Make It All Click privacy notice
Effective 2026-09-11. Make It All Click operates Make It All Click. Privacy requests: privacy@makeitall.click. General questions: support@makeitall.click.
What Make It All Click handles
- Account identifiers supplied by Amazon Cognito: issuer, subject identifier, and verified email.
- Planner content you enter, including routines, reminders, startability reflections, plans, and history.
- Calendar events you explicitly import for review. Native calendar access is read-only; imported drafts remain private planner data.
- Messages and attachments you choose to send to the public support, privacy, or security email addresses.
- Content-free operational data: route templates, status codes, timings, and service health.
Google sign-in and Google user data
If you choose Sign in with Google, Google sends Amazon Cognito the Google account identifier, verified email address, and basic profile attributes authorized by the openid, email, and profile scopes. Make It All Click uses that information only to authenticate you, link the sign-in method to the correct invited account, prevent account duplication, and protect the service. The application stores the resulting Cognito issuer, subject identifier, username, and verified email; it does not request or receive Gmail messages, Google Drive files, contacts, calendars, or other Google content.
Why, where, and with whom
Data is used only to provide, synchronize, secure, recover, and support Make It All Click. It is not sold, used for advertising, shared for cross-context behavioral advertising, or used to train models. Amazon Web Services processes authentication and production workloads; Google processes Google sign-in when you select it. Production application data stays in AWS eu-west-1: Aurora DSQL stores application records, private S3 stores imports, exports, and short-lived inbound email, Cognito processes authentication, SES receives and forwards public-role email, SQS carries identifier-only job messages, and CloudWatch receives bounded operational logs.
Browser sessions
The Planner and Admin websites use host-only, secure, HttpOnly session cookies and a CSRF token to keep you signed in and protect changes. Browser code does not receive or persist Cognito access or refresh tokens. Planner content is not stored in durable browser storage.
Mobile storage and connectivity
The mobile app also requires an internet connection. Planner content is fetched from the service into memory for the current app process and is not stored in a device database, durable draft store, or offline queue. The app may keep authentication material and app-lock preferences in operating-system secure storage so you can remain signed in, and Android or iOS may retain reminders you explicitly enable in its notification scheduler.
Retention and deletion
Live planner data remains until you delete it. Raw inbound email in AWS expires after seven days; a forwarded operator copy is kept only as long as needed to handle the request and applicable security or legal obligations. A one-way identity fingerprint and deletion time remain so an old token or restored backup cannot silently recreate the deleted account; they contain no email or planner content. CloudWatch logs are retained for seven days. Daily AWS Backup recovery points normally expire after seven days; deleted live data can remain in inaccessible recovery points until that cycle completes. Restoring an older recovery point requires replaying deletion before normal service resumes.
Your controls
You can review attributed history, revoke agent connections, request an export, request deletion of selected data without deleting your account, and permanently delete your account and data in Settings. See the data deletion request page for selectable scopes. Account deletion disables access immediately and removes the Cognito identity after bounded application and S3 cleanup. Contact privacy@makeitall.click for access, correction, export, or privacy concerns.