Privacy policy
Last updated
In short: we keep what Shadowlap needs to work, and a little usage and crash data to fix and improve it. Your tasks are never sent to analytics, crash reporting or any AI service. We don’t sell your data or show ads. Apart from Apple’s own services, your data stays in the UK and the EU.
Who we are
Shadowlap is made by Eduard Ene, trading as Meșter Labs, a sole trader in Scotland, UK. Eduard is responsible for your data (the “controller” under UK data protection law). You can reach us at support@mesterlabs.com.
What we collect, and why
Your account
You sign in with Apple. Supabase, our sign-in provider, stores your Apple user id, your email address (or Apple’s private relay address, if you chose Hide My Email), your name if you chose to share it the first time you signed in, when you signed in, and the IP address and device type of each sign-in. Our Supabase project is in London.
What you put in the app
Your tasks, projects, notes, runs, Ledger entries if you use them, and your settings, including your phone’s timezone so that your day turns over at 04:00 your time. They are kept in your own space on a server we rent from Hetzner in Helsinki, Finland, which no other account can reach. Nightly backups are kept on the same server for 14 days. The server knows you by a random user id; it doesn’t store your email address or name.
Server logs
To keep the service secure and working, the server logs each request it receives: your IP address, the time, the address requested and the app’s device type. Never your sign-in token, and never the content of your tasks. These logs are deleted after 14 days.
Usage analytics
PostHog, on its EU servers, records events such as opening the app, signing in and out, creating a task (but not what the task says) and which screen you’re on, along with your device model, iOS version, app version, language and timezone. It knows you by a random user id, never by your name or email. IP addresses are not stored.
Crash reports
When the app crashes or hits an error, Sentry, on its EU servers, receives the error, your device and iOS version, the app version, your user id, and the screens and server addresses the app used just before. Never the content of your tasks, and never your sign-in token. IP addresses are not stored.
Apple
Apple runs Sign in with Apple and TestFlight under its own privacy policy. If you test Shadowlap through TestFlight, Apple shares with us the feedback, screenshots and crash reports you send, and simple usage figures such as installs and sessions.
If you email us
Mail to our addresses reaches us through Cloudflare’s email routing and is kept in our Google (Gmail) mailbox for as long as we need it to help you.
What we never do
- We don’t sell your data.
- We don’t show ads.
- We don’t share your data with anyone beyond the services named on this page.
- We don’t send your content to any AI service.
Why we’re allowed to (UK GDPR)
- Your account and what you put in the app: to provide the service you signed up for (contract).
- Analytics, crash reports and server logs: our legitimate interest in keeping an alpha secure, fixing it and improving it. You can object at any time.
Where your data is
In the UK (Supabase, London) and the EU (Hetzner in Finland; PostHog and Sentry in Germany). Apple and Google handle data under their own policies.
How long we keep it
- Your account and content: until you delete your account, then up to 14 days in backups.
- Server logs: 14 days.
- Analytics: up to 1 year.
- Crash reports: up to 90 days.
Your rights
You can ask for a copy of your data or an export of it, ask us to correct or delete it, or object to analytics. Email support@mesterlabs.com from any address, and include the email address shown in Shadowlap under More → Account so we can find your account. In-app export and deletion are coming. We’ll reply within one month.
If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
Children
Shadowlap is not intended for anyone under 13.
Changes
When this policy changes, the date at the top changes too, and testers are told about any material change.
This website
shadowlap.app sets no cookies, runs no analytics and loads nothing from anyone else. Cloudflare, which hosts it, sees your IP address in order to deliver the pages.