Last updated: May 17, 2026
This Privacy Policy describes how Pramien collects, uses, stores, and shares personal data, and sets out the rights available to individuals whose data we process. By creating an account or using the service, you acknowledge that you have read and understood this policy.
For questions or requests relating to this policy, contact us at privacy@pramien.io.
Pramien is developed and maintained by Russel Gear ("we", "us", "our"), acting as data controller in respect of personal data processed through the service. All data is stored on infrastructure located in the EU (Frankfurt, Germany).
Email/password accounts: We collect your name, email address, and a bcrypt-hashed representation of your password. Passwords are hashed before being written to the database and are never stored or transmitted in plaintext.
Google sign-in: Upon authorisation, we receive your name, email address, and Google profile photo URL from Google. We also store the OAuth tokens returned by Google (access token, refresh token, ID token) as part of the authentication handshake. These tokens are not used to access Google services on your behalf following sign-in.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
If you submit your email address via the early access form on our website, we store it solely for the purpose of notifying you when Pramien launches. Your email will not be used for any other purpose and will not be shared with third parties beyond Resend, which delivers the launch notification. You may request removal from the early access list at any time by emailing privacy@pramien.io.
Legal basis: consent (GDPR Art. 6(1)(a)).
An encrypted, HttpOnly session cookie is issued upon sign-in and stored on your device. The cookie contains your user ID, email address, display name, profile photo URL, and an internal version counter used to invalidate existing sessions upon password reset. Sessions expire after 30 days of inactivity. No session records are maintained server-side beyond what is necessary to validate the token version on each request.
Legal basis: performance of a contract; legitimate interest.
Authentication endpoints log each request using a composite key comprising the endpoint identifier, the client IP address, and the email address submitted (e.g. sign-in:203.0.113.5:user@example.com). These records are automatically purged upon expiry of the applicable rate limit window — between 15 minutes and 1 hour depending on the endpoint. IP addresses are not stored independently or used for any other purpose.
Legal basis: legitimate interest in preventing abuse and unauthorised access (GDPR Art. 6(1)(f)).
We use PostHog to collect analytics data about how the service is used. This includes page views, navigation patterns, feature interactions, session behaviour, device type, browser, operating system, and IP address (used to derive approximate country, then discarded). Where you are signed in, analytics events may be associated with your user ID.
This data is used solely to understand usage patterns and improve the service. It is not used for advertising or shared with third parties for commercial purposes.
Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
Analytics data collection is subject to your cookie preferences. You may opt out at any time via the cookie settings accessible in the footer of the application.
We do not collect or store:
We disclose personal data to the following third-party processors solely for the purposes specified:
We do not sell personal data. We do not disclose personal data for advertising purposes.
Where required under GDPR Art. 28, Data Processing Agreements are in place with each processor.
To delete your account and all associated data, email us at privacy@pramien.io with the subject line "Delete my account". We will permanently delete your account within 30 days and confirm once complete.
Subject to applicable law, you have the right to:
To exercise any of these rights, submit your request to privacy@pramien.io. We will respond within 30 days. Where we are unable to fulfil a request, we will provide written reasons.
Account deletion is handled via email. To delete your account and all associated personal data, send an email to privacy@pramien.io with the subject line "Delete my account". Upon receipt, we will verify your identity by confirming ownership of the registered email address, permanently delete your account and all associated data (including name, email, password hash, OAuth tokens, and profile photo URL), and send a confirmation once complete. The process will be completed within 30 days of your verified request.
Data subjects in the EU/EEA have the right to lodge a complaint with their national Data Protection Authority.
We use the following cookies:
__Secure-authjs.session-token) — strictly necessary for authentication. HttpOnly, encrypted, transmitted over HTTPS only. Does not require consent and cannot be opted out of while signed in.A cookie consent banner is displayed on first visit. Analytics cookies are not set until consent is granted. You may withdraw consent or change your preferences at any time via the cookie settings in the application footer.
Passwords are hashed with bcrypt prior to storage. Verification and password reset tokens are stored as SHA-256 hashes only. Session tokens are encrypted and signed. All personal data is stored within the EU on Neon-managed infrastructure.
We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction, in accordance with GDPR Art. 32.
The service is not directed at children under the age of 13. If we become aware that a child has registered an account, we will delete it without undue delay. To report such an account, contact us at privacy@pramien.io.
We reserve the right to update this policy at any time. Where changes are material, we will provide notice by email or via an in-app notification prior to the changes taking effect. The effective date at the top of this document reflects the most recent revision.
Russel Gear
privacy@pramien.io