Legal

Privacy Policy

Version 2026-09-07 · Effective 7 September 2026

The short version

We collect what the app needs to work and nothing else. There are no analytics, no advertising, no tracking pixels and no third-party scripts — Majakka makes no requests to anyone else's servers. The one cookie we set is the one that keeps you signed in. And, as the Terms of Service say, your data can be deleted at any time without notice.

This policy explains what Majakka stores, why, and for how long. It describes the service as it is actually built rather than in general terms.

1. What we collect

Because you typed it in

Your name and email address, from the sign-up form. The email address is also how you sign in.
Your password, stored only as a bcrypt hash. We cannot read it, and neither can anyone who obtains the database.
Your work — organizations, projects, task titles and descriptions, priorities, due dates, assignments and column names. Whatever you choose to put in these fields is stored as you wrote it.
Invitations you send, including the email address you addressed them to and the single-use code.
That you accepted these documents, as a timestamp and a version number, recorded when you created your account.

Because the service needs it to function

A session record — an identifier, your user id and the time you were last active — so that you stay signed in between requests.
Failed sign-in attempts, recorded against your email address and your IP address, so that password guessing can be rate-limited. This is the only place an IP address is stored, and only for failures.
Ordinary server logs, which include IP addresses, request paths and timestamps, produced by the web server as it runs.

What we do not collect

No analytics or usage tracking of any kind.
No advertising identifiers, and no data sold or shared for advertising.
No third-party scripts, fonts, or embedded content. The app loads nothing from other servers, so no third party sees your visit.
No payment details — the service is free and takes no payments.
No location data beyond whatever an IP address implies.

2. Cookies

Majakka sets one cookie, majakka_session. It holds a random identifier and nothing else — no personal data is stored inside it. It is marked HttpOnly so scripts cannot read it, SameSite=Lax to limit cross-site use, and Secure when the site is served over HTTPS.

It is strictly necessary for signing in, so there is no consent banner: without it the service cannot work at all. There are no analytics or advertising cookies to opt out of.

3. Why we hold it

To operate the service you asked for: to authenticate you, to show you your work, to let the people in your organization collaborate, and to protect accounts against password guessing. We do not use your content to profile you, and there is no automated decision-making.

4. Who can see your data

You, and the members of any organization you belong to — they can see that organization's projects, tasks and member list, and your name and email address as a member of it.
Nobody in another organization. Tenant separation is enforced in the database itself, not only in the interface.
The people who operate Majakka, who necessarily have access to the server and database.
Our hosting and database providers, who store the data on our behalf.
Anyone we are legally required to disclose to, where we are compelled by law.

We do not sell your data, and we do not share it for marketing.

5. How long we keep it

Account and content — until deleted by you or by us.
Sessions — cleared after inactivity, and when you sign out.
Failed sign-in records — a rolling window of about 15 minutes, then removed.
Invitations — they expire, and can be revoked before then.

Deleting an organization deletes its projects and tasks with it. Note that this cuts both ways: as the Terms of Service set out, we may also delete any of it at any time, without notice, and we are not obliged to keep backups or to be able to restore anything.

6. Security

Passwords are hashed with bcrypt and never stored in readable form. Sessions are stored server-side, and the session identifier is replaced whenever you sign in or change your password. Every database query uses prepared statements. Sign-in attempts are rate-limited. The connection between the app and its database is encrypted.

None of this makes any service perfectly secure, and we cannot guarantee it. Use a password you do not use anywhere else.

7. Your rights over your data

Depending on where you live — in the UK and the EEA in particular — you may have the right to ask for a copy of your personal data, to have it corrected or erased, to object to or restrict how it is used, and to complain to your data protection authority.

These rights come from the law and exist independently of the Terms of Service: accepting those terms does not waive them, and nothing in them is intended to. To exercise a right, write to the address below. You can change your name, email address and password yourself at any time on your account page.

8. Children

Majakka is not intended for children, and we do not knowingly collect data from them. If you believe a child has created an account, write to us and we will remove it.

9. International transfers

Majakka is hosted on cloud infrastructure, and your data may be stored and processed in a country other than your own. Where the law requires safeguards for such a transfer, we rely on the mechanisms available to us for that purpose.

10. Changes to this policy

We may update this policy. The version and date at the top of this page change when we do. Continuing to use the service after a change means you accept the updated policy.

11. Contact

For any privacy question, or to exercise a right described above, write to jkqs44@gmail.com.