Privacy

Last updated 12 October 2026. Plain words first; the legal details are underneath.

The short version

• We keep your email address and time zone so we can send one card a day at eight in the morning, your time.
• We keep your answers to cards and anything you write in your notes, because that is the product.
• We never sell or share any of it. No ads, no tracking pixels, no analytics scripts on this site.
• Your data is stored in Frankfurt, Germany, inside the EU.
• You can ask for a copy of everything, or for all of it to be deleted, by replying to any email or through thecontact form.

Who is responsible

Old Friend is run by Kuba through his company, Jakub Such Consulting, Poland, which is the data controller. You can reach me through the contact form.

What we store and why

• Email address and time zone, given when you sign up. Used to send the daily card. Legal basis: your consent and the service you asked for (GDPR art. 6(1)(a) and (b)).
• Your answers and notes (done, not today, not for me, and anything you write). Used to choose the next card and to show your own notes back to you. Legal basis: the service you asked for (art. 6(1)(b)).
• Signup date and the version of this page you agreed to, so we can show when and how you joined.
• Messages you send through the contact form, with your email address, so we can answer. Legal basis: our legitimate interest in replying to you (art. 6(1)(f)). Deleted a year after the conversation ends.

Your notes can touch on private things: family, health, grief. We treat them as such. They are never used for anything except showing them back to you, and only the author reads anything you write in reply to an email.

Who else handles it

Only the services that keep Old Friend running, each bound by a data processing agreement:

• Vercel (hosting this website)
• Neon (the database)
• Resend (sending the emails)

Your email address, answers, notes and messages are stored and processed in Frankfurt, Germany. The public pages of this website, which contain no personal data, are copied to servers around the world so they load quickly wherever you are.

Some of these companies are based in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

For as long as you are subscribed. If you unsubscribe, we keep your address only to make sure we never email you again, and delete everything else within 30 days. If you ask us to delete everything, we do, address included.

Your rights

You can see, correct, export or delete your data, withdraw consent at any time, and object to how we use it. Use the contact form or reply to any email from us. You can also complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) or the authority where you live.

Cookies

This website sets no cookies and loads nothing from third parties. Fonts are served from our own domain.