Privacy Notice

Rockhunters Project operates Tournal and is the data controller for the personal data described here. That means we decide why and how your personal data is processed. You can reach us at support@rockhuntersproject.com.

Data we collect and why

• Account data (email address, hashed password, account timestamps) — to create and secure your account and to sign you in. Legal basis: performance of our contract with you.
• Content you create (tasks, reminders, notes, journal entries and moods, and records you store in the secrets vault) — to provide the Service. Legal basis: contract performance.
• AI assistant data (your messages, and excerpts of your tasks, notes and journal entries used as context, plus derived embeddings) — to answer your questions. Vault secrets are excluded from AI context, search, and indexing by design. Legal basis: contract performance.
• Device and notification data (push subscription details, time zone, browser and device identifiers) — to deliver reminders at the right local time. Legal basis: contract performance and your consent to notifications.
• Technical and usage data (IP address, log and error data, basic usage telemetry) — for security, fraud prevention, debugging, and improving the product. Legal basis: our legitimate interest in running a safe, working service.
• Support messages — to respond to you. Legal basis: legitimate interest and contract performance.

Who we share data with

• Service providers / subprocessors — hosting, database, authentication, push delivery, and AI model providers who process data on our instructions.
• Merchant of Record — Paddle.com, which handles the sale of contributions, payment processing, tax compliance, invoicing, and related customer service. Paddle collects payment details directly; we never receive your full card data.
• Professional advisers — legal and accounting advisers, where necessary.
• Authorities — where we are required to disclose by law.

We do not sell your personal data or use your content to train third-party models.

Retention

We keep your account and content for as long as your account exists. If you delete an item, it is removed from active systems along with any derived AI index entries. If you delete your account, we delete or anonymise associated personal data, except records we must keep for legal, tax, or fraud prevention purposes.

International transfers

Our providers may process data outside your country. Where data leaves the UK/EEA or India, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions.

Your rights

Subject to local law, you may request access to your data, correction, erasure, restriction, portability, or object to processing based on legitimate interests, and withdraw consent (for example, notifications) at any time. Email support@rockhuntersproject.com and we will respond within one month. If you are in the UK/EEA, you may also complain to your supervisory authority.

Security

We apply appropriate technical and organisational measures, including encryption in transit, row-level access controls that isolate each user's data, hashed credentials, and least-privilege access to production systems.

Cookies and local storage

Tournal uses strictly necessary cookies and browser storage to keep you signed in, remember your theme, and support offline use. We do not use advertising cookies. Paddle may set cookies needed to run checkout. You can clear or block storage in your browser settings, though sign-in will stop working.

Changes

We may update this notice; the date above shows the latest version.