Legal and privacy

Privacy Policy

Effective September 17, 2026 · Version 1.3

Who this policy covers

This policy explains how Progress Haven collects, uses, stores, and deletes information when you visit the website, create an account, or use its productivity tools.

Information we collect

Account and authentication information

• Your name, email address, password hash, email-verification state, and account dates.
• If you choose Google sign-in, the Google account identifier and verified identity information Google returns for authentication.

Workspace content

• Tasks, task lists, completion state, dates, ordering, and focus-session timing.
• Shared-list memberships, invitation email addresses, permissions, task assignments, creator/completion attribution, and each person's time contributions.
• Journal entries, habits, habit-tracker entries, reports, and product preferences.
• Legacy workspace records that remain associated with your account while older features are migrated.

Security and technical information

• Session, CSRF, password-reset, email-verification, and access-token records needed to protect your account.
• Security-event metadata such as event type, time, and a keyed hash derived from an IP address. The application does not store the plain IP address in its security-event table.
• Ordinary server logs may include request time, route, status, device/browser information, and IP address. Production access, redaction, and retention depend on the hosting configuration.

How we use information

• Provide, synchronize, secure, troubleshoot, and improve the service.
• Authenticate users, verify email ownership, prevent abuse, and investigate security events.
• Send service messages such as verification, password, security, task-list invitation, weekly-report, and deletion-confirmation emails when applicable.
• Comply with legal obligations and enforce service terms.

Cookies and browser storage

Progress Haven uses essential cookies for authenticated sessions, CSRF protection, and related security functions. The browser may also retain non-authoritative interface preferences and cached UI state. Clearing these values can sign you out or reset local preferences.

To help recover unfinished work after session expiry, task drafts and new journal drafts may be stored in this tab's session storage. They are associated with the original account, expire after 24 hours, and are cleared when you explicitly sign out or open the app under another account. Passwords are not included. Browser session restoration may retain this storage; clearing browser data removes it.

Google Analytics is disabled in the current product configuration. Before optional analytics is enabled, this policy and any required consent controls must be updated.

Sharing task lists

Task lists are private until you invite people and they accept. Accepted members can see the list's existing and future tasks, notes, subtasks, assignments, member names, creation/completion attribution, and combined task time. Editors can change and delete tasks; viewers have read-only access. Only the owner manages invitations, permissions, and list settings.

Members can leave, and the owner can remove their access. Recorded contributions remain in the list after someone leaves or is removed. Personal sidebar order, view preferences, and individual productivity credit are separate from shared list progress.

Third-party services

We do not sell personal information. The following services may receive limited information when you use the related feature:

• Google OAuth: provides optional Google sign-in and returns authentication identity information.
• Google Fonts: may receive network metadata such as IP address and browser information when font files are requested on current public and authenticated pages.
• Reddit: the Community feature requests public Reddit content directly from your browser, so Reddit receives ordinary request metadata.
• Brevo: processes destination addresses and message content to deliver account and service emails.
• Hosting and infrastructure providers: process stored data and technical logs as needed to operate the application.

Stripe integration code exists, but paid plans and payment collection are disabled. This policy must be updated before billing is offered.

Data retention and deletion

Account and workspace data is kept while your account is active. Permanent account deletion removes your profile, lists you own and their tasks, journals, habits, preferences, sessions, access tokens, memberships, and invitations addressed to your current email from the active application database. Shared lists you own are removed for every member. Tasks and recorded time you contributed to lists owned by other people remain with their account attribution removed. Text you entered into shared tasks and notes remains part of those lists.

A pseudonymous deletion-completion record may remain for security and accountability. It does not contain your name or email address. Operational logs and encrypted backups may persist temporarily according to infrastructure retention schedules and are removed or overwritten through those schedules rather than restored into active service after a deletion.

Your choices and requests

• Review and correct profile information from Account.
• Change preferences from Account.
• Permanently delete your account from Account → Data & privacy.
• Contact us to request privacy assistance, access, correction, or deletion that cannot be completed through Account.

Security

We use access controls, password hashing, CSRF protection, rate limits on sensitive actions, and encrypted transport in production. No online service can guarantee absolute security.

Children

Progress Haven is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has provided information so it can be reviewed and deleted.

Changes to this policy

Material changes will be posted here with a new effective date and version. When appropriate, we will provide additional notice inside the service or by email.

Contact

For privacy questions or requests, email privacy@progresshaven.com.