Privacy Policy

Who we are

Red Urchin is a time and priority management application operated by Pure Limits Pty Ltd (Australia), available at go.red-urchin.com. For anything in this policy, contact us at go@red-urchin.com. We are the data controller for the personal information described here.

What we collect

• Account details — your email address, a password (stored only as a secure cryptographic hash by our authentication provider), and an optional display name.
• Your content — the tasks, priorities, pages (Communications, Goals, Meetings, Notes), daily notes and file attachments you create in the app. Communications pages may contain contact details of people you record (name, phone, email, address, birthday).
• Subscription status — whether your account is on trial, active or cancelled, and related billing events. We never see or store your card details — payment is handled entirely by Stripe on their secure pages.
• Newsletter consent — whether you ticked the newsletter box at signup.
• Local app data — the app stores a copy of your content and your sign-in session in your browser so it works offline. This stays on your device.

We do not sell your personal information, and we do not use anything you create in Red Urchin for advertising. We do use three measurement tools — Plausible (cookieless), Google Analytics, and a Reddit conversion pixel that tells us whether our Reddit advertising works. See Cookies, analytics and advertising below, including how to decline the ones that use cookies.

How we use your information

Solely to provide Red Urchin: authenticating you, syncing your content between your devices, processing your subscription, sending you the emails you've asked for (account emails such as confirmation and password reset; the monthly newsletter only if you opted in — unsubscribe any time via the link in every issue), and responding when you contact us. We do not sell or rent personal information, and we do not use your content for advertising.

Google user data (Calendar and Contacts)

Connecting Google is optional. If you choose to connect your Google account, Red Urchin requests access to:

• Google Calendar — we read events from calendars you own or can edit, only to display them in the app's calendar panel beside your tasks; and we create, update or delete events in your primary calendar only when you explicitly set a calendar entry on a task or meeting.
• Google Contacts — we read your contacts only to let you search for and link a contact to a Communications page; when you link one, its details populate that page. If you edit those details in the app or use "Add to Contacts", we update or create the contact in your Google account at your direction.

How this data is handled:

• Your Google data is transferred directly between your browser and Google. Red Urchin's servers do not receive, store or process your Google Calendar events or your Google contact list. The access token Google issues stays in your browser on that device only.
• The only Google-related information stored in your Red Urchin account is what you deliberately place there: the identifiers of events the app created for you, contact details you chose to link into a Communications page, and the identifier of that linked contact — all protected like the rest of your content.
• We do not transfer Google user data to third parties, use it for advertising, sell it, or use it to train artificial-intelligence or machine-learning models. Humans at Pure Limits never read it — we technically cannot, as it never reaches our servers.
• You can disconnect Google at any time in the app (Settings → Link Applications → Disconnect), which revokes and discards the token on that device. You can also revoke Red Urchin's access from your Google Account at myaccount.google.com/permissions.

Microsoft 365 data (Calendar and Contacts)

Connecting Microsoft 365 is optional and works identically to Google: calendar and contact data flows directly between your browser and Microsoft; our servers never receive or store it; sign-in tokens stay on your device; only event identifiers and contact details you deliberately link into your pages are stored in your account. Disconnect any time in Settings → Link Applications, or from your Microsoft account's app permissions.

Where your data lives, and security

Your account and content are stored with Supabase, our database and authentication provider, hosted in Sydney, Australia (on Amazon Web Services infrastructure). All data travels over encrypted connections (HTTPS/TLS) and is encrypted at rest. Access controls in the database ensure each account can only ever read or write its own data. Payment processing happens on Stripe's PCI-DSS-certified systems. The offline copy in your browser is protected by your device's own security — we recommend using a device password and disk encryption, as you would with any offline-capable app.

Cookies, analytics and advertising

Plausible — cookieless, no consent needed

Plausible Analytics counts page views and referrers so we know how many people visit and where they came from. It is the one measurement tool here that needs no permission from you, because it collects nothing personal: no cookies, no local storage, no fingerprinting, no cross-site tracking, and no data that could identify you. Visitor counts are derived from a rotating daily hash that cannot be reversed or linked between days. Plausible is an EU company and the data is hosted in the EU.

Because there is nothing to consent to, Plausible is not covered by the cookie banner and runs for every visitor. If you would rather not be counted even anonymously, any browser-level tracking blocker will stop it, and we will not work around that.

We use Google Analytics 4 on this website and in the app to see how many people visit, which pages they read, and how many start a trial. It tells us whether our marketing is working. It is not used for advertising profiles: ad personalisation and advertising data-sharing signals are switched off, and we never upload your email address, your tasks or any of your content to it.

Google Analytics sets cookies on your device. We use Google Consent Mode v2, which means:

• If you are in the EEA, the UK or Switzerland, no analytics cookies are set and no analytics data is collected until you press Accept on the cookie banner. Declining is one click and leaves the product working exactly as before.
• Elsewhere, analytics cookies are set by default. You can turn them off at any time.
• Advertising cookies are denied everywhere, for everyone, by default.

To change your choice at any time, use the Cookie settings link in the footer of any page. Your preference is stored in your browser only.

Essential cookies and local storage that keep you signed in and let the app work offline are not analytics and cannot be switched off — without them the product does not function.

Reddit conversion pixel

We advertise Red Urchin on Reddit. The Reddit conversion pixel tells us how many people who saw an ad went on to start a trial or subscribe, so we can tell whether the advertising pays for itself. It is a third-party advertising tag, and we treat it more strictly than analytics:

• It does not load at all until advertising consent applies. In the EEA, the UK and Switzerland that means it loads only after you press Accept. Press Decline, anywhere in the world, and it never loads.
• We pass Reddit no personal identifiers — no email address, no name, no account ID. Reddit offers an "advanced matching" feature that would improve their attribution by sending them your email address; we have deliberately not enabled it.
• It records that an anonymous visitor viewed a page, clicked a trial button, created an account or subscribed, and the subscription amount. It never sees your tasks, pages, contacts or calendar.
• Reddit is a US company and processes this data outside Australia under its own privacy policy.

Declining costs you nothing: every feature works identically either way. Use Cookie settings in the footer to change your mind at any time.

Service providers we share data with

We share personal information only with the processors needed to run the service, and only what each needs:

• Supabase (Sydney, Australia) — database, authentication and account emails.
• Stripe — subscription payments; receives your email and payment details you enter on their pages.
• MailerLite — your email address, only if you opted into the newsletter.
• Resend — delivery of internal operational emails.
• Webcentral (Australia) — web hosting for this site and the app's files (they do not receive your account data).
• Google / Microsoft — only if you connect them, as described above, and at your direction.
• Plausible Analytics (EU) — anonymous, cookieless page-view counts for this site. No personal data, so nothing about you is shared with them.
• Google Analytics — usage statistics for this site and the app (pages viewed, trial signups), subject to the consent choices described above. No account content is sent to it.
• Reddit — anonymous conversion events (page view, trial started, subscription and its amount) when advertising consent applies, so we can measure our Reddit advertising. No personal identifiers and no account content.

Some providers (such as Stripe) process data outside Australia; where they do, they are bound by their own compliance frameworks and our agreements with them.

Retention, export and deletion

We keep your data while your account exists so the service works. You can export everything yourself at any time (Settings → Backup → Export data). If your subscription lapses, your data is retained and readable so you can return or export it. To delete your account and all associated content permanently, email go@red-urchin.com from your account address — we action deletion requests within 30 days and will confirm when complete. Newsletter unsubscribes are honoured immediately via the link in each email.

Your rights

We handle personal information in accordance with the Australian Privacy Act 1988 and its Australian Privacy Principles. You may request access to, correction of, or deletion of your personal information, object to or restrict certain processing, and receive a portable copy of your data. If you are in the European Union or United Kingdom, you have the corresponding rights under the GDPR / UK GDPR, and if in California, under the CCPA/CPRA (note: we do not sell personal information). To exercise any right, email us; we respond within 30 days. You may also complain to your local regulator — in Australia, the Office of the Australian Information Commissioner (oaic.gov.au).

Children

Red Urchin is not directed at children and is intended for users aged 16 and over. We do not knowingly collect personal information from children; if you believe a child has created an account, contact us and we will delete it.

Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected users and the relevant authorities in accordance with Australia's Notifiable Data Breaches scheme and other applicable laws.

Changes to this policy

When we change this policy we'll update the date at the top; for material changes we'll notify you by email or in the app before they take effect. Earlier versions are available on request.

Contact

Pure Limits Pty Ltd · go@red-urchin.com