Privacy Policy

An Honest Take

I'm an indie developer, not a big corporation. One of my main motivations for building UnDercontrol was that I wanted full control over my own sensitive data — tasks, finances, personal notes — instead of handing them to big tech companies. I built this for myself first, and now I'm sharing it with you.

I have zero interest, ability, resources, or motivation to do anything with your data. That said, I understand if you don't fully trust me — you shouldn't blindly trust anyone online. Big companies with entire security teams still get breached. So why would you trust a solo developer? You have every right to be skeptical.

Your Choices

That's why I give you options. You don't have to use our cloud service. You can use the Desktop App — your data stays 100% on your device, never touches any server. Or you can Self-Host — run your own instance, full control, your infrastructure.

The cloud service exists for convenience, not because I want your data. If privacy is your priority, go local or self-host. No hard feelings.

Where This Policy Applies

This policy covers everything that carries the UnDercontrol name: this website, the web app, the desktop app, the command-line tool, and the mobile app for iOS distributed through the App Store and TestFlight. Where a section below says “the cloud service”, it means the hosted backend the apps talk to by default — not the desktop app running locally, and not an instance you host yourself.

If you use the mobile app against our hosted backend, everything below — what is collected, who else processes it, how long it is kept, and how to delete it — applies to you.

What's Saved on the Server

If you use our cloud service: account info (email, username) and the data you create — tasks, expenses, budgets, etc. I promise I won't look into your data, but you don't need to trust me.

Concretely, the cloud service holds four kinds of data. Contact info — your email address, used to sign you in and to reach you. Identifiers — the user ID that ties your rows together. User content — the tasks, notes, comments and chat messages you write, plus any files, images or documents you upload. Financial info — the expenses, incomes, accounts, budgets and possessions you enter, if you use the finance features.

What it does not hold: no advertising or tracking identifiers, no device or crash diagnostics, no location, no contacts, no health data. The mobile, desktop and web apps contain no analytics, crash-reporting or attribution SDK. Voice input is turned into text before it leaves the app — no audio recording is uploaded to us. In-app purchases are verified locally on your device, so we never receive a receipt.

Choose desktop app or self-host to fully control your data

Who Else Processes Your Data

AI features send content to a model provider. When you use the built-in assistant, or an AI action on a task, a note or an image, the text you submit and the item it acts on are sent to a large-language-model provider so it can answer. Which provider depends on configuration: the cloud service uses a provider configured on the server (an OpenAI- or Anthropic-compatible API), and you can point the app at your own provider instead. We do not use your content to train any model; what a provider does with what it receives is governed by that provider’s own terms. If that matters to you, configure your own provider, or use the desktop app or a self-hosted instance.

This website uses Google Analytics. oatnil.com — the marketing and documentation site you are reading this on — loads Google Analytics (measurement ID G-B3E5P48S9Y) with IP anonymisation enabled, to count page views. The apps do not load it, and there is no advertising or cross-site tracking anywhere.

Infrastructure. The site and the API are served through Cloudflare, and the backend runs on a rented server with a managed Postgres database and S3-compatible object storage. Those providers process data in transit and at rest the way any host does. Apart from them and the model provider above, we do not share your data with anyone, and we do not sell it.

How Long We Keep It, and How to Delete It

While your account exists, we keep what you put in it — there is no automatic expiry, and nothing is deleted behind your back.

Deleting your account permanently removes your account, everything it owns, and your uploaded files. Comments you left on other people's cards remain part of those conversations, no longer attributed to you. Security audit records are retained for up to 30 days, and a small number of account-lifecycle records are retained indefinitely.

Deletion is immediate and irreversible. There is no “pending deletion” state, no grace period and no undo, and you are asked to re-enter your password first. Everything the account owns goes at once, including uploaded files in object storage, and including things you had shared with other people — shared items are deleted, not handed over.

Three things are kept on purpose, and it would be a lie to claim otherwise. First, audit logs are not erased by account deletion — an audit trail the subject can erase is not an audit trail. They expire on their own schedule instead: 7 days by default, 30 days for security-relevant events (sign-in attempts, group and membership changes), and a small number of account-lifecycle and system-configuration records (such as “this account was created”) indefinitely. The cleanup job runs once a day at 03:00, so the real maximum is less than a day longer than the period stated. Second, if your account owns an AI agent, that agent’s configuration row is emptied and retired rather than deleted — it is the only source of the author name on every comment that agent left on other people’s cards, and deleting it would damage their data, not yours. Third, a group your account owns is soft-deleted, so that membership and credential revocation can be handled.

To delete your account today, email lintao.amons@gmail.com from the address you signed up with and say you want it deleted. In-app account deletion went live on 21 August 2026 and is available in the mobile app. The web app has no self-service deletion — if you use UnDercontrol only in the browser, email is the route that works for you.

On the desktop app with local storage, or on an instance you host yourself, none of this involves us: deleting the data — or the whole database file — is entirely in your hands.

Security

I do my best: HTTPS everywhere, passwords are hashed, database is secured. But I'm not a security expert. If you're handling sensitive data, self-host or use the desktop app.

For self-hosted users, security is in your hands. Keep your server updated and follow basic security practices.

Web Clipper Chrome Extension

The Web Clipper extension captures page content only when you click “Save”, and sends it to your local disk or to the UnDercontrol server you configured — never to a third party. Your credentials are stored on your device and are only ever sent to that same server URL. The extension bundles all of its scripts locally, loads no remote code, and does not track your browsing history or activity.