Privacy

Who is responsible

A person, not a company: Guilherme Battoni, who built this site and keeps it running.

For anything about your data — to see it, correct it, delete it, or simply understand it — write to guilherme@battoni.dev. It is the only channel, and it serves all four languages of the site.

You get an answer within 7 business days.

What we store, and why each field exists

Only what step 4 asks for. Nothing is collected behind your back.

Name

First name only. It tells us who we are talking to, and it goes into the ready-made support message. It never appears on your public page.

Email

It is how you sign back in and how you recover your password. It is also the contact stored alongside your schedule.

Password

It is in none of our tables. Supabase Auth handles it and keeps only a scrambled version — one the password cannot be recovered from.

Congregation and city

They entered the form back when a schedule could be found by contact plus congregation. That route is gone: today it is your email and password that bring you back. Both are still asked for, by the decision of the person who runs the site, and today they do one thing — they go into the ready-made message you send to support, so we know where you are writing from.

The goal, the hours and the week

The goal you picked, how many hours it holds, the seven days you drew, the months or weeks you marked as tight, and which rhythm the week came from. That is the schedule: storing it is what this site is for.

Language

So the site and the emails speak your language when you come back.

Your schedule's address

It is the link you share. You choose it, and what the site suggests is never your name.

The dates

When you saved, when you last adjusted, when you ticked the consent box, and when you confirmed your email.

Why this is sensitive data

Your name, your contact, your congregation and your city are stored together with the fact that you are planning pioneer hours. Together, they say what your religion is.

Brazil's data protection law calls that sensitive personal data — religious conviction, article 5, II — and treats it differently from the rest. That is why the consent on step 4 covers only this, sits in plain view, and starts unticked.

You may refuse. The whole planner works without saving: you can pick the goal, draw the week and see the cycle month by month without leaving anything here. What you give up is coming back later to adjust it.

Consenting does not tie you down either. You can take it back at any time, at the same address above. Taking it back means deletion: without the consent there is no reason to keep anything.

What is public

Your schedule has an address of its own, and anyone with the link sees the page. That is what makes it something you can send to a group.

What the page shows: the goal, the hours, the week you drew, whatever is marked as tight, and the date of the last adjustment.

What it does not show, and cannot show: name, contact, congregation and city. The database function behind that page was written without those fields — it is not a rule someone can forget to apply.

The page also asks search engines to leave it out. A readable address that turns up on Google is exactly how a name ends up publicly tied to a religion.

Who else touches this data

Three companies, and no one else.

Supabase

Stores the database and handles accounts and passwords.

Vercel

Hosts the site. It sees what any server sees of a visit: the address requested, the browser, the IP.

Resend

Delivers the emails — the address confirmation and the password recovery.

All three are based in the United States, so your data may be processed outside Brazil.

Nothing is sold, nothing is traded with anyone else, and there is no advertiser.

Cookies and tracking

There is no tracking. No audience measurement, no advertising cookie, no social network pixel.

What stays on your device, and only there: the schedule you are building, which disappears when you close the tab; the address of your schedule, so the way back appears straight away; and your session, if you have an account.

The technical logs

Three things are logged, so that abuse shows up instead of running silently:

• Every "is this address free?" check, with the address checked. It may be your name, if that is what you chose.
• The old attempts to find a schedule by contact. The contact there was stored scrambled, never in the clear.
• The email confirmation links, also scrambled: a database leak would hand over no live link.

None of these logs carries your name, your email or your congregation.

How long we keep it

Indefinitely. Your schedule and your account are kept until you ask for them to be deleted.

There is no automatic expiry, and an abandoned account is not deleted on its own. If you no longer want us to keep it, write and we will delete it.

Your rights

The law gives you, among other things: to know whether we hold anything of yours, to see what it is, to correct what is wrong, to ask for a copy, to know who it was shared with, to withdraw consent, and to ask for deletion.

All of them in one place: guilherme@battoni.dev. You get an answer within 7 business days.

Write from the address you registered, if you still have access to it — it is what we have to know it is you. If you have lost access, say which one it was and tell us what can be checked: name, congregation and city.

How to ask for deletion

There is no delete button on the site. Deletion is done by hand, one at a time, and that is why it takes a few days instead of being instant.

What goes: the row holding your schedule, with name, contact, congregation, city and the week you drew; and your account, with the password.

What stays: the technical logs above, which do not carry your name.

If you are under 18

The law treats a child's data separately. If you are under 12, the person who should fill in the form and tick the consent box is your father, your mother or your guardian.

The site does not ask your age and has no way to check. We take the word of whoever fills it in.

Security, without promising too much

What is in place: the password never passes through our tables; the schedule table is closed, and someone who is not signed in can write to it but never read from it; the public page goes through a function that cannot return a name or a contact; the links sent by email are stored scrambled.

What cannot be promised is that nothing will go wrong. Nobody can promise that, and anyone who does is lying.

When this page changes

The date at the top says when it was last written. If what we store, what it is for, or who we share it with changes, that date changes with it.

See also the terms of use