Privacy Policy

Who's responsible

Horizio, the business of Dylan Halder, at Lange Nobelstraat 5A, 4301 HD Zierikzee, the Netherlands (KvK 70708126 · VAT NL002387616B36), runs Ideaful and is responsible for your personal data under the GDPR. Questions or requests: dylan@dylanhalder.com.

What we keep, and why

• Your account: your email address, a scrambled (hashed) version of your password that can't be turned back into it, whether your email is confirmed, and when you signed up. We need these to give you an account.
• What you make: your spaces (thoughts, ideas, links and their layout) and notes, saved to your account so they follow you between devices.
• Credits and payments: your balance, a record of what each credit was spent on, and your plan. Stripe gives us a customer and subscription reference; your card details stay with Stripe.
• Signing in: a session cookie, stored on our side only in scrambled form. Email codes (for confirming your email or resetting your password) are stored scrambled too, and expire after 15 minutes.
• The free spark: to allow one free spark per visitor per day, we keep a scrambled version of your IP address combined with the date. It can't be turned back into your IP, and it's deleted the next day.

The AI

When you use an AI action, the text involved (your thought, the ideas around it, and your answers to its questions) is sent to Anthropic, the company behind the Claude models, to generate a response. Under Anthropic's commercial terms, it isn't used to train their models.

Obsidian notes

If you connect an Obsidian vault, it's read in your browser and never uploaded to us. When you spark, only a short summary of your themes and a few excerpts from notes that match the thought travel with it to the AI. Ideaful never writes to your vault.

Who else handles your data

We use a few services to run Ideaful. Each handles your data only to provide its part:

• Vercel: hosts the website and the server.
• Supabase: our database, in the EU (Ireland).
• Anthropic: the AI that generates ideas, reviews, research and briefs.
• Stripe: takes payments and manages subscriptions.
• Resend: sends the emails with your codes.

Some of these are based in the United States. Where your data leaves the EU, it's protected by the EU's standard contractual clauses or the EU-US Data Privacy Framework. We don't sell your data, and we don't share it with advertisers.

Cookies and your browser

Ideaful sets one cookie, to keep you signed in. There are no advertising or tracking cookies. Your browser also stores your spaces and a few settings (like the theme and whether sound is on) so the app works offline and loads fast; that stays on your device.

How long we keep it

Your account data stays until you delete your account. Deleting it removes your account, spaces, notes, credits and their history from our database straight away. Stripe keeps records of payments for as long as tax and accounting law requires. Server logs are kept for a short time for security and troubleshooting.

Your rights

You can ask for a copy of your data, have it corrected, or have it deleted (you can also delete your account yourself from the account menu). You can object to how we use it, or ask us to limit it. Email dylan@dylanhalder.com and we'll respond within a month.

If you're not happy with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or to the authority where you live.

Changes

If we change this policy in a way that matters, we'll say so on the site or by email before it takes effect.