Privacy notice

Who is asking

Momentum is run by TODO_PUBLISHER_NAME, who decides what happens to the information described here. Questions, requests and complaints go to TODO_CONTACT_EMAIL, and are answered by a person.

This notice is issued in English and Bahasa Melayu, as section 7(3) of Malaysia's Personal Data Protection Act 2010 requires. A Chinese version is offered because the app is read in Chinese; where the three differ, the English and Malay are the ones that were written first.

What Momentum records

Everything below is something you typed, uploaded, or did in the app. Momentum does not buy information about you, and does not collect anything from other services.

• Your account. Your email address, and a password you never send us in a readable form — Supabase Auth holds it hashed, and Momentum cannot read it. A name, if you give one; it is optional and only used to greet you.
• Your setup. Exam board, qualification, target exam year, weekly study hours, timezone, and interface language. These set the defaults so the app does not ask again on every device.
• Your studying. The subjects and syllabus points you add, the status you give each one, when reviews fall due, study sessions and how long they ran, tasks, goals, grade targets, flashcards and how you answered them, past paper scores and dates, and difficulty ratings.
• Files you upload. Notes attached to a subject — PDF, Word, PowerPoint, plain text, Markdown, or an image, up to 20 MB each. They go in a private bucket that only your own session can read.
• Reminder records. Whether you want the daily email, and for each one sent: the date, how many items it named, and the delivery id the mail provider returned. This is what stops the same reminder being sent twice and what decides to stop sending to someone who never opens them.
• Ordinary server records. Requests to the site are logged by the host in the normal way. Page views and loading speed are measured by Vercel Analytics, which is served from this domain, sets no cookies, and reports totals rather than individuals.

Why, and on what footing

Momentum records these things to run the account you asked for: to show the right syllabus, work out what is due, and keep your work between visits. Under the PDPA this is processing for a purpose you were told about and agreed to when you signed up; for readers in the UK or EU, it is performance of the contract between us rather than consent — which matters, because someone under 16 cannot give that consent on their own.

Reminder emails are the exception. Those are sent because you left them switched on, and every one carries a link that switches them off without signing in. Turning them off does not affect the account.

Momentum does not profile you, does not make automated decisions about you, and does not advertise. Nothing here is sold, and nothing is shared with anyone for their own purposes.

Who else handles it

Three companies process data on Momentum's instructions and on nobody else's. They are not permitted to use it for themselves.

• Supabase — the database, sign-in, and the file bucket. Your account, your studying and your uploads live here, in the ap-southeast-1 region (Singapore).
• Vercel — hosting and the analytics described above. The app runs in the sin1 region (Singapore).
• Brevo — sends the reminder emails. It receives your email address and the text of the mail, which names the subjects and how many items are due. Brevo is based in France, so if you have reminders switched on, your email address is handled in the European Union. If that matters to you, turning reminders off stops it.

Beyond those three, information is disclosed only where the law requires it, and you would be told unless telling you is itself prohibited.

How long it is kept

For as long as the account exists. Momentum is a record of work done over years, and quietly deleting a syllabus you filled in eighteen months ago would defeat the point of it.

When you delete your account, the deletion is immediate and complete: the account row is removed and every table keyed to it goes with it — subjects, topics, sessions, tasks, goals, flashcards, papers, reminder records — along with the files in your bucket. There is no recovery afterwards, so export first if you want a copy. Backups taken before the deletion age out on the host's own cycle.

What you can do about it

Under the PDPA you may ask for a copy of what is held about you, ask for anything wrong to be corrected, withdraw consent to a purpose, ask that processing be limited, and complain to the Personal Data Protection Commissioner if the answer does not satisfy you. If you are in the UK or EU, you have the equivalent rights under the GDPR, including portability and erasure, and may complain to your own supervisory authority.

Two of those do not need asking. Download everything in Settings gives you the whole account as a JSON file, immediately. Delete account, in the same place, removes it. Anything else — a correction, a question about a purpose, a complaint — goes to TODO_CONTACT_EMAIL, and you will get an answer within 21 days, which is what the PDPA allows.

How it is kept

Every table carries the id of the account that owns the row, and every query filters on it; a separate layer of database row-level security scopes what a browser's own key can reach, so the two would both have to fail for one account to see another. The notes bucket is private and is read with your session rather than an administrative key. Traffic is encrypted in transit. Passwords are stored hashed by Supabase Auth and are not visible to Momentum or to TODO_PUBLISHER_NAME.

No system is beyond reach. If a breach happens that puts you at risk, you will be told what happened, what it affects, and what to do about it.

Cookies

Three things are stored in your browser, all of them necessary and none of them tracking you:

• The sign-in cookies Supabase sets, which are what keep you signed in.
• momentum-locale, which remembers the language you chose. It holds one of three words, lasts a year, and cannot be read by scripts.
• momentum-theme, which remembers light or dark. It is kept in your browser's own storage and never sent to the server.

There is no advertising, no third-party tracker, and nothing that follows you to another site — which is why Momentum does not put a cookie banner in front of you.

Age

Momentum is for students aged 13 and over. If you are younger than that, please do not create an account; if one is created anyway and we learn of it, it will be deleted.

If you are between 13 and 18, it is worth telling a parent or teacher that you use it, and they may contact TODO_CONTACT_EMAIL on your behalf about anything in this notice.

Changes to this notice

If what Momentum does with your information changes, this page changes with it and the date at the top moves. A change that materially affects you will be said in the app, not left here to be discovered.