Privacy Policy
Last updated October 28, 2026
Vencelo exists to help you build consistency — not to sell your attention. This policy explains in plain language what data we process, why, and what your rights are under applicable data protection laws, including Brazil's LGPD (Law 13,709/2018).
What we collect
Account data (name, email, a password stored only as an Argon2id hash, language and time zone); the habits you create and your entries (dates, times, duration, mood, energy, notes, urges and reflections); and minimal technical security data (IP address and browser, used to protect sign-in and kept in logs for a limited time). We use no tracking cookies or advertising tools.
How we use it
To provide the service (store and compute your habits, streaks and insights), keep your account secure, and send only essential emails: sign-up confirmation, password reset and security alerts.
Legal bases
Performance of a contract to provide the service; legitimate interest for security and abuse prevention; and specific, explicit consent for the optional spiritual content, which may reveal religious beliefs — sensitive data.
Sensitive data
Notes about mood, health or addictions may be sensitive data. They are used solely to show you your own history and insights. They are never sold, shared for advertising, or used to train third-party models.
Who we share it with
Only with processors required to run the service: Amazon Web Services (email delivery) and Cloudflare (content delivery and attack protection). They process data only under our instructions. We do not sell data to anyone.
How long we keep it
For as long as your account exists. When you delete your account, your data is removed from the main database immediately and from backups within 14 days.
Your rights
You can access, correct, export (as JSON, in Settings) and delete your data at any time, and withdraw consent for spiritual content. For any other request, write to [email protected].
Security
Always-encrypted connections (HTTPS), Argon2id password hashing, protected sessions, optional two-step verification, encrypted secrets and restricted infrastructure access.