Privacy Policy

Deciide (“Deciide”, “we”, “us”) operates the Deciide website and the decision-recording application available at deciide.xyz (together, the “Service”). We are the controller of the personal information described in this policy.

Postal address for legal notices: Available on request via the contact address below. Privacy enquiries: deciidesupport@gmail.com.

We collect the following categories of information.

• Account information. Your email address, and a password hash or third-party sign-in identifier, created when you register. We never receive or store your plaintext password.
• Content you create. Decision titles, options, criteria, weights, scores, attached links and notes, and the rationale you record. This content is yours; we process it only to operate the Service.
• Participant information. When someone votes on a shared decision link, we store their selection, any note they leave, the display name they enter if the decision requires one, and a randomly generated browser identifier used solely to prevent duplicate voting and to allow a voter to change their own vote. We do not store voter IP addresses alongside votes.
• Billing information. Subscription plan, status, renewal dates, and a non-reversible fingerprint of the payment card used, which lets us prevent repeated free trials. Card numbers, CVC codes, and billing addresses are collected and stored by Stripe, our payment processor. We never see or store full card details.
• Usage and device data. Log data such as pages requested, timestamps, approximate region, browser and operating system, and error diagnostics, generated automatically when you use the Service.
• Correspondence. Messages you send to our support address, and our replies.

• To provide, maintain, and secure the Service, including authentication, storing your decisions, and delivering shared links.
• To process subscriptions, trials, renewals, and refunds, and to detect abuse of free trials.
• To generate optional AI framing and trade-off summaries when you explicitly request them (see clause 5).
• To diagnose faults, monitor performance, and prevent fraud, spam, and unauthorised access.
• To respond to your support requests and to send service messages such as billing notices and material changes to these documents.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use your decision content to train machine-learning models.

Where the GDPR or UK GDPR applies, we rely on: contract — to provide the Service you have signed up for; legitimate interests — to secure the Service, prevent abuse, and improve reliability; legal obligation — for tax and accounting records; and consent — for any optional processing, which you may withdraw at any time.

Pro and Business plans include optional AI assistance. When you invoke it, the text of the specific decision you are working on — its title, options, criteria, and notes — is transmitted to Google’s Gemini API to produce the summary, and the response is returned to you. The feature never runs on its own; it runs only when you press the button.

Do not enter information into a decision that you are not comfortable transmitting to that provider. If you prefer that no content leave our infrastructure, simply do not use the AI features; every other part of the Service works without them.

We share personal information only with service providers who process it on our instructions, and only as needed to run the Service:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting, content delivery, and request logs.
• Stripe — payment processing and subscription billing.
• Google — the Gemini API, for AI features you invoke.

We may also disclose information where required by law, to enforce our terms, to protect the rights and safety of users or the public, or in connection with a merger, acquisition, or sale of assets — in which case we will notify you before your information becomes subject to a different privacy policy.

Anything you publish through a share link is visible to anyone holding that link. Treat share links as public.

We and our processors operate infrastructure in the United States and other countries. Where personal information is transferred out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses, or an equivalent approved transfer mechanism, as implemented in our agreements with those processors.

We keep your account and decision content for as long as your account is active. If you delete a decision, it is removed from our production database, and residual copies in encrypted backups age out within 30 days. If you delete your account, we delete or irreversibly anonymise associated personal information within 30 days, except records we must retain for tax, accounting, or dispute-resolution purposes, and the card fingerprint used for trial-abuse prevention, which we keep for up to 24 months.

Data is encrypted in transit with TLS and at rest by our infrastructure providers. Access to production data is limited to personnel who need it. Row-level security policies restrict database access so that a given account can reach only its own records, and shared decisions are reachable only through their unguessable link. No system is perfectly secure; we cannot guarantee absolute security, and you are responsible for keeping your credentials confidential.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information, to object to processing based on legitimate interests, and to withdraw consent. California residents have the rights to know, delete, correct, and opt out of sale or sharing under the CCPA/CPRA — we do not sell or share personal information as those terms are defined — and to be free from discrimination for exercising those rights.

To exercise any right, email deciidesupport@gmail.com. We respond within 30 days, and may ask you to verify control of the account email. You may authorise an agent to act for you. EEA and UK users may also lodge a complaint with their local supervisory authority.

We use strictly necessary cookies and browser local storage to keep you signed in, remember your light or dark theme preference, and hold the random identifier that prevents duplicate voting. We do not use advertising cookies or third-party behavioural trackers. Because these technologies are strictly necessary or purely local to your browser, we do not display a consent banner; you can clear them at any time through your browser settings, though doing so will sign you out.

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy as the Service evolves. We will change the “last updated” date above, and for material changes we will notify account holders by email or in-app notice before the change takes effect. Continued use after the effective date constitutes acceptance.

Your use of the Service is also governed by our Terms of Service.