Privacy Policy

Who we are

Free Some Things (freesomethings.com) is operated by Toremini Studio OÜ, based in Estonia. We sell nothing — literally. This policy explains what happens to your data while you're busy doing nothing with us.

Toremini Studio OÜ · Registry code 17288040 · Kurgla, Raasiku vald, Estonia
Contact: hello@freesomethings.com

What we collect

As little as possible. Here's the full list:

• —Email address — so we can log you in and occasionally send you nothing useful.
• —Activity data — which cards you've completed, void checks, votes, games. We track what you did, not who you are.
• —Purchase records — what you bought (nothing) and when. Stripe handles the actual payment. We never see your card number.
• —Cookies — a session cookie to keep you logged in, and a referral cookie (30 days) if you arrive through someone's affiliate link so they can be credited if you join. No analytics, no third-party trackers, no behaviour profiling.

That's it. No location data. No device fingerprinting. No “legitimate interest” in your browsing habits.

Why we collect it

• —To let you log in and keep your progress
• —To process your purchase of nothing
• —To show you collective stats (anonymised, always)
• —To send you rare emails, if you opted in

We do not sell your data. We do not share it with advertisers. We do not build profiles. The irony of surveilling people who came here to do less would not be lost on us.

Legal basis

Under GDPR Article 6, here's why each kind of processing is allowed:

• —Contract (Art. 6(1)(b)) — email, activity data, purchase records. We need these to provide the service you signed up for.
• —Legal obligation (Art. 6(1)(c)) — purchase records are kept for 7 years per Estonian accounting law (Raamatupidamise seadus § 12), even after you delete your account.
• —Legitimate interest (Art. 6(1)(f)) — referral attribution cookie, so people can credit who sent them. You can object anytime.
• —Consent (Art. 6(1)(a)) — when you opt in to non-essential emails (weekly pulse, announcements). You can withdraw anytime by clicking unsubscribe.

How long we keep it

• —Account data — while your account is active. After you delete it, 30 days, then it's gone. Activity, badges, certificates, all of it.
• —Purchase records — 7 years (Estonian accounting law, mandatory). We can't delete these earlier even if you ask.
• —Magic link tokens — 24 hours, then auto-purged.
• —Referral cookie — 30 days from arrival. Then it expires on its own.
• —Server logs — 30 days, for debugging. After that, anonymised or removed.

Third parties

We use a few services. They each see only what they need:

• —Stripe — payment processing. They have their own privacy policy, which is longer than this entire website.
• —Resend — email delivery. They see your email address and the message we send. Nothing more.

No analytics platforms. No ad networks. No social media pixels.

Your rights

You're in the EU (or we treat you as if you are). Under GDPR, you have the right to:

• —Access your data — ask us and we'll send you everything we have. It won't be much.
• —Delete your data — one email and it's gone. All of it. We don't keep shadow copies.
• —Export your data — we'll give you a file. Though exporting nothing is philosophically interesting.
• —Object to processing — you can. We'll listen.

Email hello@freesomethings.com for any of the above. We respond within 30 days, usually much sooner.

You also have the right to lodge a complaint with the Estonian Data Protection Authority (Andmekaitse Inspektsioon, www.aki.ee) if you think we're handling your data wrong. We'd rather you email us first, but the right exists.

Data storage

Your data lives on servers in the EU. It's encrypted in transit and at rest. Passwords are hashed with bcrypt. API keys are encrypted with AES-256-GCM. We take security seriously even when we don't take much else seriously.

Changes

If we change this policy, we'll update this page. We won't bury changes in footnotes or send you a 47-paragraph email. The date below tells you when this was last touched.