Momentum

Privacy Notice

Last updated: 28 July 2026

This notice explains what personal data Momentum (operated by SANA Platform) collects, why we collect it, and what rights you have over it.

1. What we collect

  • Account data — your name, email address and a salted bcrypt hash of your password. We never store your password in readable form.
  • Content you create — tasks, projects, notes, subtasks, tags and comments.
  • Subscription data — your plan, status, renewal date and the Paddle customer and subscription identifiers.
  • Technical data — a session cookie required to keep you signed in, plus standard server logs (IP address, timestamp, requested URL) kept for security and debugging.

2. What we do not collect

We do not collect payment card details — those are entered directly into Paddle’s checkout and never reach our servers. We do not run third-party advertising or analytics trackers, and we do not sell personal data to anyone.

3. Why we process it

To provide the Service you asked for (performance of a contract), to take payment and prevent fraud (legitimate interest and legal obligation), and to keep the Service secure (legitimate interest).

4. Processors we use

  • Paddle.com Market Ltd — Merchant of Record; processes payments, tax and invoices.
  • Our hosting provider — runs the application server and database on which your account data is stored.

5. Cookies

We set one strictly necessary cookie to maintain your signed-in session, and store your theme preference in your browser’s local storage. No advertising or tracking cookies are used, so no consent banner is required.

6. Retention

We keep your data for as long as your account exists. Deleting your account from Settings permanently erases your tasks, projects, notes and profile. Paddle retains transaction records for the period required by tax and accounting law.

7. Your rights

You can access, correct, export or delete your personal data. Most of this is self-service in the app; for anything else, email us and we will respond within 30 days. If you are in the EEA or UK you also have the right to lodge a complaint with your local data protection authority.

8. Security

All traffic is served over HTTPS. Passwords are hashed with bcrypt. Access to production systems is restricted to the operator of the Service.

9. Contact

For any privacy request, write to dernur0505daryn@gmail.com.