Schedule 1 Companion: Privacy Policy
Last updated: April 12, 2026
This policy explains how we collect, use, and protect your data when you use schedule1.app. We are committed to transparency and to complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).
This Privacy Policy describes how the operator of schedule1.app ("we", "our", or "us") collects, uses, and shares your personal information when you use our application. Schedule 1 Companion is a free companion tool for the Steam game "Schedule 1". We respect your privacy and are committed to protecting your personal information in accordance with applicable data protection laws, including the GDPR.
When you use schedule1.app, we may collect the following types of information:
Account Information
When you sign in via Google OAuth, we receive and store your email address, display name, and username. We do not store passwords — authentication is handled entirely by Google through Supabase Auth.
Profile Content
You may optionally provide a profile bio and upload an avatar image. Avatars are stored in Supabase Storage and are accessible via public URLs.
Mix Data
When you create, save, or share mixes, we store the data related to those mixes, including substance combinations, effects, pricing information, and any descriptions you provide.
Community Activity
If you participate in community features, we collect your ratings, comments, shared mixes, and real-time chat messages.
Contact Form Data
When you submit our contact form, we collect your name, email address, subject, message content, and your IP address (used solely for rate limiting).
Usage Data
We collect anonymous analytics data via Cloudflare Web Analytics, including page views and general performance metrics. This data is privacy-friendly — no cookies are used and no personally identifiable information is collected.
We use the information we collect for the following purposes:
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:
Contractual Necessity
Processing your account information and mix data is necessary to provide you with the service (e.g., signing in, saving mixes, participating in community features).
Consent
We rely on your consent for optional features such as community participation and profile creation. You can withdraw consent at any time by deleting your account data.
Legitimate Interests
We process certain data based on our legitimate interests, including rate limiting contact form submissions (via IP address), maintaining application security, and improving the service. These interests do not override your data protection rights.
Your data is processed and stored in the United States by our infrastructure providers (Supabase, Vercel, Cloudflare, and Resend). If you are accessing the application from outside the United States, including from the European Economic Area (EEA) or the United Kingdom, your data will be transferred to and processed in the United States.
Our third-party service providers maintain their own data protection measures and may rely on mechanisms such as Standard Contractual Clauses (SCCs) to facilitate lawful transfers of personal data from the EEA/UK to the United States.
We retain your data for as long as your account exists and as needed to provide the service. Specifically:
Account Data
Retained for the lifetime of your account. To request deletion, contact us (see Contact Us below).
Saved and Community Mixes
Retained for the lifetime of your account. Community mixes you have shared remain visible until you or we remove them.
Chat Messages
Retained for the lifetime of your account or as needed for the chat feature to function.
Contact Form Submissions
Retained as long as necessary to respond to your inquiry and for our records. IP addresses collected for rate limiting are not stored long-term.
Analytics Data
Cloudflare Web Analytics data is aggregated and anonymous — no personal data is retained by the analytics service.
We implement appropriate technical and organizational measures to protect your personal information. All data is transmitted over HTTPS (TLS encryption). We do not store passwords — authentication is delegated to Google via Supabase Auth. Database access is governed by row-level security (RLS) policies.
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.
Depending on your location, you may have the following rights regarding your personal data. Users in the EEA and UK have these rights under the GDPR:
Access
Request a copy of the personal data we hold about you.
Rectification
Request correction of inaccurate or incomplete personal data.
Erasure
Request deletion of your account and associated data. There is currently no self-service account deletion — please contact us to request this.
Data Portability
Request your data in a structured, commonly used, machine-readable format.
Restrict Processing
Request that we limit the processing of your personal data in certain circumstances.
Object
Object to processing of your personal data where we rely on legitimate interests.
Withdraw Consent
Where processing is based on consent (e.g., analytics cookies), you may withdraw consent at any time by clearing your cookies.
Lodge a Complaint
You have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been violated.
To exercise any of these rights, please contact us or email [email protected]. We will respond to your request within 30 days.
Schedule 1 Companion is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us so we can take steps to remove that information.
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top.
You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
If you have any questions about this Privacy Policy, your personal data, or wish to exercise any of your rights, you can reach us by:
Contact Form
Visit our contact page