Pupupu Kft. (registered seat: 1055 Budapest, Nyugati tér 9. 3. em. 3. ajtó, Hungary · company registration number: 01-09-453852 · tax number: 32795255-2-41 · EU VAT: HU32795255 · hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany) is the data controller for Blobsort. Contact for anything privacy-related: hello@blobsort.com.
| Data | Purpose | Legal basis (GDPR) | Kept |
|---|---|---|---|
| E-mail address | Your login, service messages (e.g. billing, important changes) | Contract — Art. 6(1)(b) | Until account deletion |
| Password | Authentication. Stored only as a salted scrypt hash — we cannot read it | Contract — Art. 6(1)(b) | Until account deletion |
| Your task data (tasks, projects, settings, usage-derived stats shown to you) | The product itself: storage and cross-device sync | Contract — Art. 6(1)(b) | Until you delete tasks or the account |
| Payment and invoice data | Subscription billing — processed by Stripe; we store only your Stripe customer ID and subscription status, never card numbers | Contract — Art. 6(1)(b); legal obligation for accounting — Art. 6(1)(c) | Accounting records per statutory retention (8 years in Hungary) |
| Server logs (IP address, request time, endpoint) | Security, abuse prevention, debugging | Legitimate interest — Art. 6(1)(f) | Max. 30 days |
If you choose “Continue with Google”, Google confirms your e-mail address to us and we store only that address — no profile data, contacts or anything else from your Google account. Google's own processing is governed by Google's privacy policy.
We do not run ads, do not use third-party analytics trackers, do not profile you, and never sell or share your data for marketing. There is no automated decision-making about you. To understand the product we keep anonymous aggregate counters on our own server (e.g. “how many sorting rituals ran today”, or which link a visit came from) — these are plain daily numbers, never tied to any person or account. Separately, your account stores a few first-use timestamps (e.g. when you first completed a task) solely so our handful of service e-mails arrive at sensible moments instead of on a blind schedule; this is part of providing the service, not profiling, and is deleted with the account. If you send us feedback through the in-app bug report, we store your message (and, if you opt in, basic technical details like browser version) to fix the problem.
Blobsort sets exactly one cookie: an essential session cookie (td_session) that keeps you logged in. It is strictly necessary for the service, so no consent banner is required — and there is nothing else to consent to. No third-party or advertising cookies exist on blobsort.com.
No other third party receives your personal data, except authorities where the law obliges us.
Under the GDPR you can, at any time and free of charge:
Blobsort is not directed at children under 16. If you believe a child has created an account, contact us and we will remove it.
If this policy changes materially, we'll e-mail you before the change takes effect and keep prior versions available on request.