Last updated: 24 October 2026
Sup? is a small, free blog planner, built and run by one person. It is an independent project, not affiliated with any blogging platform; in particular it isn't made by, affiliated with or endorsed by 37signals, the makers of HEY. This page explains, in plain words, what personal data Sup? uses, why, and what you can do about it.
The data controller is João Pinho, an individual based in Porto, Portugal. For anything about your data, email botjgp@gmail.com.
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Your email address and an account ID | To send you sign-in links and keep your data tied to your account | Performance of a contract: running the service you signed up for (Art. 6(1)(b)) |
| Your posts and settings: titles, dates, statuses, links, drafts, notes, checklists, your blog's address, your goals | To show your plan and keep it in sync across your devices | Performance of a contract (Art. 6(1)(b)) |
| Your subscriber list, as one-way codes and subscribe dates | To count how many people subscribed after each post | Performance of a contract (Art. 6(1)(b)). See "Your readers' data" below |
| Your calendar link and when a calendar app last read it | To keep your calendar up to date and show you it's connected | Performance of a contract (Art. 6(1)(b)) |
| Visits to your share links: the time, the link, and a one-way visitor code that changes every day | To show you how many visits and different visitors each place you shared a post brought | Your request for the feature (Art. 6(1)(b)) and, for the people who click, legitimate interest in giving authors simple, privacy-friendly counts (Art. 6(1)(f)) |
| The days you open Sup? (the date only) | To count how many people use Sup?, as totals only | Legitimate interest in knowing whether the service is used (Art. 6(1)(f)) |
| Anonymous page-view counts on the website (page, referring site, country, type of device and browser), through Vercel Web Analytics. No cookies are used and visitors can't be recognised: Vercel replaces each visitor with a code that changes every day. | To know how many people visit the site and where they come from | Legitimate interest in understanding how the site is found (Art. 6(1)(f)) |
| Technical logs kept by our hosting provider, which include IP addresses | To keep the site secure and fix problems | Legitimate interest in running a secure service (Art. 6(1)(f)) |
Sup? doesn't use your data for advertising or profiling, doesn't sell it, and doesn't share it with anyone for their own purposes.
When you import your subscriber list, each email address is turned into a one-way code (a SHA-256 hash) on your own device, before anything is saved or synced. Sup? stores only those codes and the date each person subscribed. Your subscribers' addresses are never sent to Sup?.
For this list you are in charge (the controller) and Sup? only processes it on your behalf to show you your numbers. Only import lists you're allowed to use.
A share link is a short link on Sup?'s website (supblogs.com) that sends people on to your post on your blog. When someone opens it, Sup? counts the visit. To tell different visitors apart, it makes a one-way code from the visitor's internet address, browser and the date. The address itself is never stored, the code can't be turned back into it, and it changes every day, so nobody can be recognised or followed over time. Known robots aren't counted. No cookies are used. Only the author of the link can see the counts.
If your blog is on HEY World, Sup? reads its public feed (posts anyone can already read) to include them in Ask AI. Your blog's address is also used to check that share links point to your own blog. Ask AI only copies text on your device or saves it as a file. Nothing is sent to an AI service unless you paste it there yourself, and then that service's own privacy policy applies.
A copy of your data is kept in your browser so Sup? is fast and works offline, along with your sign-in session. If you connect a folder, the files in it (drafts as text files, images, attachments) stay on your computer and are never uploaded. Sup? doesn't use advertising or analytics cookies. While Sup? is in private preview, one strictly necessary cookie remembers that you entered the access code.
These providers process data on Sup?'s behalf, under their data processing terms:
If you buy João a coffee, the payment is handled by Stripe under its own privacy policy. Sup? doesn't see your payment details.
You can access, correct, export and delete your data, restrict or object to how it's used, and take it elsewhere. Most of this you can do yourself in the app, in Account: Download a backup gives you everything, and you can delete your subscriber list, all your data, or your whole account. For anything else, email botjgp@gmail.com from the address you use for Sup?; you'll get an answer within one month. You can also complain to your data protection authority; in Portugal that's the CNPD (cnpd.pt).
If you clicked someone's share link and want to ask about it, email the same address. Sup? can't link a visit to you, which is the point, but you can still ask.
Sup? isn't meant for anyone under 16.
If this policy changes in a way that matters, the date at the top changes and, for important changes, you'll be told in the app or by email before they apply.
See also the Terms of use.