data promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the service, or applicable law. We will update the "Last updated" date at the top of this page when changes are made. Where changes are material, we will make reasonable efforts to notify you in advance, for example by displaying a notice in the app or sending an email to the address associated with your account. Continued use of Fullify after changes take effect constitutes your acceptance of the updated policy.

11. Contact

For any privacy-related questions or data requests, please reach out via the support link in the app or through our Buy Me a Coffee page.