Privacy Policy

sideby (“we”, “us”) is operated by House of Fofanah LLC. sideby is available at joinsidebyside.com. This policy explains how we handle personal information when you use sideby.

Privacy questions and requests: admin@houseoffofanah.com.

Information you give us

• Account. You join by invitation during the beta, with an email address and either a one-time code, a sign-in link or a password. Sign-in with Google may be added later. Our sign-in provider, Clerk, handles your email address, password and sign-in method. sideby keeps your Clerk user ID, your display name and a link to your profile photo, copied from your Clerk account.
• Waitlist. If you ask to join the waitlist, our sign-in provider, Clerk, receives your email address and we use it only to answer your request and, if we invite you, to send the invitation. You can ask us to delete it at any time (see below).
• Profile. Anything you choose to add: a bio, time zone, city, Instagram handle, the last book you read, your task-visibility setting, your status and presence sharing options, and optional co-working hours.
• Your work. Tasks, daily plans, daily status and focus sessions. Deleted tasks are erased after 30 days; see section 7.
• Challenges and community. Challenges you host or join, your commitments, check-offs and results, posts, highlights and hearts, reactions, reports you file, forum topics, replies and likes, and roadmap votes.
• Messages. The text of messages you send in group and challenge chats, with the sender and time.
• Invitations. If you invite or are invited by an administrator, the email address used and the status of the invitation; and which referral or beta link brought you in.

Information collected automatically

• Approximate location. The first time you use the app we save the city, region and country that our hosting provider works out from your internet connection. We do not collect precise location and we do not update it afterwards. Administrators use it for usage statistics and as a fallback home city. Other members see a city only if you add one to your profile and make it public.
• Activity time. We record when you were last active (at most once a minute) so administrators can see who is online. Your status is shown to others according to your sharing settings.
• Notifications. The notices we create for you, your notification settings and, if you turn on push notifications, your browser’s push address, its encryption keys and its identification string.
• Safety and technical records. Reports and moderation actions (including a reason if an account is suspended and a log of administrator actions), short-lived counters that limit how fast an account can send requests, and the standard server logs that our hosting provider keeps for a limited time under its own policy.

Information from Google

If Google sign-in is offered and you choose “Continue with Google”, Google tells Clerk your name, email address and profile photo. We use this only to create your account and sign you in. We do not use it for advertising, and we do not share it with anyone except the service providers listed in section 6.

• Sign-in cookies set by Clerk keep you signed in. They are necessary for the app to work.
• Invitation and referral cookies remember the invitation or referral link you opened until you sign up (up to 30 days). They are removed once the invitation is applied.
• Local storage on your device remembers your theme and a few display settings. A service worker caches the app’s static files and an offline page so the app can start faster and show a message when you are offline. It does not cache your account data.
• We do not use advertising cookies, and we do not use third-party analytics or tracking tools.

• To provide sideby: sign you in, show your work and challenges, and let members of a group or challenge see each other’s activity and message each other.
• To send notifications you ask for (in the app and, if you turn them on, as push notifications), including challenge reminders. A daily background job creates reminders and pushes them to people who opted in.
• To keep the service safe: rate limits, handling reports, removing content and suspending accounts that break the rules.
• To understand use in aggregate (for example counts of members, challenges and activity by area), and to fix problems and improve the product.
• To communicate with you about the service, including invitations and responses to your requests.
• To comply with the law and protect our rights.

We do not sell your personal information, and we do not share it with advertisers or use advertising or tracking services. We share information only with the service providers listed in section 6, and only as described in this policy.

• Other members. Content in a group or challenge is visible to its members. Your name and photo are visible to people who share a group or challenge with you and, for forum posts and public challenges, to signed-in members. How much of your task list others see follows your task-visibility setting (titles or a summary). Profiles can be looked up by signed-in members who share a challenge with you, or when you take part in a public challenge or post in the forum.
• Nothing is visible without signing in. Apart from the landing page, these legal pages, and invitation links, the app requires you to sign in.
• Administrators. Administrators can see member lists, usage statistics, and content that has been reported. The app has no screen for administrators to read private chat messages. The people who operate sideby can technically reach the stored data, and the account email addresses in our sign-in provider’s dashboard, and they use that access only for legitimate operational, security and support purposes, such as running and repairing the service, keeping it secure, and handling your requests.
• Service providers listed in the next section.
• Legal and safety. We may disclose information if the law requires it or to protect people or the service.
• Business changes. If the service is sold or merged, information may move to the new owner, who must honor this policy.

We use these providers to run sideby. They process information to provide their services to us, and each also handles information under its own privacy policy.

• Clerk: accounts, sign-in, and the emails it sends for sign-in codes and invitations (Clerk uses an email delivery provider to send them).
• Google: only if Google sign-in is offered and you choose it.
• Neon (database hosting): stores the information described above. Our database is hosted by Neon on Amazon Web Services in the United States (us-east-1).
• Vercel: hosts and serves the app. The app’s server functions run in Washington, D.C. (US East).
• Ably: delivers real-time updates. We send it only a notice that something changed and who made the change, not message text, and each person’s connection is limited to the channels of groups and challenges they belong to. Ably also sees your user ID and connection details while you are connected.
• Browser push services (operated by Apple, Google or Mozilla depending on your browser): deliver push notifications you turned on, with a title and a short line of text.
• Buy Me a Coffee: an optional link only. We share nothing with it.

Because our database and some providers are in the United States, your information is processed there even if you live elsewhere. Some providers may also process information in other countries.

When you delete your account (Profile, then “Delete account”; you confirm by signing in again and typing DELETE), the following happens straight away:

• Deleted: your profile, private tasks and daily plans, focus sessions, notifications and notification settings, push notification devices, reactions, hearts, likes and votes, your referral code, your group memberships, and your sign-in account.
• Words erased: your messages, challenge posts, forum topics and replies, highlights, and your reports are replaced with “[deleted]”. The place where they were written stays, now shown as written by “Deleted member”, so other people’s conversations still make sense.
• Kept without your name: your points, check-off counts and place in challenges that already finished, and the fact that you took part, so other members’ rankings and results do not change. Your name, photo, location and email are removed from your account record, which remains only as an anonymous “Deleted member”.
• Challenges and groups you host: nobody is made host or owner without saying yes. You can ask up to three members to take over (each offer lasts 72 hours and the first yes closes the others), cancel a challenge and tell everyone (progress is kept), or leave it running without a host. A challenge or group without a host keeps running: members’ tasks, points and messages do not change, host-only actions are paused, challenges in a group are locked and the group’s invite link is paused, your invite links are revoked and any personal meeting link you added is erased, and everyone in it is told, without your name. Members who have been in for at least 3 days and have committed a task can volunteer to host; a volunteering takes effect after 24 hours unless another such member objects. A challenge or group with nobody else in it is deleted. A challenge you hosted that has finished stays, shown as hosted by “Deleted member”.
• You can also ask us to do this by email (see below). Admin accounts cannot be deleted from the app; an admin must be changed to a regular member first.
• Routine backups. Our database provider keeps a short rolling history of the database, currently about the last 6 hours, which lets us undo a serious mistake. We also keep a small number of backups that we make ourselves: one saved copy held by our database provider, and exported copies kept on a private, access-controlled computer used to run the service. We replace the saved copy and delete older exports as newer ones are made. Information you delete is removed from the live service straight away but can remain in these backups until they expire or are replaced.
• Temporary exports. We may make exports of data for maintenance, migrations, safety checks or to answer a request from you. We keep an export only as long as it is needed and then delete it.
• Records we may need to keep. Where the law requires, or to resolve a dispute, prevent abuse or protect safety, we may keep limited records longer, for example the safety records and deletion records described below.

Retention while your account exists:

• Account, profile, tasks, posts and messages: kept while your account exists.
• A task you delete is hidden for 30 days and then permanently erased. If a finished challenge still counts it toward your score, only its title and description are erased.
• A post you or a challenge host removes, and a forum entry a moderator removes, has its text erased 90 days after removal.
• A challenge’s chat, feed and highlights become read-only when the challenge ends, are no longer accessible to members 30 days later, and their text is erased at that point. A canceled challenge counts from the day it was canceled. Group chat is kept while the group exists.
• Notifications are deleted automatically after 60 days (a daily cleanup removes older ones, whether or not you open the app).
• Push addresses are removed when you turn push off or your browser reports the address is no longer valid.
• Rate-limit counters are cleared automatically.
• Reports, suspensions and the administrator action log are kept for up to 24 months to protect members. They hold short notes, not the text of chat messages, and access is limited to administrators. Records of account deletions (an ID, date and outcome only) are kept for the same period. Records of host-change offers and volunteering are kept for 90 days after they end.
• These cleanups run automatically once a day and every run is recorded.

• In the app: edit your profile and sharing settings, choose who sees your tasks and city, mute notifications or turn push off, delete tasks, leave a challenge you joined (hosts ask someone to take over, cancel, or leave it without a host instead), and delete your account. Name and photo are edited in your account settings.
• Ask us: to see the information we hold about you, correct it, export it, or delete your account and data, by emailing admin@houseoffofanah.com. We may need to confirm it is you, for example by replying from the email address on your account. We aim to respond within 30 days, or sooner where the law requires, and we will tell you if we need longer. There is no self-service data export yet; we prepare a file of your own data on request.
• Depending on where you live, you may have additional rights, such as to object to or restrict some processing, or to complain to your local data protection authority. We will respond as the law requires.
• Marketing: we do not send marketing email.

sideby is for people who are at least 16 years old. We do not knowingly collect information from younger people, and we will delete an account when we learn it belongs to someone below the minimum age. If you believe a child has an account, contact admin@houseoffofanah.com.

The app is served over HTTPS. You must sign in to reach your data, real-time connections are limited to the channels you belong to, and requests are rate-limited. Sign-in is handled by Clerk. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your information, we will notify you and any authority as the law requires.

We may update this policy. If a change is significant, we will tell you in the app before it takes effect. The date at the top shows when it was last updated.

House of Fofanah LLC. Email: admin@houseoffofanah.com.