Data controller: José Covas Education Academy, Lda, NIPC 519 093 500.
Contact: academy@josecovas.com
Registered office (sede): Av. Eng. Duarte Pacheco, Torre 1, Piso 2, Esc. 10, 1070-101 Lisboa, Portugal.
What we store
- Calendar metadata: display name, timezone, settings, secret owner-token hash, recovery-code hash, public slug.
- Messages: nickname, text (≤280 chars), door number, wrapper id, optional “secret” flag.
- Abuse tools: report rows, blocked nicknames (normalised), short-lived hashed rate-limit keys (not raw IP in analytics).
- Event counters only (e.g. calendar_created, message_sent) — no message content, no nicknames, no IP in the events table.
What we do not do
- No accounts, no email/phone collection from writers or owners.
- No fake / invented messages. Reading is always free.
- No sale of personal data. No ads in the MVP.
- No analytics cookies. We use Cloudflare Web Analytics (cookieless, no personal data) to count aggregated visits.
Retention
All calendar and message data is scheduled for deletion on 15 January 2027. Ephemeral rate-limit keys are purged within ~48 hours.
CDN logs
Cloudflare may process standard request logs (IP, user-agent, URL) as infrastructure processor. Chat-like message bodies are only in our D1 database, not sent to analytics.
Bot protection
Forms are protected by Cloudflare Turnstile, which checks the browser for signs of automated abuse when you create a calendar, write, report, block or recover. Cloudflare acts as our processor for this check.
Age
Service is intended for users 16+.
Your rights
EU/EEA users may request access or erasure via academy@josecovas.com. Owners can block nicknames; anyone can report a message.