Privacy

Last updated 2 October 2026

This page says what ProcrastiMate keeps about you, why, who else is involved, and how it's protected. The short version: we keep the minimum, we never sell it, we don't track you, and the sensitive parts are locked in ways that would leave a thief with nothing useful.

1 · What we keep

• Your account: the name you chose, your email address, and a password.
• Your jobs: the one-line jobs you add, the time slot and icon for each, whether you've marked it as recurring, and any place or time you've bound it to (such as Home or Weekend).
• Your history: for each job you said Yes to, its name, how long it was, and when you finished. This is what the Progress page and your ticket balances are made from. We also keep a count of the Skip and Pick tickets you've spent. Answering No records nothing.
• A sign-in cookie so you stay signed in (see section 4).
• Technical details for safety: your IP address, kept for a short while to stop password guessing and abuse. Our hosting provider also keeps the ordinary server logs that every website produces.

That's all. There are no analytics, no advertising, no tracking pixels and no social-media buttons, and the pages make no requests to any other company when they load; even the lettering is served by us. Nothing about you is public: there are no profiles, no sharing, and nobody else can see your jobs.

2 · What we use it for

• Running the app for you: saving your jobs, picking a task, keeping the timer honest across your devices, and showing your progress.
• Emailing you a 6-digit code when you create your account or ask to sign in by code. That is the only email we send. No newsletters, no marketing.
• Keeping the service safe: your IP address is used only to limit repeated attempts.

We don't use your information for marketing, we don't build a profile of you, and no automated decisions are made about you.

3 · Who else is involved

We don't sell, rent or share your details. Two companies help run the service, and each only sees what it needs:

• Bunny.net hosts the app and its database in the EU.
• Resend delivers the sign-in code emails. Our Resend sending domain is set to its EU region, so those emails are sent from servers in Ireland. Resend is a US company and its own account records are covered by the standard safeguards for such transfers.

4 · Cookies and your device

We use one strictly necessary cookie, pm_session, to keep you signed in. It's set when you sign in, lasts 30 days, and isn't used for tracking, so it needs no cookie banner. Signing out removes it.

Your browser also keeps a few small things on your device: your name for a quicker start, which page you were on, whether sound is on, and the place and time you've chosen on the Home screen. None of it leaves your device except the place and time, which are sent with each spin so the right jobs are picked, and aren't stored. Clearing your browser's site data removes all of it.

5 · How long we keep things

• Your account, jobs and history: until you delete your account. Choose Settings → Delete account and everything is removed at once: your name, email, password, jobs and history. Nothing is kept or anonymised.
• Sign-in codes: expire after 10 minutes and are useless after that.
• Safety records tied to your IP address: at most a few hours, then discarded automatically.
• Hosting logs: kept by our provider for a limited time under their normal practice.

6 · How it's protected

Protection was designed in from the start rather than added later.

• Your password is never stored. It's turned into a one-way scramble the moment you set it. Nobody can turn that back into your password, not a thief and not us, which is also why we can never tell you what it is; you'd request a code instead.
• Your email address is encrypted in the database, and the key that unlocks it is kept somewhere else entirely. If a copy of the database were stolen, the addresses in it would be unreadable.
• Everything travels over HTTPS. Plain connections are refused, and browsers are told to always use the secure address.
• Sign-in is rate-limited. Codes allow three tries, and repeated failed logins lock an account for a while, so passwords can't be guessed by brute force.
• The app can't be embedded in other sites, and it only runs its own code, which stops the common ways of hijacking a page.
• Your jobs are only ever shown to you. Every request is checked against the signed-in account.

7 · Your rights

Under UK and EU data-protection law you can ask for a copy of your data, have it corrected, have it deleted, restrict or object to how it's used, and receive it in a portable form. Deleting your account yourself, from Settings, is immediate and complete. For anything else, email hello@procrastimate.com and we'll reply within a month. If you're not happy with our answer, you can complain to your data-protection authority; in the UK that's the Information Commissioner's Office (ico.org.uk).

8 · Children

ProcrastiMate isn't intended for children under 13 and we don't knowingly keep their details. If you think a child has created an account, contact us and we'll remove it.

9 · Changes

If this page changes, the date at the top changes with it. For anything significant we'll tell you in the app.