Skip to content
Prohor

Legal

What Prohor keeps, and why

Last updated

Prohor is made by one person, Shaif Arfan, in Bangladesh. This page covers prohor.day, the waitlist on it, and the Prohor app at app.prohor.day. It says what is collected, where it goes, how long it stays, and how to have it removed.

The short version

  • We never sell your data. There are no ads and no ad trackers, on the site or in the app.
  • Visits to this site are counted without cookies and without identifying anyone.
  • The waitlist keeps your email address, and only until you are invited or you ask to come off it. It is not kept forever.
  • What you put in the app is yours. Ask for a copy, or for all of it to be deleted, at any time.

Who is responsible

Shaif Arfan, an individual in Bangladesh, decides what is done with your data and is responsible for it. This makes him the "controller" under the EU and UK GDPR and the "data fiduciary" under Bangladesh's Personal Data Protection Act, 2026. Write to privacy@prohor.day about anything on this page. You will get an answer within 30 days, usually much sooner.

The waitlist

When you request access, we store:

  • your email address;
  • which of the two forms on the page you used;
  • the time you signed up.

To stop one script from filling the list, we also keep a scrambled form of your IP address: a one-way hash, mixed with a secret, that cannot be turned back into the address. It counts signups from the same connection over the last hour. After an hour it is no longer used, and it is erased soon after. We do not store your IP address itself in the waitlist.

Mailtrap keeps a copy of your address in our contact list and sends one email to confirm you are on it. After that you hear nothing until there is a seat for you, and then you get an invite.

Why we may: you asked us to, and you agree to this policy by sending the form. Change your mind by replying to any email from us, or by writing to privacy@prohor.day, and your address is deleted from the list and from Mailtrap within 30 days.

How long: until you are invited. We do not keep addresses on the list forever, and we delete old ones that have not been invited after a reasonable time. If you have not accepted an invite 90 days after it was sent, your address is deleted.

The bot check

The waitlist form uses Cloudflare Turnstile to tell people from scripts. It usually runs unseen and shows a challenge only when it is unsure. To decide, Cloudflare looks at signals from your browser and connection, including your IP address, and uses them only for that, under its Turnstile privacy addendum. Turnstile runs only where the form is, and only to keep spam off the list.

When the form is sent, Cloudflare keeps a technical log of that one request for us to debug the form with. The log is deleted after seven days at most.

Counting visits

We count visits to prohor.day with PostHog, on its servers in the EU, in cookieless mode. Nothing is stored on your device. To count how many different people came in a day, PostHog makes a hash of your IP address and browser with a secret that changes every day and is then thrown away. The same person is a stranger again the next day, and your IP address is not kept.

What is recorded:

  • the page you opened, without anything after the ? in its address;
  • the site that sent you, but not the page on it;
  • the campaign tags in the link you followed, if it had any;
  • your browser, operating system, kind of device, language and time zone;
  • a few clicks: asking for access, opening an install guide, opening the app.

Never your email address and never anything you type. If your browser sends Global Privacy Control or Do Not Track, the counting script is not even loaded. You can also ask us to leave you out at privacy@prohor.day.

Why we may: knowing whether the site reaches anyone is a legitimate interest, and it is met here without identifying you.How long: the counts are kept only as long as they are useful. Nothing in them points back to a person.

The app

If you are invited and create an account at app.prohor.day, we keep:

  • your email address and a password, which is stored only as a hash;
  • what you put in it: your tasks, habits, projects, time entries, notes and settings, so it can sync between your devices.

Where it goes:

  • Both are kept by Supabase, in Tokyo, Japan.
  • Account emails, the invite and password resets, are sent through Mailtrap.
  • When the app breaks, Sentry, with its servers in Germany, receives a report of what went wrong. It carries your account's internal ID so a fault can be traced, and not your email address or anything you wrote.
  • Vercel serves the app's files. Like any host, it sees your IP address when you load the app.
  • On your device, the app keeps you signed in and keeps a copy of your data so it works offline.

The app has no analytics and no ads. Data is encrypted in transit, and we restrict who can reach the database. We do not read what you write, except to fix a fault you have reported, to keep the service secure, or because the law requires it.

Why we may: running the app you signed up for is the agreement in ourterms, and keeping it working and secure is part of that. None of this is used for anything else.

How long: for as long as you have an account. Ask us to close it and everything in it is deleted within 30 days. Copies in backups are removed as the backups expire. There is no delete button in the app yet, so write toprivacy@prohor.day from the address you signed up with.

Cookies and storage on your device

There is no cookie banner here because there is nothing to ask about. Everything Prohor stores on your device is needed for what you asked for.

  • prohor.day sets no cookies. If you choose light or dark, that one word is saved in your browser so the next page opens the same way.
  • Counting visits stores nothing, as above.
  • The bot check on the waitlist form may use what it needs to tell a person from a script, and nothing else, under Cloudflare's addendum.
  • The app stores your session and settings, and a copy of your data, so you stay signed in and can work offline.

None of it is used for advertising or to follow you to other sites.

Logs kept by our providers

We do not keep our own log of who visits the pages. Our providers do see your IP address when they deliver a page or handle a sign-in, as every internet service does, and may keep short-lived technical and security logs of it. We do not use those logs for anything else.

Who else handles it

These companies handle personal data for Prohor, only to do the job listed, and only on our instructions.

  • CloudflareHosts prohor.day, keeps the waitlist, runs the bot checkGlobal network (US company)
  • MailtrapKeeps the waitlist contact list, sends every emailUnited States
  • PostHogCounts visits to prohor.dayEU (US company)
  • SupabaseKeeps app accounts and everything in themTokyo, Japan (US company)
  • SentryReceives app crash reportsGermany (US company)
  • VercelServes the appGlobal network (US company)

We do not share your data with anyone else, except where the law requires it. If that happens we will tell you, unless the law forbids it.

Moving data between countries

Prohor is run from Bangladesh, and the providers above hold data in several countries. Japan and the EU are recognised by the EU as providing adequate protection for personal data. For providers based in the United States, we rely on their data processing agreements, which include the EU's standard contractual clauses, and on the EU–US Data Privacy Framework where they are certified under it. Ask us at privacy@prohor.day for a summary of the safeguards in place.

If something goes wrong

We take steps to keep your data safe. If a breach is likely to cause you serious harm, we will tell you by email without undue delay, and we will tell the authorities where the law requires it.

Your rights

Wherever you live, you can ask us to show you what we hold about you, give you a copy of it, correct it, delete it, or stop using it. Where we rely on your consent, you can withdraw it at any time, and anything we did before that stays lawful. Write to privacy@prohor.day from the address the data is about, so we know it is yours. You will get an answer within 30 days.

If you think we have got it wrong, you can complain to the data protection authority in Bangladesh or where you live. We would rather hear from you first.

Age

Prohor is not for anyone under 18. If we learn that we hold data about someone younger, we delete it.

Changes to this page

The date at the top says when this page last changed. If a change affects what we do with your data, account holders are told by email before it takes effect, and the waitlist is told if the change affects them.