Your weekly plan is stored in your own web browser, on your own device. AertaOne never receives it and has no copy of it. We hold no account for you, set no cookies, run no analytics, and the app contacts nobody else unless you connect it to your own Microsoft 365 account, which is described below. There is no passphrase: what keeps the plan private is that somebody has to be able to sign in to your computer and open your browser profile to reach it.
AertaOne provides Aerta OnTrack and is the data controller for the limited processing described below. For any question about this notice, or to exercise the rights set out at the end, contact ontrack@aertaone.com.
Everything you enter (your tasks, hours, next steps, requests, decision log, archived weeks and parked notes) is written to a database inside your web browser (IndexedDB) on the device you are using. It is not sent to us, and there is no server-side copy.
It is not encrypted, and this is deliberate. Earlier versions encrypted it with a key held on the device or derived from a passphrase. Neither bought anything a signed-in computer was not already providing: a key stored beside the data is readable by anyone who can read the data, and a passphrase asked for several times a day is a lock people work around rather than a lock that holds. What protected the plan in practice was always your operating-system sign-in and your browser profile, so that is what protects it now, and this notice says so plainly rather than implying more.
Be clear about what that means. Anyone who can use your computer while you are signed in can open the app and read your plan, exactly as they could open your email. Anyone who can copy your browser profile can read it too. If your plan contains anything you would not leave on your screen, do not record it here.
A workspace created by an earlier, encrypted version is read once with its passphrase and written back in the clear; recovery copies made with the old key cannot be read afterwards and are discarded rather than kept as unreadable rows.
This has a consequence worth understanding. Because we never receive your plan, we cannot recover it for you, produce it on request, or restore it if the browser profile holding it is gone. The privacy guarantee and the absence of a safety net are the same fact, which is why the app offers to write a copy into a folder you choose.
Only what is unavoidable in serving a web page. The app is hosted by Vercel Inc., acting as our processor. When your browser requests the site, Vercel processes standard connection data on our behalf:
| Data | Why | Lawful basis |
|---|---|---|
| IP address, date and time, the file requested, browser and operating system identifiers | To deliver the page, keep the service available, and detect abuse or attack | Legitimate interests (Article 6(1)(f): operating and securing a tool we make available to our people |
Vercel retains these request logs for a limited period under its own policies and then deletes them; see the Vercel privacy policy. Vercel is based in the United States, so this involves a transfer outside the European Economic Area, made under the standard contractual clauses in Vercel's data processing agreement.
We do not receive these logs in any form that we use to identify or profile individuals, and we do not combine them with anything else.
The app is deliberately built so that you do not need to record other people's details. There is no field for a requester's name; a request holds a link to the ticket instead. Typed email addresses and phone numbers are refused in titles, notes, next actions and other free-text fields. Manual email capture stores a searchable reference, subject, received date and an optional https link, not the message body, and not an address you type. The one structured exception is a message imported from a connected mailbox, which may keep the sender display name and address exactly as Outlook supplied them, on that source record only, so you can find the message again. The same rule applies whether the source is attached at capture, later, or after the work is committed.
Titles, next steps and outcomes remain free text, because a task you cannot read is a task you cannot do. If you choose to write a colleague's name into one of those fields, that is personal data about them, held on your device and under your control. Keep such notes to what you actually need, and remember that anything you export in a backup travels with the file.
Connecting is optional, off until you set it up, and you can remove it at any time. If you do connect it, your browser talks to Microsoft directly. The request and the reply do not pass through the site this app is served from, and we never see either.
The connection asks for two read-only permissions and no others:
No other folder is read. The app asks for that folder's message list and nothing else. Nothing is written to your mailbox or calendar, no message is sent, and nothing is marked as read.
What is kept on your device, inside your plan: the folder you chose; a short reference for a message you ignore so it is not offered again; and, for each message you turn into a request or attach to existing work, its subject, the sender's name and address as Outlook supplied them, the time it arrived and the Outlook link. Message bodies are never stored. A message you neither accept, attach nor ignore is not kept. Reading the folder on a schedule only changes what is offered to you; it never adds work to your plan by itself.
The sign-in itself is deliberately short-lived. We ask for no refresh token, so the access token lives in the page's memory and is gone when you close the tab or after about an hour. There is nothing to steal from storage, and no way for the app to reach your mailbox while you are not using it. The application and directory identifiers you enter are public identifiers from your own app registration, not secrets.
Two consequences worth being clear about. A subject line and a sender's address are personal data, yours and theirs, and they travel in any copy of your plan you save elsewhere, so treat a folder you sync them into as holding personal data. And Microsoft processes this under your own agreement with them, as the operator of your mailbox; we are not a party to it and receive nothing from it.
An Outlook calendar file you select is processed locally in a separate browser worker. The app keeps only the daily busy-hour totals, working window, time zone, import time and allowance you approve. It does not save or upload the source file, meeting titles, attendees, locations or message bodies. The selected file remains wherever you saved it. A snapshot does not update when Outlook changes.
Focus appointments exported as .ics files contain a generic “Focus time” title and times, with no task title, ticket link or attendees. Outlook decides how to store an appointment after you import it. Opening an Outlook or ticket link takes you to that provider under its normal access controls; Unless you connect Microsoft 365, OnTrack sends no mailbox requests at all.
A plan left behind by a much older version in localStorage is adopted into the current database rather than replaced with sample data. Conflict checks on a saved copy keep a content digest rather than a second copy of the file. Folder names and copy times remain browser metadata.
You can export your plan as a file and put it wherever you choose: a folder on your device, OneDrive, or another service. Once a backup leaves the app it is governed by whatever you saved it into, and by that provider's terms and privacy policy. We have no visibility of it. Each backup includes a workspace identifier and a revision number so this device can recognise an older copy of the same plan before you restore it.
A copy is ordinary JSON and is readable by anyone who opens the file. If you choose a folder for the app to write copies into automatically, pick one only you can reach — a personal OneDrive folder rather than a shared drive. A copy made by an older version with its own passphrase can still be restored, with that passphrase; what gets written to this device afterwards is not encrypted.
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form.
In practice, most of these you exercise directly and immediately: your plan is on your device, you can export it at any time from Data & backup, you can edit any part of it, and clearing the site's data erases it beyond recovery. We could not comply with a request about your plan even if you made one, because we do not hold it.
For the server request logs described above, write to ontrack@aertaone.com and we will deal with your request. You also have the right to lodge a complaint with the Data Protection Commission, Ireland's supervisory authority.
The site is served only over HTTPS, with a content security policy that permits no external scripts, styles, fonts or connections, and no connections at all beyond Microsoft's two hosts if you have connected Microsoft 365. There is no server that holds your data, so there is no server to breach. Saved copies are written two files at a time, alternately, each read back and checked after writing, so an interrupted write cannot destroy the only copy.
No system is perfect, and the honest limits are these: anyone who can use this computer while you are signed in can read your plan; anyone who can copy your browser profile can read it; a copy you save into a shared or synced folder is readable by whoever can reach that folder; and clearing your browser's site data erases the plan with no way back except a copy you kept. If your threat model includes someone with access to your unlocked machine, this app is not the place for that information.
If the app starts doing something this notice does not describe, the notice changes first. The date at the top always reflects the current version.