Operator and processing purposes
The service is operated by an individual using the Mo Labs brand. The official email for personal data questions is on the contact page. This document explains data processing and manual handling during the beta period.
Account and project data is processed to run the service you request, based on performing the service relationship/contract. Required transaction records may be processed for bookkeeping and legal obligations. Early access contact uses consent given when you submit the waitlist; optional data is not required to try the editor. If other processing needs consent, the purposes and choices must be explained separately, not assumed from the Google sign-in.
Account, project, and device data
- Google sign-in: Google account ID (sub), email, name, and email-verified status. Sessions use a cookie and a session-token hash stored in the database, with an expiry. The app does not ask for your Google password.
- Projects: one JSON document containing the schedule, tasks, dependencies, PIC names, notes, logos, and slide settings. PPTX files exported under an account are stored on the server for re-download.
- Guest mode and the offline file editor: drafts/autosaves live in the browser's localStorage. Account mode uses a local outbox for changes that failed to save, and browser data to resume editor flows. Closing a tab does not always remove them. Anyone with access to the browser profile can read that local data.
- Waitlist: email is required; name, role, and WhatsApp are optional, along with plan interest, form origin, UTM, referrer, landing URL/query, and user agent. Do not put secrets in URLs; queries may be stored as attribution when you submit the form.
- Landing visits and feature use: daily aggregate counts without individual identities, by visit source (utm_source or the referring site's name without its page address), device type (phone or desktop), and the step taken (for example opening the export dialog or downloading a PNG), marked as guest or signed in. Browser sessionStorage marks visits and steps already counted and keeps attribution. The session cookie is only read to tell guests from signed-in users and to leave out the operator's internal accounts; no identity is stored with the counts. This is not cross-site journey profiling. The system does not store user IPs in the app database or request logs; request limiting uses temporary network information in memory.
Operational app logs contain the pathname, request ID, status, response time, and needed error information. Request logs are filtered so they do not record queries, bodies, headers, cookies, or IPs. Do not treat this as a guarantee that no network providers outside the app process their own metadata.
Access and service providers
The app, its PostgreSQL database and export files run on a single Google Cloud (Compute Engine) VM in the Jakarta region, Indonesia. There is no copy of the data in another location and no geographic replication yet. The operator/admin can access data and operational metadata needed for support, security, and operation; you are not the only one technically able to access all server data.
Every time an admin opens user data on the admin pages (user lists and details, projects, exports, transactions, waitlist, invitations, admin access, and activity), the system records the admin's email, the time, the section opened, the user viewed if any, and the search terms used (which may contain email addresses). These records are kept for 365 days. When a user account is deleted, records pointing to that account are deleted with it, but search terms already recorded (which may contain email addresses) remain until their 365 days end. The admin pages show project titles and their page/task counts, not the project document contents. Direct operator access to the server or database for maintenance is recorded through the operator's procedure, but not yet recorded automatically by the system.
Records about admins themselves remain after that admin's account is deleted: the admin action history and admin access history (containing the admin's email and, in the access history, their Google account identifier, so old access cannot be claimed by another account), and the admin's email on data-access records for 365 days. This concerns only operators/admins, not regular users.
Google processes the sign-in under its own service and, through Google Cloud, hosts the server. The Plus Jakarta Sans font is served from this service's own server: the landing, editor and admin pages do not request fonts from Google Fonts or any other provider. Cloudflare manages the domain's DNS and forwards email sent to @timelinebuilder.id addresses; site traffic does not pass through Cloudflare. The official contact email on the contact page uses Gmail.
The offline file editor may load PptxGenJS from the jsDelivr/unpkg CDN to prepare PowerPoint exports. The CDN provider receives network request metadata; loading that library is not an upload of your local document by the export feature. Account mode builds the PPTX on the server. There is no claim that the analytics hooks present in the source mean third-party trackers are active.
Doku processes the information needed for checkout and payment confirmation, including the buyer email, transaction ID, amount, and plan. Do not send OTPs or card data through support contacts.
Providers may process data in different locations, including outside Indonesia, per their services and policies. The operator must assess the safeguards and data-transfer terms that apply; the presence of a provider is not a compliance certification or proof that a data transfer has been audited.
Storage and deletion
Account, project, and export data is kept to provide the service until the account is deleted, a verified deletion request is fulfilled, or the service ends, except certain records that must be kept by law. The operator handles requests and further deletions manually.
The project delete button removes the project from your list right away, and it can no longer be opened. 30 days later, the project document and all its exported PPTX files are permanently erased from the database automatically; until then, recorded exports can still be downloaded from your billing history. Deleted projects cannot be restored.
You can delete your account from account settings with email confirmation. Account deletion removes the account row, projects, export files stored in the database, related credits and sessions, and waitlist/invitation entries for the account email. The account link on transactions is removed; certain transaction records remain, including IDs, provider transaction references, checkout URLs, and transaction notes. Those references and records may remain associated with data at the payment provider; this is not irreversible anonymization. Account deletion does not automatically scrub personal data written into other records; state the scope in a privacy request.
Transaction records are kept as long as needed for bookkeeping, legal, or dispute-resolution obligations, separately from the need to keep project content. When that need ends, the operator deletes or anonymizes data that is no longer needed, manually; not every project document is a mandatory transaction record.
Waitlist data is kept until consent is withdrawn or the early access program ends. Request withdrawal of consent via the official contact email; the operator deletes the related entries manually.
Session access lasts 30 days. Expired sessions are deleted from the database automatically about one day later, and signing back in also clears that account's expired sessions. Signing out removes the current browser session; deleting the account removes all account sessions.
In production, operational logs rotate with size and file-count limits. Test environments may be configured differently; logs that are no longer needed are deleted manually. Daily visit and feature-use counts without individual identities may be kept for service evaluation.
Database backup copies are kept on the same server (there is no copy in another location yet) and are deleted automatically 30 days after they are made. Data already deleted from the active database may therefore remain in backups for up to 30 more days; for a deleted project the total is at most about 60 days from pressing delete. Backup access is limited to the operator. If a backup is restored, completed deletions are re-applied before users can access the database.
Drafts/autosaves in localStorage and the outbox have no automatic deletion period. Downloaded copies, files you have already shared, and browser data on other devices cannot be remotely removed by account deletion. Clear site data in the browser/device you use and delete copies you no longer need.
Rights requests and children's data
You can request information, access, correction, deletion, or an end to processing under applicable rights, including withdrawing waitlist contact consent. Contact the operator with the related email and a description of the request. The operator verifies your relationship to the data proportionally; do not send an ID card upload or additional identity data before the reason and a safe method are explained.
Deletion may be limited by legal obligations for certain records; the reasons and scope are explained in the follow-up. Requests are handled within the deadlines required by applicable law. This document sets no additional SLA beyond those obligations.
The service is intended for work planning, not collecting children's data. Children should not submit their own or others' data without appropriate supervision and authority. The app has no age gate or parental verification yet; if children's data is identified, contact the operator for special handling under legal obligations.
Security and changes
Connections to the service use HTTPS (TLS 1.2 or newer) with HSTS, and session cookies are Secure and HttpOnly. The server disk is encrypted at rest by Google Cloud as the provider's default; the database does not add per-column encryption. The app restricts project access by account, stores session hashes, validates input, and limits requests. This is not end-to-end encryption (E2EE); the operator can still process server content. No system can guarantee freedom from disruption or leaks.
If a failure to protect personal data occurs, the operator notifies affected users and the competent authority in writing within 3 x 24 hours, as required by Law 27/2022 on Personal Data Protection, stating which data was exposed, when and how it was exposed, and the handling and recovery steps. Report suspected incidents via the operator contact without sharing secrets in the report.
Material changes to processing purposes or methods are explained to users. The status, version, and dates above are not stored proof of user consent, a compliance certification, or proof of PSE registration.