SetoffLegal
Privacy Policy
Effective and last updated: 13 September 2026
1. Who we are
Setoff (setoff.at) is operated by Jason Spiliotopoulos, an individual based in the United Kingdom, trading as Setoff (the "data controller" for the purposes of UK GDPR). This policy explains what personal data Setoff collects, why, and what rights you have over it.
Contact for any privacy question or request: privacy@setoff.at.
2. What data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address; if you use Google sign-in, your Google account ID and the name/email Google shares with us | You, via Supabase Auth or Google OAuth |
| Trip content | Trip name, destination, start/end dates, activity and climate tags, laundry cycle preference | You |
| Packing items | Item names, categories, quantities, which bag/luggage an item is assigned to, packed/gathered status, and any item weight you enter | You |
| Local device storage | An offline copy of the above, kept in your browser's IndexedDB so the app works without a connection, plus a queue of not-yet-synced changes and your unit/theme preferences | Generated on your device |
| Basic technical logs | Standard request logs (IP address, timestamp, browser type) kept briefly by our hosting and database infrastructure for security and abuse prevention | Vercel, Supabase |
We deliberately do not collect: advertising identifiers, analytics/tracking events, precise location, payment details (Setoff is free), or the contents of any file outside the app.
3. Anonymous, shared item weight averages
If you enter a weight for an item in your catalog (e.g. "hiking boots — 900g"), Setoff contributes that number to a running average kept for that item name, so other users get a sensible starting estimate instead of guessing. This is the only way your data is combined with other users' data. Specifically:
- Only the item name and weight are used — never your identity, user ID, trip, or account.
- The stored record is a single running average and a sample count per item name; it cannot be traced back to any individual entry or user.
- Items you mark as personal (the "misc/personal" category) are always excluded and never contribute to or draw from this average.
- This processing relies on our legitimate interest in making packing weight estimates useful to all users, balanced against the fact that no personal data is retained in the shared record.
4. Why we use your data, and our legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Creating your account and authenticating you | Performance of a contract with you |
| Storing and syncing your trips and packing lists | Performance of a contract with you |
| Offline support via on-device storage | Performance of a contract with you |
| Shared item-weight averages (anonymised) | Legitimate interests |
| Security, fraud, and abuse prevention | Legitimate interests |
| Responding to your emails or support requests | Legitimate interests / consent |
We do not use your data for advertising, do not build behavioural profiles, and do not make any automated decision about you that has legal or similarly significant effect.
5. Who we share data with
We use a small number of infrastructure providers to run Setoff. We do not sell personal data, and we do not share it for any provider's own marketing purposes.
| Provider | Role |
|---|---|
| Supabase | Database, authentication, and hosting of the item-weight-average table |
| Optional "Sign in with Google" authentication, if you choose to use it | |
| Vercel | Hosting the web app and static assets |
These providers may process data outside the UK/EEA (for example, in the United States). Where that happens, we rely on the provider's Standard Contractual Clauses or an equivalent, recognised safeguard for international transfers.
6. How long we keep your data
- Account and trip data is kept for as long as your account is active.
- Deleting a trip in the app removes that trip and its items from our database.
- To delete your account and all associated personal data, email privacy@setoff.at — we don't yet have a self-serve "delete account" button in the app, so this is handled manually, and we'll confirm once it's done.
- The anonymised shared weight average is not personal data once contributed and is not deleted on request, since it cannot be attributed back to you.
- Locally cached data in your browser is removed if you clear your browser's site data, or automatically if you uninstall the app.
7. Security
Data in transit is encrypted (HTTPS/TLS). Your database rows are protected by row-level security policies so that, with the sole exception of the anonymised shared weight table, only you can read or write your own data. No method of transmission or storage is 100% secure, but we take reasonable technical measures appropriate to a small, free consumer app.
8. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure of your data ("right to be forgotten")
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time, where we rely on consent
- Complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO)
To exercise any of these rights, email privacy@setoff.at. We'll respond within one month.
9. Children
Setoff is not directed at children, and you must be at least 13 years old to use it.
10. Cookies and local storage
Setoff does not use advertising or analytics cookies. It uses your browser's local storage and IndexedDB solely to keep you signed in and to make the app work offline — this is strictly necessary storage, not tracking, and there is no cookie consent banner because no non-essential cookies are set.
11. Changes to this policy
If we make material changes to this policy, we'll update the date at the top of this page and, for significant changes, notify signed-in users in the app.
12. Contact
Questions about this policy or your data: privacy@setoff.at.