Privacy policy

Controller

The site operator and data controller for this website is Oğuzcan Ünver.

1207 Delaware Ave #1401, Wilmington DE 19806, United States

Contact: privacy@practicaladhdtoolkit.com

What this site collects

Public tools work without an account. While you fill a worksheet as a guest, answers stay in session storage for the current browser tab. They are not sent to the server, and closing the tab normally removes them.

If you create an account, the dedicated Keycloak identity service stores the email address and identity information needed for registration, verification, sign-in, and recovery. The separate application database stores only a stable Keycloak identifier plus worksheets you explicitly save. If you start a saved plan, it can also store plan-round dates and private check-ins you choose to add.

Creating an account does not subscribe you to marketing. If you separately ask for the weekly practical email, the application stores an encrypted copy of the address you entered, a keyed lookup value, the consent purpose, source, version and time, and content-free confirmation and delivery state. Existing Keycloak account addresses are never copied into this list automatically.

Saved worksheet answers, user-chosen worksheet names, check-in notes, reading locations, and next-step text are encrypted before they are written to PostgreSQL. The application does not put this content in URLs, analytics, identity-provider attributes, or routine logs.

If you explicitly enable email reminders, the application copies your verified Keycloak email address into the application database using a separate encrypted envelope. Amazon SES is used to send a fixed reminder nudge. The email contains a link to your signed-in Today view, but not your reminder text, worksheet answers, or generated output. Disabling email reminders clears the encrypted delivery address from normal application storage.

Optional measurement is disabled until you make a privacy choice. The site never sends worksheet answers, generated guidance, saved worksheet names, reminder text, names, email addresses, account identifiers, or record identifiers to analytics or advertising services.

Weekly practical email

The weekly email is a separate, optional marketing purpose. It uses double opt-in: entering an address queues only a confirmation request, and the practical email sequence starts only after the confirmation action is completed. Refusing or withdrawing this choice does not affect worksheets, accounts, saves, printing, reminders, or exports.

Every marketing message provides an unsubscribe route that works without a Toolkit account. Unsubscribing cancels queued messages and removes the normally usable encrypted address. A keyed suppression value may remain for up to three years so the system can respect the withdrawal and avoid sending again unless the person starts a new opt-in.

Authorized administrators can view the separately entered address together with its consent source and time, confirmation status, and content-free delivery state in the private administration area so they can operate the list and honor consent choices. This roster is not joined to Toolkit accounts, worksheet activity, or analytics.

Unconfirmed subscriptions expire from normal storage after seven days. Content-free delivery and complaint records are retained for up to 14 months. The program remains closed unless a reviewed delivery provider, sender address, unsubscribe handling, and complaint controls are configured; the existing account and reminder email credentials are not repurposed automatically.

Saving, exports, and deletion

The first server save always requires a clear action from you. Autosave starts only after that first save. You can export an individual worksheet or all saved worksheet data, plan rounds, and check-ins from account settings. You can edit or delete an individual check-in from its saved worksheet.

Deleting a worksheet removes its plan rounds and check-ins from normal application use as well. Deleting all saved Toolkit data removes the application profile, worksheets, answers, plan rounds, and check-ins. Encrypted backups expire within 35 days. Limited content-free security events are retained for no more than 30 days. Keycloak identity data can be managed separately in identity settings.

Hosting and operational data

The application, Keycloak, and PostgreSQL services run on infrastructure hosted by Hetzner in Germany. Amazon SES provides account and opted-in reminder email delivery. Encrypted database backups are stored off the production server for recovery. Operational logs are designed not to contain worksheet answers, reminder text, names, or email addresses.

Analytics

If you allow analytics, the site records content-free daily aggregate counts for events such as public page views, a confirmed worksheet intent, reaching a concrete first action, completed outputs, print actions, saves, accepted newsletter signup requests, views of a paid-book offer, and clicks on that offer. For an owned-book event, the fixed catalog slug and ASIN, broad page family, coarse source, and bounded placement label may be counted so the operator can compare which relevant offers help. These counters contain no visitor, device, account, or session identifier. A broad source category such as direct, organic search, social, referral, or an opaque Toolkit campaign may be counted; the referring URL and domain are not stored in these counters. Detailed aggregate dimensions are suppressed from administrative reporting when they could expose very small groups. Daily aggregate counters are deleted after 14 months.

Analytics consent also permits Google Analytics 4 on public pages. The Google configuration disables advertising signals and advertising personalization. Private account, Toolkit, administration, API routes, and public worksheet URLs opened with a private saved-record identifier are excluded. Specific worksheet, article, topic, book, academy and author URLs are reduced to broad route families before optional measurement. Google Analytics may process a pseudonymous browser identifier, approximate location, device information, referral category, and broad page or event information.

Signed-in administrator, measurement, and support sessions are excluded from public analytics, first-party public-event counters, and experiment assignment. This keeps routine site operation and quality checks out of the public growth funnel.

Provider: Google LLC. Service: Google Analytics 4. Purpose: measuring public traffic and broad product performance. Legal basis where required: your consent. Google's processing may involve international transfers under its applicable data-processing terms and transfer safeguards.

Google Analytics does not receive a Toolkit account User-ID, email address, hashed contact information, selected personal problem, free text, or a private record identifier from this site.

The private administrator dashboard periodically imports aggregate Search Console and Google Analytics reports. The imported snapshot contains fixed totals, comparison periods, and public landing-page paths only. Search queries, referral URLs, Google credentials, browser identifiers, account information, and private routes are not imported. These operational snapshots are retained for up to 180 days.

Campaign and advertising measurement

If you separately allow advertising measurement and arrive through a campaign link created by the Toolkit, the site may remember an opaque campaign code for up to 30 days. The code identifies the campaign, not you, and contributes only to aggregate campaign counts.

Google Ads conversion tracking is currently disabled. Meta Pixel, Meta Conversions API, advanced matching, remarketing audiences, enhanced conversions, and customer-list matching are not active on this site.

Enabling a new advertising provider requires a new privacy review, an updated provider disclosure, and a consent-respecting release before any data is sent.

Experience replay

No session-recording or experience-replay provider is currently active. The privacy controls show this future category as unavailable; it cannot be selected and no recording starts today.

Any future pilot must exclude worksheets, signed-in areas, account pages, administration, APIs, form values, private text, and people under the provider's permitted audience rules. This policy will identify the provider, captured data, route scope, safeguards, and retention before such a pilot is enabled.

Your measurement choices

Optional categories are off by default. You can reject them without losing access to public tools or account features. Use the Privacy choices link in the footer at any time to review or withdraw your choices. Withdrawing a choice removes the related first-party browser cookies that this site can remove and stops future optional collection from this browser.

The site honors a browser Global Privacy Control signal by keeping advertising measurement off. The consent preference itself is necessary storage and is kept for up to 180 days so the site can remember your decision.

Amazon links

This site links to Amazon product and author pages. If you click those links, Amazon receives data according to Amazon’s own policies.

With analytics consent, the Toolkit may add content-free daily counters when a known owned-book link becomes visible and when it is clicked. These counters record the fixed site book slug and ASIN, a generalized public page, a bounded placement, a coarse source category, and—on the Task Initiation Worksheet—its public worksheet slug. They do not record whether a purchase happens, any price or order information, activity after leaving this site, worksheet answers, or an account identifier.

Your rights

Depending on your jurisdiction, you may have rights to request access, correction, deletion, restriction, or objection regarding personal data, and to withdraw consent. Depending on where you live, you may also have a right to opt out of sale or sharing for cross-context behavioral advertising. This site does not sell personal data.

For privacy questions, contact privacy@practicaladhdtoolkit.com.