Privacy Policy

1. Information We Collect

We collect information you provide directly:

• Account information: Email address and name when you create an account.
• Content: Data you create within your applications (posts, pages, etc.).
• Payment information: Processed securely by Stripe. We never store your card details.

We automatically collect:

• Usage data: Pages visited, features used, timestamps.
• Device information: Browser type, operating system, IP address.

2. How We Use Your Information

• To provide and maintain the service.
• To send you important updates about your account.
• To respond to your support requests.
• To detect and prevent fraud or abuse.
• To improve our service.

3. Data Storage and Security

Your application data is stored in an isolated SQLite database unique to your tenant. This provides strong data isolation between customers.

We use industry-standard security measures including:

• TLS encryption for all data in transit.
• Encrypted backups.

Our server logs record the IP address of each request so we can stop abuse. These logs are kept for a few days, then deleted, and the address is never written to a database or used for analytics.

4. Data Sharing

We do not sell your personal information. We may share data with:

• Service providers: Who help us operate (hosting, email, payments).
• Legal requirements: When required by law or to protect our rights.

For the personal data your site keeps about other people, we are your processor under our Data Processing Addendum, which says what we process, why, and which subprocessors help us.

Assist: where a site's owner turns Assist on, the text or image a writer asks Assist about, or the messages of a conversation a team member asks Assist to answer or summarize, a customer's included, is sent to OpenAI, which writes the suggestion as our processor. Nothing else is sent, and OpenAI does not use it to train its models. It keeps it for at most 30 days, to watch for abuse.

Email to a site: mail sent to a site's address, or forwarded there from an address of the site owner, is received through Cloudflare and passed to us. The site keeps what the message becomes in its own database. We keep a raw copy of each message for 30 days, then delete it, and a record of who wrote, to which address and when for 90 days.

5. Your Rights

You have the right to:

• Access: Request a copy of your data.
• Export: Download your data at any time.
• Delete: Terminate an app at any time; its data is deleted 30 days later. An account with no apps holds only your email address and is removed on request.
• Correct: Update your personal information.

6. Cookies

We use essential cookies only:

• Session cookies: To keep you logged in.
• CSRF tokens: For security.
• Language: Set only when you pick a language, kept for a year, so the site stays in it.

We do not use tracking cookies. This marketing site (simplest1.com) is measured with Cloudflare Web Analytics, which sets no cookie and stores no IP address. It also counts its own page views, per day, page and link, with no cookie and nothing about the visitor. Your app counts its own page views in its own database with no cookie, no stored IP address and a visitor hash that changes every day; no third party sees your visitors. It also keeps the words typed into its search for 90 days, and the Yes or No readers give to “Was this helpful?”, with nothing beside them that names a reader or an address. When you sign up, we record where you came from: the ref of the link you followed, the page you signed up on and the name of the site that sent you, never the address of the page you were on. If you ask us to tell you when a coming app is out, we keep your email address, that app and your language until we have sent that one email, then delete them; an address not confirmed within 7 days is deleted too.

7. Data Retention

We retain your data while your app is active. Export is available at any time, and for 30 days after you terminate an app. After termination:

• The app stops serving immediately. For 30 days its admin stays open for one thing: exporting your data.
• Its data is deleted from our servers 30 days after termination.
• Backup copies expire 30 days after that deletion.

When a site erases a person (Settings, Erasure), everything the site keeps for them is deleted at once; a comment they wrote keeps its words, without their name. Mail already delivered and events already sent to the site's webhooks are out of our reach. Backups hold the person until they expire, within 30 days, and restoring a backup never brings them back: for that, we keep the id of each erased record, never a name or an address, for as long as the site exists.

8. International Transfers

Your data is stored on servers in Canada and the United States. By using our service, you consent to this transfer.

9. Children's Privacy

Simplest1 is not intended for children under 13. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes via email.

11. Contact

Questions about privacy? Contact us at [email protected].

For help with your account, a site or billing, write to us at support.simplest1.com.