Privacy

1. Who answers for this

The controller of your data is Moreno Preto, based in Argentina. For any request about your data, write to contact@kokoro-nikki.com.

2. What Piecerun does not do

No advertising, no third-party trackers, no pixels, no analytics. Piecerun does not sell or rent data to anyone, and does not train models on your content. The only cookies it uses are the two listed below.

3. The waitlist

Piecerun is not open yet. In the meantime, the site offers to take your email so we can tell you when it opens. That is all that form does: it does not create an account, it does not subscribe you to anything, and it asks for nothing else.

What is stored: your email and the date you left it. Nothing else. Your name is not asked for, and the page you came from is not recorded.

Where: that form is a Google Form, so your email is held by Google and not on a Piecerun server. Moreno Preto decides what happens with that list; Google only hosts it on his behalf.

What for: one notice, when Piecerun opens. There is no newsletter, the list is not sold or handed to anyone, and those emails are never joined with the data of any account.

For how long: until we tell you, or until you ask to be taken out. If a year after you left it Piecerun still has not opened, the whole list is deleted.

How to get out: write to contact@kokoro-nikki.com and your email is deleted. You do not have to say why, and nothing will be asked of you in return.

4. What it stores, one by one

To have an account: your email, your name if the provider gives one, which provider you used — Google or GitHub — the identifier that provider gave you, when the account was created and when you last signed in. Nothing else. Piecerun never receives or stores your password.

To keep you signed in: a session with its creation and expiry dates. Of the token that travels in the cookie, only its fingerprint is stored; the token itself is never written down. If someone walked off with that file, it would not let them in as you.

Your work: the brand kit, the pieces, the copy, the images you upload, the calendar, the ideas, the edit history and the trash. That is your content, it lives isolated per account and never mixes with anyone else.

Billing: which plan you have, the state of the subscription, until when it is valid, and the identifiers Stripe uses for your customer and subscription. Card details never pass through Piecerun at any point.

The credentials you load — the model one, and Instagram, Telegram or the bucket if you use them. They are stored encrypted, and the model one never comes back out to the browser.

Server logs: which requests arrived, with what result, and when. They exist to find a failure and to spot abuse, and they are kept for a short time.

5. The cookies, which are two

• foundry_sesion: the one that keeps you signed in. It lasts 30 days and the product cannot work without it.
• foundry_idioma: whether you picked Spanish or English. A preference, nothing more.

Neither of them can follow you around other sites, because there is no third party able to read them.

6. What they are used for

• Giving you the service: storing your work, showing it, rendering it and scheduling it.
• Knowing who you are when you sign in, and which account you are standing in.
• Charging the subscription and telling you what state it is in.
• Writing to you when something affects you: a failed charge, a price change, a change to these texts.
• Finding failures and stopping abuse.

The legal basis, briefly: giving you the service and charging for it is performing our contract; finding failures and stopping abuse is our legitimate interest in keeping the service standing.

7. Who they are shared with, and why with each

• Google or GitHub: only to confirm you are you when signing in. They receive the sign-in request, not your content.
• Stripe: processes the payment and holds your payment method. It gets your email and what you pay, never your work.
• The model provider you choose: receives what the agent needs to work on your pieces, governed by their own policy.
• The provider hosting the server: stores the files, without looking at them.
• Instagram, Telegram or your image bucket: only if you configure that integration, and only what that integration sends.

Outside that list, and whatever a court order may require, your data goes nowhere.

8. Where they live and for how long

Data is stored on servers that may be outside your country, and some of the services above are foreign. That means international transfers, and we make them with the safeguards the applicable law requires.

Your content is kept while you have the account. If you ask us to delete it, it is deleted within 30 days, except what must be kept for accounting or tax obligations — the records of what you paid — and the server logs, which expire on their own.

Cancelling the subscription deletes nothing: the account moves to the free plan and your work stays. Deleting is a separate, explicit request.

9. How they are protected

Credentials are stored encrypted with AES-256-GCM under a key that lives neither in the code nor in the data folder: if someone walked off with a copy of the disk, the ciphertext is useless to them. Sessions store a fingerprint, not the token. Each account writes in its own space and cannot read another one.

None of this is a promise of absolute security, because no such promise exists. If there is ever a breach that affects you, we will tell you, with what we know and what we are doing about it.

10. Your rights

You can ask to see what data we hold about you, to correct it, delete it, take it with you, or object to a use. Write to contact@kokoro-nikki.com and we answer within 30 days.

Taking it with you is genuinely easy: all your work is text files and images that export as they are, with no proprietary format in between.

If you are in Argentina, Law 25.326 gives you these rights and you can complain to the Agencia de Acceso a la Información Pública. If you are in the European Union or the United Kingdom, the GDPR ones apply and you can complain to your supervisory authority. If you are in California, the CCPA ones apply, including the right not to be discriminated against for exercising them.

11. Minors

Piecerun is a work tool and is not directed at minors. We do not ask for or seek children data; if we learn an account belongs to a minor, we close it.

12. If this changes

If we change something material about how we handle your data, we tell you by email 30 days ahead and update the date above. A wording change that does not change what we do with your data only changes the date.