Privacy policy

Huna is a workspace and business-operations application operated by Mark Paul Cañeda. In this policy, “Huna,” “we,” “us,” and “our” mean the operator of Huna. “You” means the person using Huna, and “workspace data” means information you or another workspace member enters into a workspace.

Huna is designed to keep operational records useful and portable. Workspace records are stored in your browser by default. If you enable Sync to Huna Cloud, Hunasends a copy of those records to our backend so authorized members can use the workspace on other signed-in devices. Account, authentication, workspace, and membership data are processed by our backend when you use Huna.

If you use Huna for an organization, the organization may decide why personal or other third-party information is entered into a workspace. In that situation, the organization may be the controller or business for that content and Huna may act as its service provider or processor. Contact the relevant workspace owner first for requests about records they control.

Information you provide

• Account and authentication data: your email address, display name, account identifiers, and authentication or recovery information. If you use Google sign-in or connect Google, Google and our authentication provider may provide us with the account details needed to identify and sign you in. Huna does not receive or store your Google password.
• Workspace setup data: workspace name, slug, membership, role, ownership, and timestamps.
• Workspace records: information you choose to enter, such as calendar events, notes, bookmarks, expenses, income, debts, accounts, countdowns, habits, cycle logs, and notification settings. These records can include dates, amounts, notes, links, and other details you choose to enter.
• Messages and requests: information you provide when you contact us about support, privacy, security, or legal matters.

Information collected through use

• Browser storage: Huna uses IndexedDB to store local workspace records and local storage for settings such as theme, language/region preferences, and pending sync changes. Browser storage is controlled by your device and browser. Clearing it can remove records that have not been synchronized.
• Session and security data: essential cookies or similar technologies used to maintain a signed-in session, protect routes, prevent abuse, and troubleshoot authentication.
• Usage and device data: information that may be made available by hosting, authentication, or analytics providers, such as IP address, browser and device type, pages or features used, timestamps, and error or diagnostic information. Google Analytics may be enabled for a particular deployment; when it is, Google may use cookies or similar technologies under its own policies.

Bookmark metadata

When you ask Huna to load metadata for a bookmark, the bookmark URL is sent to the server. The server requests the public page, follows limited redirects, and returns available title, description, site name, canonical URL, image, and favicon information to your browser. Huna does not need or request credentials for the linked site. The linked site may receive the request and process it under its own privacy policy.

Information about other people

Only enter information about other people when you have a lawful basis and the authority to do so. You are responsible for giving those people any notices required by applicable law and for responding to requests about records that your organization controls.

Huna is not designed for payment-card numbers, passwords, private keys, biometric data, health data, or other highly sensitive data unless the operator has expressly agreed in writing to support that use. If you use a dedicated business field, such as a custom business identifier, do so only when it is necessary, lawful, and authorized. Do not put secrets in notes or other free-text fields.

We use information for the following purposes:

• provide, authenticate, maintain, and personalize Huna;
• create workspaces, apply workspace permissions, save records, and synchronize records when you enable cloud sync;
• provide support, respond to privacy requests, and send service or security communications;
• secure the service, detect abuse, investigate incidents, maintain backups, and enforce our Terms of Service;
• understand product performance and improve Huna, using analytics only where permitted by applicable law and according to the choices available in the relevant deployment; and
• comply with legal obligations, lawful requests, and regulatory or law-enforcement requirements.

Legal bases where required

If a law such as the GDPR or UK GDPR applies, we rely on the following legal bases as appropriate to the processing:

We disclose information only as needed for the purposes described in this policy. Depending on how you use Huna, recipients may include:

• Supabase or our configured backend provider for authentication, database storage, access controls, and real-time synchronization;
• Google when you use Google sign-in, connect a Google identity, or when Google Analytics is enabled for the deployment;
• Hosting, infrastructure, security, and support providers that process information on our behalf and under appropriate contractual or legal safeguards;
• Workspace members and administrators who are authorized to access the relevant workspace; and
• Authorities or other parties where disclosure is required by law, necessary to protect rights or safety, or needed to investigate fraud, security, or abuse.

We do not sell personal information. We do not knowingly share personal information for cross-context behavioral advertising. We may use aggregated or de-identified information that cannot reasonably identify you to operate, measure, and improve Huna.

Providers may process information in countries other than where you live. When cross-border transfer rules apply, we use a lawful transfer mechanism or other safeguard required by the applicable law. Provider privacy practices are governed by their own notices, including the Supabase Privacy Policy and Google Privacy Policy.

We keep information only for as long as it is reasonably necessary for the purposes described here, to provide the service, resolve disputes, meet legal obligations, enforce agreements, and protect the service. Actual periods depend on the type of information and how you use Huna.

• Account and workspace metadata are generally kept while your account or workspace is active and for a limited period afterward when needed for security, backups, or legal obligations.
• Cloud-synchronized workspace records remain until you or an authorized workspace member deletes them, the workspace is deleted, or we otherwise remove them under this policy. Deletion markers and backup copies may remain temporarily so changes can propagate and systems can be restored.
• Records stored only in your browser remain there until you delete them, clear browser storage, or the browser removes them. Huna cannot recover an unsynchronized record after it is cleared.
• Authentication, hosting, and analytics providers may retain logs or account data under their own retention schedules and agreements.

Controls in Huna

• Turn cloud sync on or off in Advanced settings. When it is off, new local records remain in the browser and are not sent to the cloud by the sync service.
• Export or import local records from Advanced settings. The export is a JSON file; protect it like any other business record.
• Review connected Google identities and remove a connection when another sign-in method is available.
• Workspace owners can delete a workspace from Workspace settings. This permanently removes the workspace and its membership records from the application; local browser copies and provider backups may require separate time to clear.

Privacy requests

Depending on where you live, you may have rights to know, access, correct, delete, restrict, object to, or port your personal information, and to withdraw consent where processing is based on consent. You may also have the right to complain to your local data-protection authority. To submit a request, email paraghimo@gmail.com from the email address associated with your account, or identify the account and workspace concerned. We may need to verify your identity and authority before responding.

If your request concerns information entered by an organization or workspace owner, we may direct you to that organization or act on its documented instructions. This does not limit any rights you have against the organization or under applicable law.

California residents

Subject to applicable thresholds and exceptions, California residents may have rights to know or access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service for exercising those rights. We do not sell personal information or share it for cross-context behavioral advertising. To make a request, use the email above and include “California privacy request.” We will not discriminate against you for exercising a right.

For additional information about California rights, see the California Attorney General’s CCPA guidance.

Philippines

If the Philippine Data Privacy Act of 2012 applies, we aim to process personal data transparently, for a legitimate purpose, and only to the extent proportionate to that purpose. You may exercise rights available to you under the Act, including the right to be informed, access, correct, object, block or erase where warranted, and data portability, subject to legal limitations. You may contact the National Privacy Commission at privacy.gov.ph if you believe your rights have been violated.

Security

We use reasonable administrative, technical, and organizational measures designed to protect information, including authenticated access, workspace-level access controls, encrypted transport where supported, and security monitoring by our providers. No internet service, browser, or storage system is completely secure. Keep your password private, use a unique password, review workspace membership regularly, and report suspected unauthorized access promptly.

Changes to this policy

We may update this policy when Huna, our providers, or the law changes. We will post the revised version here and update the “Last updated” date. If a change materially affects how we use information, we will provide additional notice where required. Earlier versions may be requested by contacting us.

Contact

Questions, requests, and concerns about this policy may be sent to paraghimo@gmail.com.