Privacy notice
Who is responsible?
Lusonetix LDA is responsible for the processing described here. Address: Fazenda do Cavalinho, CCI Fidalga, 7050-013 Montemor-o-Novo, Portugal. Contact: incubatorbuddy@lusonetix.com.
Data we process
Account: email address, display name, account identifier and authentication information. Your password is handled by Supabase Authentication; do not send it to us by email. Incubation: session name, egg type, start date, initial and current position, membership and invitation codes, turning times and the users who recorded or cancelled turns. Results: eggs set, hatched, infertile and unhatched counts, optional notes and recording/update details. Support: the information you send us. Technical requests to our hosting and authentication services can include IP addresses, timestamps, browser/device information and error logs.
Why we use it
We use account and incubation data to provide the service you request, including synchronisation between participants (performance of our agreement with you, GDPR Article 6(1)(b)). We process necessary security and diagnostic information to protect accounts and keep the service working, and correspondence to handle support (our legitimate interests, Article 6(1)(f)). Where applicable, legal obligations require us to handle rights requests or retain specific records (Article 6(1)(c)). We do not use your data for advertising, sell it, or make automated decisions with legal or similarly significant effects.
Who can see it
Other participants in a shared incubation can see its history, results, notes and the display names associated with actions. Do not put sensitive or unnecessary personal information in session names or notes. In the current database configuration, signed-in users can technically read profile identifiers and display names, not only those of their own household; use a nickname if preferred. Your login email and password are not displayed to other participants by the app.
Service providers and international processing
Supabase provides authentication, database storage and synchronisation. The primary database is hosted in Ireland, in the West EU (Ireland) region (eu-west-1), within the European Union. Hostinger hosts this website. Email providers process messages you send to support. These services may use subprocessors and process data in countries outside the European Economic Area. Where a transfer requires safeguards, the relevant provider arrangements must provide an applicable GDPR transfer mechanism, such as standard contractual clauses. Contact us for information about the applicable hosting location and safeguards. Provider information: supabase.com/privacy and hostinger.com/privacy-policy.
Device storage and notifications
The app saves sign-in information, language and onboarding/notification preferences on your device. Notification reminders are scheduled locally using the device timezone and incubation settings; the current app does not use a remote push-notification service. You can turn notifications off in Android settings. This website contains no analytics, advertising trackers or cookies of its own. The website’s Nginx access and error logs are rotated daily, retaining the current file and 13 daily archives (approximately 14 days during normal operation). This does not specify the retention of separate proxy logs or backup copies.
Retention and deletion
Account data is kept while your account is active. On account deletion, the account and profile are removed from the active database, along with memberships. Sessions where you are the only participant, including their history and results, are deleted. Shared sessions remain for the other participants; references to your user identifier in turning and result records are cleared. Free-text names or notes may still identify you: contact us to have personal information in them reviewed and removed. Remaining shared data is not necessarily anonymous. Technical logs and backup copies may remain until their configured retention period expires; deletion from the active database is not a promise of immediate deletion from every backup. Support correspondence is kept only as necessary to handle your request and any related obligations or disputes. Contact us for the applicable retention details.
Your choices and rights
You may request access, correction, deletion, restriction or, where applicable, portability of your personal data and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. Email incubatorbuddy@lusonetix.com; we may request proportionate identity verification. We respond without undue delay, normally within one month; if a lawful extension is necessary, we explain it. You can complain to Portugal’s Comissão Nacional de Proteção de Dados (cnpd.pt) or your local supervisory authority. Providing account information is necessary to use the account-based app; optional notes are not required.
Young users
Families may use the app together. A parent or guardian should help young users understand what is shared and avoid entering unnecessary personal information. Where applicable law requires parental authorisation, it must be obtained before processing that depends on it. Contact us if a child’s information has been submitted inappropriately. This notice does not itself implement an age check or parental-consent process.
Changes
We update this notice when the service or its data practices change. The date above identifies this version. Material changes will be communicated as appropriate.