Privacy Policy

1. Who we are

Stats is operated by Chapter 26 AS, a company registered in Norway under organisation number 938 312 273, with its registered address at Øyjordslien 26, 5038 Bergen, Norway. In data protection terms we are the data controller for the personal data described here.

For any question about this policy, or to exercise any of the rights below, write to support@statsapp.no.

2. What we collect

Information you give us when you sign up

• Your name
• Your email address
• Your password, which is stored only as a secure irreversible hash, never as text

The content you create in Stats

• The tabs you create and the columns you define
• Every stat you record, including dates, numbers, ratings, notes and checklists
• The widgets on your dashboard, and your layout and display settings
• Any photos you upload to a photo widget

We treat this content as personal data because it can be very personal. A weight log, a reading list or a workout history says a lot about someone, and we handle it accordingly.

Technical information

• Basic log data created when your browser or the mobile app contacts our servers, such as the IP address, the time of the request, and the type of device or browser
• Error reports, so we can find and fix bugs
• If you turn reminders on in the mobile app, a notification token, which is what allows Apple or Google to deliver the reminder to your device. It is deleted when you turn reminders off

Payment information

Who handles your payment depends on where you subscribe:

• On our website: payment is handled by Paddle, who act as the seller of record.
• Inside the iPhone or Android app: payment is handled by Apple or Google through the App Store or Google Play, under their own terms and privacy policies.

In every case your card details go directly to the payment provider and never reach our servers. We receive only your subscription status, the country from which you purchased, and a payment reference.

3. Why we use it, and our legal basis

We do not profile you, we do not sell or share your data with advertisers, and we do not use the content of your tabs to train anything.

4. Who else handles your data

We are a small company and we rely on a few established providers. Each one is bound by a data processing agreement, and each may only use your data to provide their service to us.

Paddle, Apple and Google act as independent controllers for the payment data they collect from you, each under its own privacy policy. We will update this list before adding any new provider that handles your personal data.

5. Where your data is stored

Your account, your stats and your photos are stored in Ireland, in the European Union. Some of our providers operate globally, so limited data such as technical logs and notification tokens may be processed outside the European Economic Area. Where that happens, the transfer is covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

6. How long we keep it

• While your account exists: we keep your data so Stats works.
• After you delete your account: your data becomes inaccessible immediately, and is permanently erased after 30 days. That waiting period exists so an accidental deletion can be undone.
• Backups: deleted data may remain in our encrypted backups for up to 30 days after erasure, until those backups are automatically replaced by newer ones.
• Invoices and accounting records: whoever took the payment issues the receipt. Paddle emails you an invoice for every payment and renewal made on our website, and Apple or Google does the same for purchases made in the mobile app. We keep the corresponding accounting records for 5 years, because Norwegian bookkeeping law requires it. This obligation overrides the right to erasure, and it applies to payment records only, never to the content of your tabs.
• Technical logs: our hosting providers keep connection logs (IP address, browser type, time) for up to 30 days for security and fault-finding, then delete them.

7. Your rights

Wherever you live, you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct anything that is wrong
• Delete your account and your data
• Export your data in a portable format. Stats has a built in CSV export, and it keeps working even if your subscription has ended
• Object to or ask us to pause the limited processing we do for security and fault finding, which is the only thing we do on the basis of legitimate interests
• Withdraw consent for anything you agreed to, such as reminder notifications

How to make a request

Most of these you can do yourself inside Stats. Your name, your email address and every stat you have recorded can be edited or deleted from your account settings at any time.

For anything else, write to support@statsapp.no from the email address on your account, so that we can be confident the request is genuinely yours. We will reply within one month. If a request is unusually complex we will contact you before that month is up, and explain why.

If you want a copy of your data, you do not need to wait for us. The CSV export inside Stats gives you the contents of your tabs and all your stats immediately. If you would rather have everything we hold, including your account details and any photos you have uploaded, ask us and we will send you a single file. We will never charge you for exercising a right, and we will never make the service worse because you used one.

8. Deleting your account

You can delete your account at any time from your account settings. When you do:

• You are signed out straight away and your data becomes inaccessible
• For 30 days the deletion can still be reversed, so contact us quickly if it was a mistake
• After 30 days we permanently erase your login, all of your tabs and stats, and every photo you uploaded
• Invoice records are kept for 5 years, as described above

If you have lost access to your account and cannot delete it yourself, email us from the address you signed up with and we will handle it.

9. Age requirement

Stats is not intended for children under 16. You must be at least 16 years old to create an account, and you confirm that you are when you sign up. We do not ask for your date of birth, because we do not need it and we prefer to collect as little as possible. If we learn that we hold data from a child under 16, we delete it.

If you are a parent or guardian and believe a child under 16 has created an account, contact us and we will look into it. We will ask you for enough detail to identify the account, and we will normally contact the account holder first. We do not delete an account on the strength of an unverified claim. Where we need time to establish the facts, we may suspend an account rather than delete it, so that nothing is lost either way.

10. Cookies

Stats uses only what is strictly necessary to work. We store a session token so you stay signed in, and your local preferences such as your chosen language. The app also keeps a copy of your own stats in your browser’s storage, so it opens instantly and keeps working when you are offline; it is removed when you sign out. We do not use advertising cookies, tracking pixels or third party analytics, which is why you do not see a cookie banner. If that ever changes, we will ask for your consent first.

11. How we protect your data

• All traffic between your device and our servers is encrypted with HTTPS
• Data is encrypted at rest by our hosting providers
• Database level security rules mean one account physically cannot read another account’s data
• Passwords are stored only as irreversible hashes, so nobody can read them, including us
• Administrative access requires two factor authentication

In the interest of transparency, we must point out one limit. As the operator of the service, a very small number of authorised people can technically access stored data. This happens only where it is necessary to fix a fault, to respond to a support request you have made, or to comply with a legal obligation. We do not access your stats for any other purpose than technical ones.

No online service can guarantee perfect security. If a data breach occurs and it presents a risk to your rights, we will notify the Norwegian Data Protection Authority within 72 hours of becoming aware of it, and we will inform you directly where the law requires it.

12. If you are in the United States

Some US states give residents additional privacy rights. We extend the following to all US users regardless of state, because running one standard is simpler and fairer:

• The right to know what personal information we collect and why
• The right to a copy of that information
• The right to have it corrected or deleted
• The right not to be discriminated against for exercising these rights

We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act or similar state laws, and we never have. We do not use your data for cross context behavioural advertising. To exercise any of these rights, email support@statsapp.no.

13. Complaints

If you are unhappy with the way we have handled your personal data, please contact us first, as most issues are resolved fastest that way. You also have the right to complain to a supervisory authority. Ours is the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no). If you live elsewhere in the European Economic Area, you may complain to the authority in your own country instead.

14. If Stats closes down or changes hands

We intend Stats to be around for a long time, but you deserve to know what would happen if it were not.

If the business is sold or transferred, your data would pass to the new operator, who would be bound by this policy until they gave you notice of any change. We would email you before that happened, so that you could export your data and close your account first if you preferred.

If Stats were to shut down, we would give you at least 60 days notice by email. Export would keep working for the whole of that period, and paying subscribers would be refunded the part of their subscription they had not used, unless we were prevented by law from doing so. At the end of the notice period we would permanently erase all accounts and all stored data, apart from the accounting records we are legally required to keep.

15. Changes to this policy

If we change this policy in a way that matters to you, we will email you and show a notice in Stats before the change takes effect. Smaller clarifications will simply appear here with a new date at the top. Previous versions are available on request.