This policy explains how eduardomarques.dev handles personal data. It covers the whole site and every project published on this domain (the portfolio, Castor, Sterna, and anything else I put online). There is no separate policy per app.
Controller
I am the controller: Eduardo Marques, acting as a Brazilian legal entity (microempresa).
Questions, correction, access, or deletion: connect@eduardomarques.dev. Portuguese or English. I usually reply within a week.
What data shows up here
It depends on what you are doing.
If you only browse public pages (home, projects, writing, this policy), I do not ask for a name or email. The host logs what any server logs on a visit: URL, browser, and IP address.
If you sign into a tool, the account needs:
- the email used to authenticate, which is also the contact on file;
- the password, which is not stored in plain text. Castor uses Firebase Authentication and keeps a hash. Sterna keeps its own password hash on the Sterna server;
- the tool’s content.
Castor: list items, prices, weekly caps, essentials and extras, pharmacy, beauty, archived months, and the name you chose for the greeting.
Sterna: the trips you belong to, members (by email), day-by-day schedule, packing lists, budget amounts and who paid whom, feed posts and comments, and files uploaded to a trip. Files may include tickets, bookings, photos, and identity documents (passport, visa, ID) if someone in the trip puts them there. Those files exist so the group can find them. Sterna is not a government-grade vault, not zero-knowledge, and not a substitute for storing originals somewhere you control.
Other private apps on this domain keep whatever that screen shows after login.
Your device may keep the theme (light or dark), language, a local copy of data for offline use, and the session. That does not become a public profile.
I do not run ads, social pixels, or my own audience analytics.
LGPD
A shopping list is personal data. Pharmacy items can imply something about health, and Brazilian law (LGPD, art. 5, II) treats health data as sensitive.
Trip files can include identity documents. Those are also sensitive. They are stored because a traveller uploaded them for the trip, not because Sterna is asking for a national ID as a product requirement.
These tools were not built to collect a diagnosis, a religion, or a political view. What you typed or uploaded is there so you can come back. Household lists and trip contents are not published and are not sold.
You do not need an account to use the public site. Without an account there is no sync across devices.
To withdraw consent, write to the email above. In practice that means deleting the account and what was tied to it.
Public and private
The portfolio, projects, and writing are public and may be indexed.
Anything behind a login is not. Castor and Sterna ask search engines not to index those apps. There is no public URL for a Castor list or a Sterna trip, schedule, or file. Only someone signed in can see that content.
In Sterna, every member of a trip can see that trip’s shared data and files. People who are not on the trip cannot. Adding someone is done by an existing member, using an email that already has a Sterna account.
Some tools show whether another person with access is active at the same time. That does not put your email or your list on the public site.
Processors
Besides me:
- Vercel hosts the public site and sees ordinary visit traffic.
- Google / Firebase, on projects that use it (such as Castor), stores authentication and the account documents.
- Sterna stores its own accounts, trip records, and uploaded files on the Sterna application server. That is separate from Firebase. Files are not given a public link.
Vercel and Firebase operate mainly in the United States, so processing may happen outside Brazil. Where Sterna is hosted, that host also sees what any server sees: encrypted connections, and whatever is stored for the app to work.
I do not sell data and there is no advertiser on this domain.
Hosts also keep access logs (URL, browser, IP) long enough to look into abuse. That is not a second copy of your list or your trip files.
Retention
The account and its content stay for as long as the account exists. Quiet accounts are not deleted automatically.
To delete, write to connect@eduardomarques.dev, preferably from the registered address. If you lost access to it, include whatever can still be checked.
There is no in-app delete button. I do it by hand, so it is not instant. The account and associated content go (in Castor: list, name, and history; in Sterna: memberships, trip data you created, and files). Server logs may already have rotated. Removing you from a shared trip does not by itself erase what other members still need.
Rights
Under the LGPD you can, among other things, confirm whether I hold data about you, access it, correct it, request a copy, learn who it was shared with, withdraw consent, and ask for deletion. All through the same email.
Minors
Children’s data has extra rules. Accounts for anyone under 12 should be created by a parent or guardian. The site does not ask for age and cannot verify it.
Security
Passwords are not stored in the clear. Authenticated content is not a public page. Castor and Sterna are not offered for indexing. Sterna files travel over HTTPS. A host may encrypt disks at rest. I can still open files when operating the server. Do not treat uploaded passports as if they were in a bank vault.
That lowers risk. It does not rule out an incident.
Updates
The date at the top changes when this policy changes. If I start storing something new, using it for another purpose, or sharing it with another processor, it will show up here.