Privacy
Sorted is a to-do service run by Raya Studio (rayastudio.id). This page explains what we keep about you and why. We follow the laws of Indonesia, including Law No. 27 of 2022 on Personal Data Protection (UU PDP).
What we collect
- Your account email.
- Your password, stored only as a one-way hash. We cannot read it.
- What you put in Sorted: to-dos, projects, areas, tags, notes, checklists, repeat rules, reminders and settings.
- Your change history, so you can undo and review edits.
- Calendar feed URLs you add. Our server fetches them from the host you point at.
- Push notification endpoints, with the browser user agent, from browsers where you turn notifications on.
- The names of connected-agent (MCP) tokens you create.
- Sign-in session records.
- If you delete your account, a record of its account id and deletion time, kept so restores stay deleted.
- Security logs: sign-in attempts are kept up to 1 day, and rate-limit records up to 2 hours. They hold IP addresses and email addresses.
Why we use it
To run the service you signed up for, and to prevent abuse and keep accounts safe. Our legal basis is performing the service you asked for, and our legitimate interest in security.
What we do not do
We do not sell your data. There are no ads. We run no tracking or analytics scripts.
Who processes it
- Tencent Cloud: hosts our server, located in Singapore. Your data is stored there.
- Resend: delivers our emails (verification and password reset).
- Cloudflare: DNS, and Turnstile bot protection on sign-up and similar forms.
- Browser push services (Google, Mozilla, Apple, Microsoft): deliver notifications, if you enable them.
How long we keep it
- Account data stays until you delete your account.
- Sign-ups that never verify their email are deleted after 7 days.
- Backups are kept on our server only and age out within 14 days. If we restore a backup, we delete again any account that was already deleted.
Your rights
Under UU PDP you can access and export your data, correct it, delete it, withdraw consent, and object to our use of it.
- Access and export: Settings → Account → Export My Data.
- Deletion, and withdrawing consent: Settings → Account → Delete Account.
- Anything else, such as correction or objection: email hello@rayastudio.id.
Security
Data is encrypted in transit between your browser and our server. Passwords are hashed. Each account's data is isolated from every other account.
Children
Sorted is not directed at children under 13. Under UU PDP, users under 18 need the consent of a parent or guardian.
Changes
We may update this page. We will post the change on the site, and the effective date above will move.
Contact
Raya Studio, hello@rayastudio.id.