Modulo · Private preview
Your information in this preview
Signing in creates a private test account. It does not upload your local projects, start a trial or charge you. This notice covers the account preview at modulo-staging.croat.dev.
Who is responsible
Martin (Modulo), based in Croatia, is the controller for this preview's account and security information. Contact majeric.martin@gmail.com for privacy requests or questions. No separate data protection officer has been appointed for this private development preview.
What we use and why
- Account access: your email address, email-verification status and dates, identity identifiers, invitation and personal-workspace records. These provide the account service you request under the preview terms.
- Acceptance: the terms/notice version and timestamps, and your confirmation that you are 18 or older. We do not request your date of birth. These records establish the applicable account conditions.
- Security: sign-in challenges, attempt counts, session identifiers and dates, and keyed email/IP rate counters. We use these to prevent account misuse and manage access, relying on our legitimate interest in protecting the service and its users.
- Support: information you choose to email us, used to answer the request and investigate relevant problems. We retain only what is needed to handle the matter and any necessary security or legal follow-up.
Your email and account conditions are needed for sign-in. You can use the available local tools without creating this preview account. Account pages do not use advertising or optional analytics cookies. We do not sell your information or use your private designs to train AI models. No payment information is collected by this preview, and it does not make automated decisions with legal or similarly significant effects about you.
Device storage and providers
Necessary cookies hold an opaque account session and a short-lived sign-in challenge. The app-session cookie expires after at most 14 days, and server access also expires after 24 hours without activity. Signing out or revoking a session ends its access. Local project and recovery storage stays in your browser until you manage it; signing in does not copy that content to the server.
The application runs on the operator's Hostinger VPS. Supabase provides the authentication service and database, whose selected primary region is Ireland (eu-west-1). Resend delivers requested sign-in emails, including the recipient address and one-time code. Your email provider also processes those messages. Hosting and service providers receive network and security metadata, which can include IP addresses; the application's own rate counters use keyed identifiers.
An EU primary database does not mean all processing stays in the EU. Provider support, security operations and subprocessors may process information in other countries, including the United States. The relevant provider agreements describe their transfer mechanisms, including applicable standard contractual clauses. See Supabase's data-processing terms, Resend's data-processing terms and Hostinger's privacy information. Contact us to request information about the applicable safeguards. Access is limited to the operator and providers needed to run or support the preview, or a recipient required by applicable law.
How long records remain
The daily authentication cleanup removes expired challenges after a further day, session history after a further 14 days beyond its maximum session lifetime, and expired rate-counter records. It clears an invitation's email within the daily cleanup cycle once 30 days have passed after use, withdrawal or unused expiry. Invitation identifiers and consumption dates remain account records; removing the email does not make them anonymous.
Account, identity-binding, workspace and acceptance records remain while the preview account is in use. Closure and deletion requests are handled manually; automated account erasure is not yet available. We assess which records can be removed and whether narrowly necessary security or legal records must remain, and explain applicable exceptions. Provider delivery and security records have their own retention conditions; Resend's current free plan lists 30-day data retention. Local browser storage has no automatic expiry managed by the account service. This preview has no qualified cloud backup or recovery promise.
Your rights and choices
You can request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests, where the relevant legal conditions apply. Email the contact above. We may need proportionate verification to protect your account and will respond within the applicable legal time limit, normally one month. Accepting the terms does not consent to unrelated marketing or tracking.
You can complain to Croatia's Personal Data Protection Agency (AZOP) or another competent supervisory authority. We will publish material changes to this notice with a new version. This notice describes the current private preview; future customer projects or paid services require updated information before they are introduced.