Privacy Policy

1. Who is responsible

The service is operated by Đức Nguyễn Văn ([email protected]), an individual in Vietnam, acting as the data controller. There is no company behind it and no data-protection officer: one person runs the install and answers the mail.

The application runs on hardware the operator administers and is published to the internet through Cloudflare. It is not a multi-tenant commercial platform.

2. What this policy covers

This policy covers the website and API at dntechx.com — the public hub and feed, posts, comments, stories, chat, uploads, the Time Management workspace, and the Money module — whether you are signed in or only browsing.

Using the service also means accepting the Terms of Service. This policy does not license the source code, which is proprietary and covered by its own terms.

3. Account information

An email address is the only piece of personal data the service requires. When you register with a password, the database stores your email address, a bcrypt hash of the password (never the password itself), and the times your account was created, last updated, and last signed in.

• Optional profile fields you choose to fill in: display name, avatar image, title, job, and location.
• Your role in the install (member, admin, or superadmin) and whether your email address has been verified.
• Preferred interface language and Money display currency, stored on the account so emails and Money formatting follow your choice across devices.
• If you sign in with Google: the Google account identifier, the email address, and the name Google returns. The Google profile photo is received but not stored.

4. What you create

Everything you make in the app is stored in the operator's database until you delete it or the account is deleted.

• Time Management: epics, tasks, notes, tags, due dates, checklist items, scheduled time blocks, and timer sessions. These rows are private to your account — no other member, admins included, has an endpoint that reads them.
• Feed: posts and their titles, bodies, categories, styling, comments, reactions, and the audience list when a post is shared with named members.
• Stories: the text, any attached media, reactions, and a record of which signed-in member viewed the story. Only the author can see that viewer list.
• Chat: message text, stickers, image and voice-note attachments, reactions, and per-conversation read state.
• Money: income and expense transactions, custom categories, savings goals and contributions, monthly budgets, and the display currency preference. These rows are private to your account — no other member, admins included, has an endpoint that reads them.
• Uploads: the file itself plus its original name, MIME type, kind, size, and storage key.

5. Cookies

The service sets four cookies. None of them are advertising or cross-site tracking cookies, and there is no cookie consent banner because none of them are used for tracking.

• mgmt_at — short-lived access token. HttpOnly, SameSite=Lax, expires after 15 minutes.
• mgmt_rt — refresh token that keeps you signed in. HttpOnly, SameSite=Lax, expires after 30 days.
• mgmt_oauth — single-use anti-forgery nonce during Google sign-in. HttpOnly, expires after 10 minutes.
• mgmt_locale — remembers your interface language. Readable by the browser and free of personal data.

6. Device, network, and log data

Your browser keeps your display preferences (theme, density, week start, time format, language, alert settings) and a cached copy of your own profile in local storage, under the keys mgmt:settings:v1, auth:user, and auth:hasSession. Session secrets are never written to local storage.

Each signed-in session row records the IP address and browser user-agent it was created from, so a session can be recognised and revoked. Abuse protection counts requests per IP address (and, on sign-in and password-reset routes, per email address) in memory or Redis; those counters expire with their short window, typically one minute.

For a first-time visitor the server reads the country code Cloudflare attaches to the request (CF-IPCountry) to pick a sensible default language. The country code is used in the response and not stored. The server also keeps the last few hundred log lines in memory for the superadmin's diagnostics screen; those lines can contain an email address when a message fails to send, but never passwords, tokens, or request bodies.

7. No advertising or product analytics

The application ships no analytics SDK, no advertising pixel, and no behavioural profiling. Nothing about your usage is sold or shared for marketing.

Two edge details are worth naming. Cloudflare sits in front of the site and may add its own lightweight analytics beacon at the edge, outside the application code. Feed and manuscript pages load one webfont from Google Fonts, which means Google receives the IP address and user-agent of that font request.

8. Why the data is used

Data is used only to run the service you asked for:

• Authenticate you, keep you signed in, and verify your email address.
• Store and display the content you create, according to the visibility you chose.
• Send transactional email: address verification and password reset.
• Protect the install against brute force, spam, and abuse.
• Pick a default interface language on your first visit.
• Give admins aggregate activity figures so the install can be maintained.

9. Legal basis

Processing rests on performance of the agreement between you and the operator (Terms of Service) for account and content data, on the operator's legitimate interest in keeping the install secure and working for abuse-protection and diagnostic data, and on your consent where you volunteer optional profile details or opt in to alerts.

The operator processes personal data in line with Vietnamese law, including Decree 13/2023/ND-CP on personal data protection. If you are in a jurisdiction with additional rights, the operator will honour requests it can technically satisfy.

10. Who else processes your data

The service depends on a short list of providers. There are no data brokers, ad networks, or resale arrangements.

• Cloudflare — network, TLS, and the tunnel that publishes the site, plus R2 object storage for uploaded files. The storage bucket is private; files are served through the application with signed links that expire about an hour after they are issued.
• An SMTP email provider — delivers verification and password-reset messages, and therefore sees the recipient address and the message body.
• Google — only if you choose Google sign-in. The service requests the openid, email, and profile scopes and stores the identifier, email, and name it receives.
• Google Fonts — serves one webfont on feed and manuscript pages, as described above.

11. Who can see what inside the install

Visibility inside the service is deliberately narrow, and it is worth knowing the exact edges:

• Public posts are readable by anyone on the internet, including search-engine crawlers, and appear in the site sitemap.
• Private posts are readable only by their author; shared posts only by the members named in the post's audience.
• Stories are visible to every signed-in member until they expire 24 hours after posting. Only the author sees who viewed a story.
• Chat conversations are readable only by the two participants. There is no administrative endpoint that reads anyone's messages. Chat is not end-to-end encrypted, so the operator could in principle read the database directly — treat it as private mail, not as a secure channel.
• Admins see an account list: email, name, role, verification state, timestamps, last sign-in, and activity counts such as tasks, epics, and hours logged. Admins do not see task contents, chat, private posts, or password hashes.
• The superadmin can additionally read server diagnostics and delete an account together with everything it owns.

12. How long data is kept

Content stays until you remove it or the account is deleted. Short-lived technical records expire on their own:

• Access token 15 minutes; refresh session 30 days, and a revoked session row is purged about 30 days after revocation.
• Email-verification link 24 hours; password-reset link 1 hour.
• Queued transactional email carries the recipient address and the one-time token until it is sent; completed and failed queue rows are purged after 14 days.
• Stories and their view records are hard-deleted 24 hours after posting.
• Abuse counters expire with their window; response caches live 20 to 60 seconds; signed file links expire about an hour after being issued.
• Deleting your account — from Settings → Danger zone, at any time — removes the account row and cascades to your epics, tasks, time blocks, checklist items, timers, posts, comments, reactions, stories, chat messages, uploads, money records, and sessions. Queued emails addressed to you are dropped too. It takes effect immediately and is permanent: there is no recycle bin, no soft delete, and no grace period in which it can be reversed.

13. Your data, your requests

You can edit your profile at any time, and delete your own posts, comments, stories, tasks, epics, and chat messages from the app. Deleting a chat message is a hard delete for both participants — the message is removed from both sides immediately and cannot be recovered. Settings → Your data exports your epics and tasks as JSON, CSV, or an iCal calendar file, and the Money module exports its own ledger.

You can also delete the whole account yourself, from Settings → Danger zone. It asks you to type your address and, unless the account signs in only with Google, your password; then everything listed in section 12 goes at once. Conversations go with it for the other participant too, because a thread cannot exist with one side missing — export or copy anything you want to keep first.

One limit is honest to state: the built-in export does not yet cover feed posts, chat, stories, or profile data. For a full copy of your data, email [email protected] from the address on the account. Requests are answered without undue delay and within 30 days at the latest.

You may also object to processing or withdraw consent. Withdrawing consent for the essentials — email address and password — means the account can no longer exist, so the request is handled as an account deletion.

14. How the data is protected

The install applies the protections you would expect of a careful small deployment: passwords hashed with bcrypt, refresh tokens stored only as SHA-256 hashes, session cookies marked HttpOnly with a same-origin check on sensitive routes, signed short-lived access tokens, a content-security policy and hardened response headers (including HSTS on HTTPS), request rate limits at both the web server and the application, HTML sanitisation of user content before it is rendered, magic-byte checking of uploads, a private storage bucket, and TLS on every public request.

No system is perfect, and this one is a personal install rather than a hardened enterprise platform. The Money module is intended for personal expense tracking you choose to keep here — do not store bank login credentials, payment-card numbers, health records, or other high-sensitivity secrets. If you believe you have found a vulnerability, email the operator before disclosing it publicly.

15. Children

The service is not intended for anyone under 16, and accounts for children are not knowingly created. If you believe a child has registered, write to [email protected] and the account and its content will be removed.

16. Where the data lives

The database and the application run on hardware in Vietnam. Uploaded files sit in Cloudflare R2, and email, network delivery, and Google sign-in are handled by the providers named above, which may process data outside Vietnam. By using the service you accept these transfers, which are limited to what running the service requires.

17. Changes to this policy

When the software changes what it collects, this policy is updated and the date at the top of the page moves. Significant changes are announced on the public hub. Continuing to use the service after a change means you accept the updated policy.

18. Contact

Questions, data requests, and complaints go to [email protected]. If you are not satisfied with the answer, you may lodge a complaint with the competent Vietnamese authority for personal data protection.