Privacy Policy
In force from September 20, 2026.
Retainr is a retainer tracker for freelancers. It is operated by João Mateus dos Santos Scarpa (JMSCARPA), CNPJ 27.582.262/0001-68, of Al. José Caetano Ferreira Munhoz, 540 — Granjas Rurais Reunidas São Judas Tadeu, Taubaté/SP, CEP 12.086-050, Brazil, who is the controller of the data described here. This policy explains what the service stores, why, who else can see it, and how to get it back or removed. Questions go to joao.scarpa@gmail.com.
The short version
We store what you type into Retainr and little else. There is no analytics, no advertising, no tracking pixels and no third-party cookies — the service sets exactly two cookies, both of which are needed to keep you signed in. We do not sell anything to anybody.
Two kinds of data, two different roles
Your account. Your email address, your name and your picture are yours, and we decide how they are handled. This policy covers them.
What you record about your clients. Client names, the hours you log and the descriptions you write are data you control. We hold and process it on your behalf so the product can work, and we do not use it for anything else. If a description names a person, or your client is an individual rather than a company, you are the one responsible for having a reason to record it and for telling them. Your own agreement with your client governs that relationship, not this policy.
What is stored
| Data | Why |
|---|---|
| Email address | Identifies the account and receives the sign-in link. Required. |
| Name and profile picture | Optional. Shown in the app, and beside your hours on client portals. Uploaded pictures are re-encoded, which removes any camera metadata such as location. |
| Workspace name | Names the account. Shown to you, not to clients. |
| Client records | The client name, monthly hour allocation, optional overage rate and currency, billing anchor day, and an optional four-digit portal PIN. |
| Time entries | Hours, date, who logged them, and an optional description and category. |
| Sign-in tokens | Stored as one-way hashes so a copy of the database does not let anyone sign in as you. |
| Your IP address | Counted, not stored as a log: it is used to limit how often sign-in links and portal PIN attempts can be tried, so the service cannot be used to send unwanted mail or guess a PIN. |
| Push subscriptions | Only if you turn notifications on. The endpoint your browser issues, so alerts can be delivered. Turning notifications off deletes it. |
| Subscription details | If you upgrade: the plan, its status and the identifiers our payment provider issues. Card details never reach us — see below. |
Client portals
Every client has a report at a long, unguessable link. Anyone who has that link can open the report, so treat it as you would any shared document, and only send it to the people who should see it. A portal shows the hours used against the allocation, the names and roles of whoever logged time, and the descriptions attached to each entry — anything you write in a description is visible to whoever opens the link.
You can add a four-digit PIN to a portal, which is asked for before anything is shown. Archiving a client turns its link off entirely: it stops showing a report from that moment.
Cookies
Two, both strictly necessary, neither used for tracking. No consent banner is needed because there is nothing here to consent to.
| Cookie | Purpose | Lifetime |
|---|---|---|
retainr_session | Keeps you signed in. Not readable by scripts. | 30 days |
retainr_portal_… | Set in a client's browser once they enter a portal PIN, so they are not asked again. Scoped to that one portal. | 30 days |
Who else processes your data
These are the only third parties involved in running the service.
| Service | What it handles |
|---|---|
| Resend | Delivers sign-in emails. Receives your email address and the link. |
| Lemon Squeezy | Takes payment, as merchant of record. They are the seller, they hold your card and billing details, and they issue your invoice. We never see a card number. |
| Cloudflare R2 | Stores uploaded profile pictures, where configured. |
| Your browser's push service | Only if you enable notifications. Operated by your browser vendor, and it carries the alert to your device. |
| Our hosting and database provider | Runs the application and stores the database. |
Some of these operate outside your country, which means your data may be processed elsewhere. We do not sell data, and nobody receives it for advertising.
How long it is kept
- Sign-in links expire 15 minutes after they are requested and work once.
- A sign-in session lasts 30 days, or until you sign out.
- Everything else — clients, time entries, your profile — is kept until you delete it or ask us to close the account. Deleting a client also deletes its time entries.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Depending on where you live you may also have the right to object to processing or to complain to a data protection authority.
You can do all of it yourself, under Settings → Data & privacy. “Download my data” gives you a JSON file containing your profile, every client and every time entry, and “Delete account” removes the account and everything in it, immediately and for good. You can also edit your profile, edit or delete any time entry, and archive or delete a single client at any time.
If a subscription is running, cancel it before deleting the account — otherwise the payment provider would keep charging for something that no longer exists, so the app asks you to do that first. Anything you would rather we handled, write to joao.scarpa@gmail.com.
Security
Sign-in tokens and session tokens are stored as one-way hashes rather than in a form that could be reused. Sign-in and portal PIN attempts are rate limited. Connections use HTTPS. No service can promise perfect security, and this one is small and run by a small team — if you find a problem, please write to joao.scarpa@gmail.com rather than posting it publicly, and we will fix it.
Children
Retainr is a tool for running a business and is not intended for anyone under 16.
Changes
If this policy changes in a way that matters, we will email account holders before it takes effect. The date at the top always reflects the current version.
Contact
João Mateus dos Santos Scarpa (JMSCARPA), CNPJ 27.582.262/0001-68, Al. José Caetano Ferreira Munhoz, 540 — Granjas Rurais Reunidas São Judas Tadeu, Taubaté/SP, CEP 12.086-050, Brazil — joao.scarpa@gmail.com. See also the Terms of Service.