Privacy Policy

In short

• We keep your account and the spaces you make, so they're there on every device. That is the whole point of Pageisle.
• We count how Pageisle is used (which days you use it and for how long, which kinds of components get added) but never read what you write or upload for it.
• No advertising, no selling data, no third-party trackers, no advertising cookies.
• You can export everything or delete your account yourself, at any time, from the account menu.

Who is responsible

Pageisle is run by Hüseyin Yeldan, an individual based in Türkiye, who is the data controller for the personal data described here. Contact: hello@pageisle.com.

This policy is the same for everyone who uses Pageisle, wherever they live. It's written to meet the privacy laws that apply to us, including the EU and UK GDPR and Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK), and it is also the information notice those laws ask for. Your data is collected electronically, through Pageisle's website and app, as you sign in and use them.

What we keep

• Your account: your email address, the username you pick (@name) and, if you sign in with Google, the name and profile picture Google shares, plus Google's identifier for your account. We never see your Google password. If you sign up with an email and a password, Supabase keeps your password only as a salted hash; we can't read it.
• Your profile: the name you show, a short bio, a profile colour, a picture you upload (your browser redraws it first, which drops its location and camera details) and your choices of what others see.
• What you make: your spaces, layouts, components and everything in them (text, cards, chart data, saved titles and places, calendar entries with dates, times, time zones and reminder settings, timer states), the files and pictures you add, and settings such as the Spotify client ID of your own Spotify app.
• Your plan: whether you're on a trial or Pro, when your trial ends and until when Pro lasts, badges such as Founding member, and whether you test components before everyone gets them. If you subscribe: whether it's monthly or yearly, its status (for example on trial, active or cancelled), when it renews or ends, and Paddle's identifiers for the subscription and for you as its customer. Never your card or bank details: those stay with Paddle.
• Your answers when you start: what you pick in the few questions after signing up (short choices, never free text) and the plan you lean towards on the trial screen. We use them to shape Pageisle and what it offers people who are new; they're part of your export and are deleted with your account.
• How Pageisle is used: the days you open Pageisle and when you were last there; how long Pageisle is open in your browser each hour, and how much of that time you're clicking or typing in it (the length of time only, never what you did); when you add a component, a space or a layout, we note its kind (for example “timer” or “wide layout”), never its content; the country your connection came from when you signed up (we don't keep your IP address); the link that brought you here, if it carried one (for example a video's ?ref=); which of our announcements (short notes from us that show in the editor) you've seen, and when; and your streak: the time zone your browser reports, the first and last day of the days in a row you've opened Pageisle, your best run, and how far you got in each streak campaign and when you earned its Pro.
• When something breaks: if a component fails to show, we count which kind of component it was, the kind of error and the version of Pageisle, by day. It isn't linked to you and never includes what the component held.
• What you send us: feedback messages, and the technical details you choose to include with them (app version, language, browser, window size).
• What we note about your account: changes our team makes to it (for example your plan, a suspension or a new username) with when and who made them, and a private note an admin may write. The note is part of your export; ask us for the record of changes any time.
• Running the service: our hosting providers keep short-lived technical logs (such as IP addresses and the pages requested) to keep Pageisle secure and working. If we need to act on your account (for example to suspend it), we record that action.

Your public profile

Your profile at pageisle.com/<username> is public: anyone can open it, signed in or not, and search engines may list it. It shows your username, your picture, your bio, your profile colour and the month you joined, and, unless you turn them off in Profile settings, your name and your badges (Admin, Founding member, Pro). Your email shows only if you turn it on.

Pictures you upload for your profile are stored where anyone with their link can load them. If you use your Google picture, it is loaded from Google.

When you change your username, your old one leads to your profile for 30 days, and nobody else can take it in that time.

Friends: when you send or answer a friend request, we keep who asked whom, when, and whether it was accepted. Your profile shows how many friends you have; who they are, and your requests, are shown only to you. Someone whose request you decline isn't told. Your friendships are part of your export, and they are deleted with your account (or theirs).

Blocks and reports: when you block someone, we keep who you blocked and when, so they can't find you, see your profile or send you requests; they aren't told, and only you see your list. When you report a profile, we keep your reason and note, who you reported, and what their profile showed at that moment, so our team can look into it. The person you report isn't told who reported them. Blocks and the reports you send are part of your export; reports about you aren't, because they would name the people who sent them. A report is kept until we've dealt with it and as long as we need it to keep Pageisle safe, and goes when the reported account is deleted.

Showing your profile is part of the service you signed up for (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)). You choose what it shows, and you can change it any time.

Why we use it

• To provide Pageisle to you (our agreement with you, GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)): signing you in, saving your spaces and files, keeping your devices in sync, your storage limit.
• To improve and protect Pageisle (our legitimate interests, GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)): understanding which features are used and whether people come back, preventing abuse, fixing problems and answering your feedback.
• To meet legal obligations (GDPR Art. 6(1)(c), KVKK Art. 5(2)(ç)), when the law requires us to keep or hand over information.

We don't use your data for advertising, we don't sell it, and we don't make automated decisions about you.

Who helps us

These providers process data for us, under their data processing agreements, only to run Pageisle:

• Supabase (sign-in, database and file storage): your account and everything you make, stored in Frankfurt, Germany (EU).
• Vercel (hosting): runs the website and our server code, in Frankfurt for server code; handles every request.
• Google: when you choose “Continue with Google”, to confirm who you are.
• Resend: sends the codes that confirm your email address and reset your password.
• Paddle (Paddle.com Market Limited, United Kingdom), our reseller and the merchant of record for every purchase: when you subscribe, Paddle runs the checkout and takes the payment, handles tax and sends invoices. We give it your email address; you give it your payment details, country and, where needed, address directly. It tells us your subscription's status and dates. The pricing page loads Paddle's checkout from Paddle only when you start paying, so Paddle sees your IP address then. For the payment data it keeps under tax and anti-fraud law, Paddle is a controller in its own right, under its own privacy notice.
• Have I Been Pwned (Pwned Passwords): when you choose a password, our server checks it hasn't appeared in a known data breach. Only the first 5 characters of its SHA-1 hash are sent, never the password or anything that identifies you.

Some components talk to other services when you use them. From your browser directly: Spotify (your own Spotify account), LRCLIB (the song playing, to find its lyrics) and Open-Meteo (the place you chose, for its weather); they see your IP address, like any website you visit. Through our server, so they never see who you are: Yahoo Finance and Truncgil (the market symbols you follow), JustWatch (your title searches and your country) and any picture link you paste.

We share data with nobody else, except when the law obliges us to.

Where your data is

Your account and your content are stored in the European Union (Frankfurt). Some of our providers are companies based in the United States or the United Kingdom and may access data from there; such transfers are covered by their data processing agreements and the European Commission's standard contractual clauses, and by the safeguards KVKK Art. 9 asks for. Using Pageisle means your data may be handled outside the country you live in, for these purposes only.

How long we keep it

• Your account and content: for as long as you have an account. When you delete your account, it is erased from our database and file storage straight away.
• Backups (if our database provider holds any) roll over and disappear within 30 days.
• Hosting logs: a short time, usually days, as our providers keep them.
• Your subscription's record: for as long as you have an account. Paddle keeps its own record of your payments for as long as tax law requires.
• After you delete your account, we keep only a line saying that an account was deleted on that date, with nothing that identifies who.

On your device, and cookies

Pageisle only stores what it needs to work, so it doesn't ask you about cookies:

• Sign-in cookies: keep you signed in (and, for a moment, finish a sign-in). They can't be read by the page's scripts.
• Language cookie (pageisle-lang): remembers the language you chose.
• Browser storage: a copy of your spaces so they open fast and work offline, your theme so the page doesn't flash, local records of delivered calendar reminders to avoid repeats, small preferences (the space you were on, which layout to use on this screen), and, if you connect Spotify, its connection, which never leaves this browser.

There are no advertising, social media or third-party analytics cookies. Signing out clears your Spotify connection from the browser; clearing your browser's site data removes the rest.

Your rights

You can, at any time:

• get a copy of your data: the account menu → Your data → Export makes a file with everything in your account;
• delete your account and everything in it: the account menu → Your data → Delete account;
• ask us what we hold about you, why, and who it goes to;
• ask us to correct it, restrict how we use it, or object to it, including to any result reached only by automated means;
• claim compensation if your data is used unlawfully and it harms you;
• complain to the data protection authority where you live or work (for example your EU country's authority, the UK's ICO, or Türkiye's Personal Data Protection Authority, kvkk.gov.tr).

Write to hello@pageisle.com for anything else. We answer within 30 days, free of charge.

Keeping it safe

Your data travels encrypted. Every row in our database is locked to its owner, files sit in private storage that's only reachable through short-lived links, the sign-in session is kept in cookies no script can read, and nothing you add can run code in Pageisle. No system is perfect: if something ever goes wrong with your data, we'll tell you and the authorities as the law requires.

Children

Pageisle is not for anyone under 16. If you think a child has given us their data, tell us and we'll delete it.

Changes

When this policy changes in a way that matters, we'll tell you in Pageisle and ask you to accept it before you carry on. The date at the top always shows the latest version.

Contact

Questions about your privacy: hello@pageisle.com.