Privacy policy
In short: your emotion journal, action plan and settings stay on your device. No account, no cookies, no ads, no trackers. The server only receives what the AI features and abuse limits need.
Sensitive data
Your emotions, and the fact that you use an ADHD app, can reveal information about your health. That is why they stay on your device by default and only leave it if you start the AI analysis yourself.
Who is responsible?
Tdhappi is published by Fawzi, full-time self-employed, Flemish Brabant (Belgium). Data controller: Derfouf Fawzi. Company / VAT number: BE 0645.860.444, Meise, Belgium. Contact for any question about your data: lesav_oir@hotmail.com.
1. What stays on your device
The app stores in your browser's local storage (localStorage): your emotion entries (emotion, intensity, date and time, trigger if you write one), your action plan, theme, language, a random device ID, your Premium licence key and trial token if you have them, your consent to the AI analysis if given, and today's free breakdown counter. The service worker also keeps a copy of the app files so it works offline (no personal data).
This data is not sent to us and we cannot access it. It stays until you delete it: clear the site data in your browser (or uninstall the app). As this is purely local and strictly necessary, no cookie consent is required.
2. Task breakdown (AI)
When you tap "Break it down", the text of your task is sent to our server (Netlify), then to Google's Gemini API (Gemini Flash model) to generate the steps. Your name is not sent. Don't put personal details in the task if you don't want to share them. We don't keep the text: our functions neither store nor log it. Google processes it under the paid Gemini API terms: this data is not used to train its models. Legal basis: performance of the service you request (Art. 6(1)(b) GDPR).
3. Pattern analysis (AI, Premium)
If you start the analysis, up to 20 entries from the chosen period (day, time, emotion, intensity, trigger) are sent to our server, then to Google's Gemini API. Nothing is kept on our side. Because this data may concern your health, it is only sent after your explicit consent: before the first analysis you must tick a consent box (Art. 9(2)(a) GDPR). This consent is stored only on your device (with its date); you can withdraw it at any time via "Withdraw my consent to the AI analysis" below the analysis button, and no analysis is possible without new consent. You never have to use this feature.
4. Free quota and Premium trial
To limit abuse (3 free breakdowns per day, one 7-day trial per network), our server computes a fingerprint (SHA-256 hash with a secret key, truncated) of your IP address (/64 network for IPv6) and of your random device ID. Only these fingerprints are stored in Netlify Blobs, with a per-day counter or the trial start date. Your IP address is not stored in clear. A daily automatic purge deletes counters older than 2 days and trial fingerprints older than 30 days. Legal basis: legitimate interest in preventing abuse of a free service (Art. 6(1)(f) GDPR).
The trial token is signed by the server and only contains a start date, an end date and a random number.
5. Payment and licence (Polar)
Premium is paid on the website of Polar (Polar Software, Inc.), which acts as the seller (Merchant of Record): Polar collects your email, payment and billing details and handles VAT, under its own privacy policy. We never see your card. Your licence key stays on your device and is sent to our server with each AI request, which checks it with Polar's API (kept 5 minutes in memory, not stored). Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
6. Hosting and technical logs
The site is hosted by Netlify, Inc. Like any host, Netlify processes your IP address and technical information (browser, requested pages) to serve and secure the site, and keeps technical logs for a limited period set by Netlify. Our functions do not log your texts or your IP. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
7. No trackers
No cookies, no analytics, no ads, no embedded social networks. The font is self-hosted (no Google Fonts). That is why there is no cookie banner.
8. Recipients and transfers outside the EU
- Netlify, Inc. (hosting, functions, Netlify Blobs) — United States
- Google (Gemini API) — tasks and entries sent to the AI
- Polar Software, Inc. (payment, licences) — United States
These providers may process data outside the European Union. Such transfers rely on the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses. We sell no data.
9. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to object to processing based on legitimate interest, to data portability, and to withdraw consent at any time. As we know neither your name nor your IP address in clear, we usually cannot identify you in our data; email us anyway and we'll help. For payment data, you can also contact Polar. We reply within one month.
You can also lodge a complaint with the Belgian Data Protection Authority (APD/GBA): Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be.
10. Minors and changes
Tdhappi is intended for adults. If this policy changes, the date at the top will be updated.