Privacy policy

Controller

Maze Digital, Malta, operates Provedays. For any privacy question or request, contact hello@provedays.com.

The app

We do not collect, receive or process any personal data through the Provedays app. The app has no user account and no server component. Your location history, trips, evidence, attestations and settings are created and stored solely on your device, protected by iOS file protection, and are never transmitted to us. This is why the app's App Store privacy label reads "Data Not Collected".

Specifically, within the app:

• There is no analytics, telemetry or crash-reporting service.
• Location coordinates are rounded to approximately 110 metres before being stored, because attributing a day to a country requires nothing finer.
• The only outbound network activity is Apple's own App Store purchase handling and links you choose to open.
• If you create an encrypted backup file, it is encrypted on your device with a key that never leaves it, and you choose where to store it. We are not a party to that file and cannot read it.
• You can export everything as a single file, or erase everything, at any time from within the app.

Because we hold no app data, there is nothing for us to disclose, sell, transfer or lose, and data-subject requests about app content cannot be answered by us — the data is yours and only you have it.

This website

The website sets no cookies and does not track you across sites. There is no advertising network, no social pixel, no fingerprinting, and no user account.

We measure aggregate page views using Plausible Analytics, a cookieless service that does not collect or store personal data and does not create a persistent identifier for you. Plausible records a page view with the page address, the referring site, and coarse information derived from your request such as country, browser and device type, and a count of signup forms submitted (never the address entered). It does not store IP addresses, and no profile of you is built or shared. Plausible Analytics is operated by Plausible Insights OÜ and the data is processed within the European Union.

Our legal basis for this aggregate measurement is our legitimate interest in understanding which pages are useful. Because no personal data is stored, the measurement cannot be tied back to you. If you would rather not be counted at all, any content blocker will prevent it, and the site works identically.

The calculators on this website run entirely in your browser. The dates and answers you enter are processed locally, are not transmitted anywhere, and are gone when you close the page.

Fonts and all other assets are served from this domain, so browsing the site does not disclose your visit to a third-party asset host. The only data you can send from this site is an email address, if you choose to sign up for the letter described next.

The monthly letter and the launch waitlist

If you sign up on this site, we process your email address, the topics you chose (the monthly letter, launch news, or both; or, for accountants and advisers, the separate advisor letter), the page you signed up from, the version of the consent wording you were shown, and the time you signed up and confirmed. MailerLite, the service that stores the list and sends the emails, also records the IP address from which you confirmed. Together these are our record that you agreed, and to what. We do not ask for your name and we do not connect the address to anything you type into a calculator.

The purpose is to send you what you asked for and nothing else: if you subscribed to the letter, one email a month on residency day counts, expat life and news about Provedays; if you joined the waitlist, one email when the Provedays app launches and one a week later, after which the waitlist is closed; if you joined the advisor list, a launch note and then one short professional letter a month. Each topic is a separate choice with its own consent, and the welcome email you receive after confirming lets you move between the general and the advisor list. The legal basis is your consent (GDPR Article 6(1)(a) and the electronic-communications rules that require prior consent for marketing email). Nothing is sent until you confirm by clicking the link in the first email. You can withdraw consent at any time, as easily as you gave it, with the unsubscribe link in every email or by writing to hello@provedays.com; you can also keep one topic and drop the other. Withdrawing does not affect anything sent before.

Open and click tracking are switched off for these emails, so we do not know whether you read them. If you do not confirm within 30 days, the address is deleted. Once confirmed, we keep your address until you unsubscribe, after which it stays only on the suppression list that stops us from emailing you again. Your address travels from your browser to a relay we run in Frankfurt, which forwards it to MailerLite and stores nothing.

If you request a jurisdiction sheet

On the guide pages you can ask for a PDF of one jurisdiction's day-count rules, with a paper tracker to tick and a checklist of the evidence to keep. We use the address you enter to send you that document, which is the performance of what you asked for (GDPR Article 6(1)(b)). The request passes through our relay and Amazon's email service in Frankfurt; the address is not stored by us, and the copy of the email is held only by your own mailbox provider. The download link you receive carries a random identifier so that we can count how often that particular link is used; the identifier is not connected to your address, which we do not keep, so we can see that a link was used, never by whom.

To stop anyone using the form to flood a stranger's inbox from our address, we keep a keyed one-way code of each requesting address with a request count, for 24 hours, on the basis of our legitimate interest in preventing abuse (Article 6(1)(f)). It cannot be turned back into the address without a key we hold, and it is deleted automatically.

The "keep me posted" box beneath the form is a separate consent, never a condition of the download. Its wording names every topic it enables: notices when that jurisdiction's rules change, and the letter described above. Each is a separate group you can drop on the unsubscribe page while keeping the others, and the double opt-in described above applies. If you leave the box unticked, the sheet is the only email you receive and nothing about you is kept beyond the 24-hour code.

Processors

These are the companies that process data on our behalf, and what each one touches:

• MailerLite (UAB MailerLite, Lithuania; data held in the European Union) — the subscriber list, consent records and email delivery.
• Plausible Insights OÜ (Estonia; data processed in the European Union) — aggregate, cookieless page counts. No personal data is stored.
• Amazon Web Services — hosting of this public website, the signup relay, delivery of requested jurisdiction sheets, the 24-hour abuse counter described above, and receipt of email sent to our contact address. The relay runs in Frankfurt and passes your address through without storing it; email to hello@provedays.com is received in Frankfurt and forwarded to our mailbox, with the copy deleted once forwarded (and in any case within three days). The website files themselves contain no personal data.

Apple processes App Store purchases under its own terms and is not our processor. There are no others.

If you email us

We process your address and the content of your message to reply, on the basis of our legitimate interest in responding to correspondence, and keep it no longer than needed for that purpose. Mail to our contact address is received by Amazon Web Services in Frankfurt and forwarded to the mailbox we read; the forwarded copy is stored by our mailbox provider like any other email, and the transit copy is deleted once forwarded.

Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, objection and portability regarding personal data a controller holds about you. As set out above, we hold no personal data from the app and no identifiable data from browsing the website; where we hold your email address for the letter, or correspondence with you, write to hello@provedays.com and we will respond within one month. You may also lodge a complaint with the Office of the Information and Data Protection Commissioner in Malta, or your local supervisory authority.

Children

Provedays is not directed at children and we knowingly hold no data about them.

Changes

If this policy changes, the date above changes with it. Any change that affects what is processed will be described here rather than made silently.