Privacy Policy

Last updated: November 9, 2026

Transparency draft. This page describes the intended processing at a high level. The controller's verified identity, contact method, processing inventory, retention periods and subprocessors must be confirmed before Sness is considered privacy-compliant.

Who controls your data?

The operator of Sness is the intended data controller. Full legal identity and a privacy contact address are pending confirmation. See the Legal Notice.

What information may be processed?

Account details, such as email address and authentication identifiers.
Content you choose to enter: routines, goals, reminders, plans, calendar events, and personal notes.
Technical and security data needed to operate and protect the service.
Calendar data if you explicitly connect a supported Google Calendar integration.
Potentially sensitive information if you choose to record health-related routines or other personal details.

Why is it processed?

To provide account access and requested app features; to maintain service security; and, where relevant, to provide optional integrations you enable. The specific GDPR lawful basis must be documented for each processing purpose. Special-category health information requires a separate assessment under Article 9 GDPR, including an applicable exception and appropriate safeguards.

Who may receive it?

Sness uses Supabase for application infrastructure and Vercel for website hosting. Additional service providers, locations, international transfer safeguards and contractual roles must be verified and listed before a complete privacy notice is published. Google Calendar data is accessed only when you authorize the integration. Notion and wearable integrations are not currently advertised as available.

AI features

AI-assisted goal planning is experimental. Do not assume personal content is sent to an AI provider unless the feature expressly informs you. The operator must disclose any actual AI processors and data flows before enabling such processing.

How long is data kept?

Account and content retention, deletion procedures, backups and technical logs require an approved retention schedule. Sness must not claim a fixed period until it has been verified.

Your rights

Depending on the applicable law and legal basis, you may request access, correction, deletion, restriction, portability or objection. You may withdraw consent where processing relies on consent. You can also complain to your competent supervisory authority, including the CNIL in France. A verified privacy contact and a working request-handling process must be published.

Cookies and local storage

Essential browser storage may be used for login sessions and interface preferences. Optional analytics or advertising trackers must not run before any legally required consent. Review the Cookie Settings page.

Children and sensitive data

Sness is an early MVP, not a medical service. The operator must determine age-appropriate onboarding, any required parental authorization and safeguards before allowing children to use personal-data features.