Privacy Policy

Last updated:

The short version: CONSUMED is built to be private. Your notes and files live in your own browser — we never receive, store, or sell them. The only data that leaves your device is anonymous usage analytics, and (only if you choose to turn it on) a copy of your space saved to your own Google Drive.

1. Who we are

CONSUMED ("we", "us") provides the web and desktop app at consumedonline.com. For any privacy question or to exercise your rights, contact consumedonline@gmail.com.

2. What data we process, and why

Data	Where it's stored	Purpose / legal basis (UK/EU GDPR)
Your notes, cards, files, settings	Your browser only (local storage / IndexedDB)	To provide the app. We do not receive or store this. No transfer to us.
Passphrase (if you set one)	Hashed, your browser only	To lock your space. Never transmitted.
Anonymous usage analytics (page views, device type, referrer, coarse region)	Vercel Web Analytics	To understand and improve the product. Legitimate interest. Cookieless; no cross-site tracking; not linked to your identity.
Standard server logs (IP address, request time)	Vercel (hosting)	To operate and secure the site. Legitimate interest. Held briefly by our host.
Cloud sync copy of your space (opt-in only)	Your own Google Drive (a hidden app-data folder)	To sync across your devices. Consent (you click "Connect Google Drive"). Stored in your Google account, not ours.

We do not use advertising, we do not sell or share personal data, and we do not build profiles of you.

3. Third parties who may process data

Vercel Inc. — hosting and privacy-friendly analytics. (Vercel privacy policy.)
Google LLC — only if you enable cloud sync, and only your own Google Drive account. We use Google's app-data scope, which limits access to a hidden folder created by this app. (Google privacy policy.)
Websites you choose to embed or bookmark load directly from those sites, at your request.

Fonts are self-hosted — no font CDN receives your IP address.

4. International transfers

Our host and (optional) sync provider are US-based. Where personal data is transferred outside the UK/EEA, it is protected by appropriate safeguards such as Standard Contractual Clauses and the providers' data processing terms.

5. Retention

We hold none of your content, so there is nothing for us to retain or delete on servers. Your data stays on your device until you delete it. Analytics are aggregated and anonymous. If you use sync, the copy remains in your Google Drive until you delete it or disconnect.

6. Your rights

Under UK/EU GDPR you have the right to access, correct, erase, restrict, object to, and port your personal data. Because your content lives on your device, you can exercise most of these yourself, instantly:

Access / portability: ⋯ menu → Export backup gives you a full copy in one file.
Erasure: ⋯ menu → Delete all my data wipes everything from this browser. If you used sync, it also removes the copy from your Google Drive.
For anything else, email us at the address above. You also have the right to complain to your local supervisory authority (in the UK, the ICO).

7. California (CCPA/CPRA) & other US states

We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising. You have the right to know, delete, and correct your information, and not to be discriminated against for exercising these rights — exercisable via the in-app tools above or by contacting us.

8. Cookies & local storage

The app uses your browser's local storage to function (this is essential and cannot be turned off without disabling the app). Our analytics are cookieless. We do not use tracking or advertising cookies.

9. Children

CONSUMED is not directed to children under 16 (or the minimum age of digital consent in your country), and we do not knowingly collect their data.

10. Changes

We may update this policy; the "last updated" date will change. Material changes will be highlighted in the app.