Privacy Policy

Updated on October 26, 2026

1. Who the controller is

Reprograme is the controller of the data processed on this site under Regulation (EU) 2016/679 (GDPR) and Brazilian Law 13.709/2018 (LGPD). Data protection officer: mail@reprograme.com.

2. What we collect and why

• Item, reason and triggers — to build the reflection and justify the suggested waiting period. The reason you write comes back to you in the reminder email and on the end-of-wait page.
• Price and payment method — to calculate the cost in hours.
• Monthly take-home income and weekly working hours — essential to estimate a price in hours of work. Both are encrypted in completed reflections. Include the hours of the jobs that make up the income you enter. The cost in hours, hourly value and share of income are not stored: they are recalculated from these data when the purchase is displayed.
• Email (optional) — only when you request a reminder after deciding to wait: to send the reminder at the end of the pause, a price-drop alert if you also request monitoring, and a confirmation link when you request deletion of your data. Before the first reminder, we send a link to confirm that the address belongs to you; without confirmation, no reminder, alert or message copy containing your text is sent. Evaluating and recording your decision do not require email. Stored encrypted.
• Product link (optional) — only when you request price monitoring with the reminder: to check the price published on the page during the pause.
• Session identifier and IP address — to resume the wizard and for basic security. Income, working hours and email are kept in plain text in the server session: alongside the draft, we remember those from your last reflection in which you requested a reminder to fill in the next one in this browser. The first recorded answer through the reminder link also saves them; opening the link or answering again saves nothing. If you forward that email, whoever records the first answer may receive these details in their browser.
• Contact messages — subject, email, name (optional) and the text you write on the contact page, so that we can answer. Email, name and text are stored encrypted.
• Your answer when the wait ends (optional) — if you use the link in the reminder email to tell us whether you still want the item, we store the answer with the reflection. It is used to measure whether waiting makes a difference, and it is deleted along with the reflection. If you tick the tally option when requesting a reminder, we add up the answered waits with the same email for which you also ticked it — using a code derived from the address, without decrypting it — and show the total on the end-of-wait page. Requesting again without ticking it takes that reflection out of the sum.

We count how often each page is viewed, by day, language and referring website, without cookies, without storing your IP address and without identifying anyone.

3. Legal basis

Processing relies on your consent (LGPD art. 7, I; GDPR art. 6(1)(a)). By recording your decision, you consent to saving the reflection: a notice appears next to the button before recording, and the time of recording is kept in the reflection. Email, reminders, price alerts and the tally require their own consent, requested only when you ask for a reminder. When email comes from the last reflection, the box is already checked for that same address; you can uncheck it. If you change the address, we ask you to check the box for the new email. The tally starts unchecked for every request. You can withdraw consent at any time by deleting your data — withdrawal does not affect the lawfulness of prior processing. Processing a deletion request relies on compliance with a legal obligation and the exercise of a data subject right (LGPD art. 18, VI and art. 7, II; GDPR art. 6(1)(c)).

4. How long we keep it

• Reflection in progress and remembered details (session): 7 days of inactivity, then discarded automatically. “Forget”, beside the prefilled fields, removes the remembered income, working hours and email and those in the current reflection, without deleting completed reflections. Deleting your data also removes the remembered details.
• Recorded reflection: until you request deletion. If there is no pending reminder or active price monitoring, we delete it after 24 months of inactivity. You can delete a reflection recorded without email only while this browser session exists (up to 7 days without use), using the option to delete this session’s reflection; afterwards we cannot associate it with you, and the same 24-month retention period applies.
• Reminders: deleted together with the reflection they belong to. If the address is still unconfirmed 30 days after the date the reminder would go out, it is cancelled.
• Deletion request in progress: the address you enter is kept only until the confirmation link is sent. If delivery fails we erase it after 7 days — and after 30 days in any case.
• Contact message: 12 months. The email address and the text are deleted together, automatically. Asking for your data to be deleted also removes the contact messages from the same address, before that deadline.
• Email confirmation request: the address you enter is kept only until the link is sent; after that only a record without the email stays (it prevents a second request on the same day) for up to 30 days, or goes away sooner, when you confirm. If delivery fails we erase it after 7 days. The address confirmation is deleted together with the reflection.

5. Who we share with

Nobody, for commercial purposes. The data lives with the hosting provider that runs our servers and database, acting as a processor, and with the email service used for the product emails: the reminder, the price alert and the deletion confirmation. In the application — the reflection, the reminders, the contact page and this page — there is no third-party analytics, no tracking pixel, no advertising.

The pages of the essay "What is money?", the blog and, under Tools, the savings calculator and the support channels show Google AdSense ads, which help cover the costs of the site. There, and only there, the browser loads Google's script, which receives technical data about the visit — such as the IP address, the browser and the page read — and processes it as an independent controller. Nothing you enter in the reflection reaches Google. In every country, we ask Google for non-personalised ads only. In the European Economic Area, the United Kingdom and Switzerland, Google's consent window also appears; if you decline, the ads become limited. How Google uses that data: policies.google.com/technologies/partner-sites. To adjust the ads you see: myadcenter.google.com.

6. Cookies

• reprograme_session — identifies the session that keeps your reflection in progress and remembers income, working hours and email for the next one in this browser. Strictly necessary. Expires in 7 days.
• locale — remembers the language you chose. Expires in 1 year.
• cookie_ok — records that you have seen the notice, so we do not repeat it. Expires in 1 year.
• reprograme_csrf — protects forms against cross-site request forgery (CSRF). Strictly necessary for security. Expires when you close the browser.
• Google cookies, only on the essay, blog, savings calculator and support channels pages (__gads, __gpi and __eoi) — set by the ads script to display and measure ads, cap repetition and fight fraud; and FCCDCF and FCNEC, from Google's consent window. Names and durations are set by Google.

The first four are strictly necessary or preference cookies and apply across the whole site. Google's exist only on the essay, blog, savings calculator and support channels pages: the application screens load no third-party scripts.

7. Security

Income and email are encrypted with AES-256 before reaching the database; the key is stored outside the database. Traffic is served over HTTPS with HSTS. The application enforces a restrictive CSP and CSRF protection, and its screens load no third-party scripts; the essay, blog, savings calculator and support channels pages load only Google AdSense's, under a policy of their own.

8. Your rights

You may request confirmation of processing, access, rectification, anonymisation, portability and erasure of your data, and withdraw consent (GDPR arts. 15–22; LGPD art. 18). The fastest route is the deletion page below; for anything else write to mail@reprograme.com — we reply within 15 days.

If you live in the European Union you may complain to your national data protection authority. If you live in Brazil, to the ANPD.

Delete my data

9. International transfers

Our servers may sit outside your country. When that happens, the transfer relies on the provider standard contractual clauses and on the safeguards required by Chapter V of the GDPR and art. 33 of the LGPD.

10. Changes to this policy

If anything changes materially, we announce it on this page with an updated date before the change takes effect.