Privacy policy: Ondalonga
Last updated: 2026-10-26
Who is responsible
Ondalonga is run by Luca Piu. It decides what is stored and why. Questions about your data: hello@lucapiu.com.
What we store, why, where and for how long
Everything is kept on our own server (Shared web hosting in the United States), in a database that belongs to this app only. Other apps we run have their own separate databases and accounts; nothing is shared between them.
| Data | Why | Where | How long |
|---|---|---|---|
| Account: username, and a one-way hash of the password (never the password itself) | To create your account and let you sign in | Our database | Until you delete your account |
| Email address, if you give one, and whether you confirmed it | To confirm it is yours and to send password-reset links | Our database | Until you delete your account |
| If you sign in with Google or Apple: the user id that provider gives us for you, and the email address and name it shares (Apple may share a private relay address instead). We never receive your Google or Apple password | To recognise you when you sign in again, and to let you use more than one way to sign in to the same account | Our database | Until you remove that sign-in method or delete your account |
| Signed-in devices: a short description of the browser or device and when it was last used. We keep only a hash of the sign-in token, and no IP address | To keep you signed in and let you sign out other devices | Our database | Until the sign-in expires or you sign out; at the latest when you delete your account |
| A one-way hash of your IP address or username, with a time | To slow down guessing of passwords. The original IP address is not stored | Our database | About one day |
Who else receives data
Nobody. We do not sell your data, and we do not pass it to other companies.
Cookies and analytics
We set one cookie, which keeps you signed in. It is strictly necessary for signing in and is not used for tracking. While you sign in with Google or Apple we also set a second cookie, which lasts a few minutes and only makes sure the sign-in is finished by the same browser that started it. We set no advertising or tracking cookies.
We do not use analytics or tracking of any kind.
Deleting your data
You can delete your account in the app's account settings. This removes your account and everything linked to it from the live database at once. Backups of the database are kept for up to 30 days, so a deleted account can remain in a backup until that backup expires. Backups are not used for anything else.
Your rights
You can download a copy of your data from the account settings, and delete your account there. You can also ask us to correct your data, to restrict or stop its use, or to explain what we hold. Write to hello@lucapiu.com. You may also complain to your local data protection authority.
Changes
If this policy changes, the date at the top changes too. If the change is significant, we will tell account holders in the app.