Privacy policy

This policy explains how Cafton collects, uses and protects your personal information when you use our application, in line with the Data Privacy Act of 2012 (Republic Act No. 10173).

Who we are

Cafton is operated by Cafton Software Development Services, based in Baguio City, Philippines. We are the personal information controller for the information described below. Contact us at contact@cafton.com.

Information we collect

• Account details: your name and email address, and a one-way hash of your password (we never store the password itself).
• Security information: when and from which browser and device type you signed in, so you can review and end sessions; and, if you turn on two-factor authentication, your authenticator secret and hashed recovery codes.
• Content you create in the application.
• Technical data: your IP address and request details, used briefly to keep the service secure (for example, to limit repeated sign-in attempts) and to diagnose problems.

How we use it

• To create and secure your account and provide the service.
• To send messages you need, such as email confirmation, password reset and security notices.
• To prevent abuse and fraud, and to maintain and improve the service.
• To comply with legal obligations.

We do not sell your personal information and we do not use it for advertising.

Cookies and similar technologies

• Essential cookies: a session cookie that keeps you signed in, and a short-lived cookie used during two-factor sign-in. They are strictly necessary and cannot be turned off while using the service.
• Preferences: your theme (light or dark) and whether the sidebar is collapsed, stored in your browser.

We do not use advertising or cross-site tracking cookies.

Who we share it with

Only with service providers that help us run the service, under agreements that limit their use of your information: hosting and infrastructure, and email delivery. We may also disclose information when the law requires it or to protect rights and safety.

How long we keep it

We keep account information while your account is active. Sessions expire after seven days or when you sign out. When you ask us to delete your account we delete or anonymise your information, except what we must keep to meet legal obligations.

How we protect it

Passwords are hashed with a memory-hard algorithm; sessions can be revoked at any time; connections are encrypted; sign-in attempts are rate limited; and you can add two-factor authentication. No system is perfectly secure, so please use a strong, unique password.

Your rights

Under the Data Privacy Act of 2012 (Republic Act No. 10173) you have the right to:

• be informed about how your personal information is processed;
• access your personal information;
• object to processing, or withdraw consent where we rely on it;
• correct inaccurate or outdated information;
• request suspension, withdrawal, blocking, removal or destruction of your information;
• receive your information in a commonly used, portable format; and
• claim compensation for damages caused by inaccurate, unlawfully obtained or unauthorised use of it.

To exercise these rights, email contact@cafton.com. You may also lodge a complaint with the National Privacy Commission.

Changes to this policy

We may update this policy. We will change the date above and, for significant changes, notify you in the application or by email.