Privacy Policy

1. Who we are

Boffin is run by Rideone Nahian Islam, an individual based in London, United Kingdom (“we”, “us”, “our”). We are the “controller” of your personal information under UK data protection law.

Email: contact@boffin.work

2. What information we collect

Account information. When you register we collect your name, your email address and a password. Passwords are handled by Firebase Authentication. We never see or store your password in readable form.

Content you create. This is the content you add to Boffin, such as journal entries, checklists, whiteboards and timers. We store it so that you can come back to it from any device.

Technical information. Like most websites, our servers and our providers automatically record technical data such as your IP address, browser type, device type, operating system, and the date and time of requests. We use it to keep the Services secure and working.

We do not collect payment details, because Boffin is free. We do not ask for special category data (such as health or political opinions) as a separate category, but you may choose to write anything in your private journal. See section 4.

3. How and why we use your information

• To provide the Services (create your account, sign you in, save and show your content). Legal basis: performance of our contract with you.
• To keep the Services secure and fix problems (prevent abuse, detect errors, maintain logs). Legal basis: our legitimate interests in running a safe and reliable service.
• To reply to messages you send us. Legal basis: our legitimate interests, or your consent where relevant.
• To meet legal obligations, for example responding to a lawful request from authorities. Legal basis: legal obligation.

We do not use your information for advertising, we do not sell it, and we do not use it to build marketing profiles.

4. Who can see your content

Your journal, checklists, whiteboards and timers are private to your account. Our database security rules only allow the signed-in account owner to read and write that content. We do not read your content, except where you ask us for support and give permission, or where we must investigate a security issue or comply with the law.

Because a journal can contain very personal thoughts, please avoid storing information you would not want held in an online service, such as financial account numbers or passwords.

5. Who we share information with

We use Google (Firebase Authentication, Cloud Firestore and Google Cloud) to run Boffin. Google acts as our processor: it handles your information on our instructions and under its data processing terms, and it may not use it for its own purposes beyond those terms.

We may also disclose information if we are required to by law, to protect the rights, safety or security of users or the public, or in connection with a sale or transfer of the Services (in which case we would tell you and this policy would continue to apply to your information).

We do not sell your personal information or share it with advertisers.

6. Where your information is stored

Our database is hosted in the Google Cloud region [europe-west1 (Belgium), europe-west4 (Netherlands), europe-north1 (Finland)]. Google may process some data in other countries, including outside the UK and European Economic Area. Where that happens we rely on appropriate safeguards, such as the UK International Data Transfer Addendum or other approved transfer mechanisms in Google’s terms.

7. Cookies and similar technologies

Boffin uses only essential browser storage (such as cookies, local storage or IndexedDB) that is needed to keep you signed in and to make the Services work, for example the session information created by Firebase Authentication. These do not need your consent under UK rules.

We do not use analytics, advertising or tracking cookies. If we add any in future, we will update this policy and ask for your consent first. You can clear or block browser storage in your browser settings, but you may not be able to stay signed in if you do.

8. How long we keep your information

• Account and content: we keep them for as long as you have an account. If you delete your account (or ask us to), we delete your account and content from our live systems within 30 days.
• Backups and logs: these may persist for a short further period, normally up to 90 days, before being overwritten or deleted.
• Messages to us: we keep emails you send us for as long as needed to deal with your request, then delete them within 12 months, unless we need to keep them for legal reasons.

9. How we protect your information

We use technical and organisational measures such as encrypted connections (HTTPS), access controls on our database, and restricted access to administrative systems. No online service can be completely secure, so we cannot guarantee absolute security, but we take reasonable steps and will notify you and the regulator where the law requires us to after a breach.

10. Your rights

Under UK data protection law you have the right to:

• be told how your information is used (this policy);
• access a copy of your information;
• correct information that is wrong or incomplete;
• ask us to delete your information;
• restrict or object to certain uses of your information;
• receive your information in a portable format, where it applies; and
• withdraw consent at any time, where we rely on consent.

You can view and edit most of your information by signing in. To use any right, or to delete your account, email contact@boffin.work. We will respond within one month and may need to confirm your identity first.

11. Children

Boffin is not intended for children under 13, and we do not knowingly collect their information. If you are 13 to 17 you must have the permission of a parent or guardian to use Boffin. If you believe a child under 13 has given us information, email contact@boffin.work and we will delete it.

12. Complaints

If you have a concern, please contact us first at contact@boffin.work so we can try to put it right. You also have the right to complain to the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.

13. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above, and if the changes are significant we will tell you by email or a notice on the Services.

14. Contact

Email contact@boffin.work.