Privacy Policy

Limited Liability Company “ASINTEX” (ASINTEX LLC); in Russian — Общество с ограниченной ответственностью «АСИНТЕКС» (ООО «АСИНТЕКС»).

• OGRN (primary state registration number): 1252300041608
• INN (taxpayer identification number): 2312337130
• KPP (tax registration reason code): 231201001
• Registered and postal address: 350059, Russian Federation, Krasnodar Krai, Krasnodar, Yaltinskaya Street, building 14, premises 204 (in Russian: 350059, Краснодарский край, г. Краснодар, ул. Ялтинская, д. 14, помещ. 204)
• Phone: +7 (916) 555-55-12
• E-mail for requests concerning personal data processing: privacy@jarbi.ru
• The operator is included in the Roskomnadzor register of personal data operators, registration number 23-25-158928.

The person responsible for organising the processing of personal data at ASINTEX LLC (Article 22.1 of Law 152-FZ) is the General Director, Yakhshibekyan Alexander Alexandrovich (Яхшибекян Александр Александрович), appointed by Order No. 2 of 27 August 2025.

Within the Jarbi («Джарби») service (the “Service”), the following may be processed:

• Account data: e-mail, hashed password, name/nickname (if provided by the user), account identifier.
• Profile data provided by the user voluntarily: last name, first name, patronymic, date of birth, phone number. These fields are not required to register and use the Service; they can be changed or cleared in the “Account” section at any time.
• User content: tasks, objects (including objects of the user’s own types and their fields), tags, notes, habits, “Graph” links, files and images in texts, priority pyramid levels and Super Goals, as well as previously created energy log entries — everything that the user enters and uploads to the Service.
• Consent data: the fact, date and document version for each consent (age and Terms of Use — together with the language of the accepted version, push notifications, mailings, public profile, analytics cookies, recurring charges), the confirmation given at payment that the user is 18 or older or has the consent of a legal representative, the fact and date of withdrawal of consent, as well as previously given consents.
• Payment data — only when a paid subscription is taken out: e-mail, payment amount and status, payment and card binding identifiers, masked card number, cash receipt data. The full card number and the CVV code are not transferred to the Operator and are not stored by it.
• Invitation data — if the user invites others via their own link or registers via an invitation link: the invitation code, who invited whom, the status of the invitation and the decision on it, information on the gift access granted for the invitation. An invitation counts once the invitee has confirmed their e-mail address and has used the Service for the established period (days of use are taken into account). To prevent abuse (for example, inviting oneself), the Service compares the network and the browser of the inviting user and of the invitee. For this purpose, it stores not the IP address and not the browser identifier but their digital fingerprints — values irreversibly derived with the Operator’s secret key (hashes): for the network — from the address without its last part (IPv4 — the first three numbers of the address, IPv6 — the first 48 bits), for the browser — from a random identifier that the Service creates in the browser. The IP address or the browser identifier cannot be recovered from these values; they are used only for comparison. In the invitation record, the browser hash is kept for no longer than 12 months and the network hash until a decision on the invitation is made; for the inviting user, the hashes of their latest browsers and network are kept until the account is deleted. In the Android application, after installation from Google Play, the Service receives once from Google Play (the Install Referrer service) the link via which the application was installed and uses only the invitation code from it.
• Data on access provided by an organisation — if access to the Service has been provided to the user by an organisation (for example, an educational institution or an employer): the organisation, the way access was obtained (an e-mail address on the organisation’s domain, an access code or a decision of the Service administrator) and the access period. For the organisation, its name, INN (if specified) and the contact e-mail address of its representative for service e-mails are stored. Information about the organisation’s users is not transferred to it — the e-mail about the access period states only the number of participants.
• Moderation data: reports submitted by the user about other users (with the reason stated) and the list of users the user has blocked — see section 6 of the Terms of Use.
• Technical data: IP address, browser type and version, operating system, platform and application version, timestamps of requests and of last activity, referrer, session identifier — collected automatically for security, diagnostics and support purposes; as well as the device time zone — it is automatically saved in the profile when the application starts so that reminders arrive according to local time (additional time zones previously specified by the user are kept in the profile).
• Information about the use of the Service (usage statistics) — for registered users: which sections of the Service the user opens and which key actions they take (for example, creating and completing a task, processing the Inbox, logging a habit, starting a focus session, opening search), as daily counters: the event name, the date, the kind of application (the website on a computer or on a phone, the Android or iOS application) and the number of times; the days on which the user used the Service; summary counters of the user’s own content (for example, how many tasks, tags and habits the user has) and the dates of the first key actions; on which device and by which method the user signed up; progress through the in-app tutorial. This information is linked to the user’s account. The texts of tasks, notes and other records, search queries and screen content are not included in it. The information is collected by the Service itself on the Operator’s servers, without third-party analytics services.
• Sign-up source — if the user signs up on the website and has previously consented to analytics cookies (section 7): the tags of the link through which the user first came to the Service no earlier than 30 days before signing up (utm_source, utm_medium, utm_campaign, utm_content, utm_term), only the domain of the website from which the user came (without the page address), the address of the first page of the Service opened, without parameters, and the time of the first visit. Before sign-up, this information is stored only in the user’s browser (for no longer than 30 days); without consent to analytics cookies, it is not stored and is not sent on sign-up. When the user signs up in a mobile application, only a mark that the sign-up took place in the iOS or Android application is stored.
• Mobile application data: device identifier for delivering push notifications (push token) — only if the user has enabled notifications in the mobile application (Android/iOS).
• League public profile data — only if the user has enabled the public profile (the profile is private by default): nickname, season Pulse and consistency (aggregated weekly activity indicators, without the content of tasks), season achievements (including historical level achievements of past seasons), mentor status and “mentor — mentees” links (nicknames), position in the leaderboard. This data becomes available to an unlimited number of persons via a direct link to the profile page. Enabling the public profile is a voluntary action of the user expressing consent to the dissemination of this data; it can be cancelled at any time in the League settings — the profile becomes private, and the public page stops opening.
• Cookies and similar technologies: see section 7.

The Service is not intended for collecting special categories of personal data (race, political/religious beliefs, health, etc.) or biometric personal data. If the user independently enters such information in their content, it is processed on the basis of the user’s consent and at the user’s own responsibility.

• Providing the functionality of the Service, including reminders according to the device time zone, — performance of a contract (clause 5, part 1, Article 6 of Law 152-FZ; Article 6(1)(b) GDPR).
• Authentication, account protection, logging of technical errors — legitimate interest of the operator (clause 7, part 1, Article 6 of Law 152-FZ; Article 6(1)(f) GDPR).
• Communicating with the user on technical and legally significant matters (password reset, notices of material changes, responses to enquiries).
• Maintaining the League public profile and leaderboard — on the basis of the user’s consent expressed by voluntarily enabling the public profile (with the right to withdraw it at any time in the League settings).
• Sending informational and advertising mailings (service news, tips and advertising e-mails about the Service) — on the basis of your consent (clause 1, part 1, Article 6 of Law 152-FZ; Article 18 of the Federal Law “On Advertising”); the text of the consent is the “Consent to receive mailings”. Consent is voluntary and may be withdrawn at any time in the settings, via the “Unsubscribe” link in every e-mail or by writing to privacy@jarbi.ru. Opting out of mailings does not affect service (transactional) e-mails necessary for the operation of the Service.
• Gift access for invitations and prevention of abuse (accounting for invitations; checking that the user does not invite themselves and does not create a series of similar accounts) — performance of a contract (clause 5, part 1, Article 6 of Law 152-FZ; Article 6(1)(b) GDPR) and legitimate interest of the operator (clause 7, part 1, Article 6 of Law 152-FZ; Article 6(1)(f) GDPR); separate consent is not required.
• Providing access granted by an organisation — performance of a contract with the user (clause 5, part 1, Article 6 of Law 152-FZ; Article 6(1)(b) GDPR); contact details of the organisation’s representative — legitimate interest of the operator (clause 7, part 1, Article 6 of Law 152-FZ; Article 6(1)(f) GDPR).
• Improving the Service on the basis of its usage statistics(information about the use of the Service, section 2): to understand which sections and functions are used, where users run into difficulties and what should be improved; the days on which the Service was used are also taken into account when checking the conditions of gift access by invitation. This information is linked to the account and is therefore personal data. Basis — legitimate interest of the operator (clause 7, part 1, Article 6 of Law 152-FZ; Article 6(1)(f) GDPR); taking into account the days of use to check the conditions of gift access — performance of a contract (clause 5, part 1, Article 6 of Law 152-FZ; Article 6(1)(b) GDPR). The Service has no separate setting that turns off the collection of this information. You have the right to object to such processing by writing to privacy@jarbi.ru: we will stop keeping statistics for your account and delete the counters already collected, except the days of use for as long as they are needed for gift access.
• Assessing acquisition channels (where new users come from; sign-up source, section 2): when signing up on the website — on the basis of consent to analytics cookies (clause 1, part 1, Article 6 of Law 152-FZ; Article 6(1)(a) GDPR); when signing up in a mobile application (only the iOS or Android mark) — legitimate interest of the operator (clause 7, part 1, Article 6 of Law 152-FZ; Article 6(1)(f) GDPR). Consent can be withdrawn in “Cookie settings” on the app.jarbi.ru website: after that, information about visits in that browser is erased and no longer collected, and the sign-up source stored on sign-up is deleted from the server automatically — immediately if the user is signed in at that moment, otherwise the next time they sign in to the account in that browser. The sign-up source can also be deleted on request to privacy@jarbi.ru.
• Compliance with legal requirements — tax law, anti-fraud law, requests from competent authorities.

The operator engages the following persons to provide technical services necessary for the operation of the Service. For each of them, it is stated below what data is transferred and on what basis. Personal data is stored and mainly processed within the territory of the Russian Federation; the only exception is the delivery of push notifications of the mobile applications (see below and section 5).

• REG.RU Domain Name Registrar LLC (ООО «Регистратор доменных имен РЕГ.РУ»; OGRN 1067746613494, INN 7733568767, KPP 774301001) — provision of a cloud server for hosting the Service. The servers are located in the certified “Relcom Data” data centre (ЦОД «Релком Дата») at: Moscow, Volgogradsky Prospekt, 42, building 5, within the territory of the Russian Federation. More about the “Cloud FZ-152” infrastructure (in Russian). Transferred: all categories of data listed in section 2 (as the place of their primary recording and storage). Basis: the hosting services contract (the REG.RU public offer); a personal data processing assignment agreement under part 3 of Article 6 of Law 152-FZ is being concluded.
• Yandex.Cloud LLC (ООО «Яндекс.Облако»; OGRN 1187746678580, INN 7704458262, KPP 770401001) — storage of encrypted backups (Object Storage). The platform is hosted in Yandex data centres in the territory of the Russian Federation: Vladimir (Energetik microdistrict, Poiskovaya Street, 1, building 2); Sasovo, Ryazan Oblast (Pushkina Street, 21); Kaluga (1st Avtomobilny Proezd, 8); Mytishchi, Moscow Oblast (Silikatnaya Street, 19). Yandex Cloud compliance certificates. Basis: a personal data processing assignment under part 3 of Article 6 of Law 152-FZ included in the Yandex Cloud terms of use (the Data Processing Agreement).
• Google LLC / Google Ireland Limited — the Firebase Cloud Messaging service (FCM) for delivering push notifications in the mobile applications; for Apple devices, notifications are further delivered via the Apple Push Notification service (Apple Inc.). Transferred: the device push token and the content of the notification (the title and text of the reminder). The infrastructure of these companies is located, among other places, outside the Russian Federation (USA) — for details on cross-border transfer, see section 5. The transfer takes place only if the user has enabled push notifications in the mobile application. Basis: the public data processing agreements of Google and Apple.
• YANDEX 360 for Business LLC (ООО «ЯНДЕКС 360 для бизнеса»; INN 9704259180, KPP 770401001) — the “Yandex 360 for Business” corporate e-mail service. The Service uses it to send service (transactional) e-mails: e-mail address confirmation, password reset, change of address, account deletion and other account-related notifications; it also stores the e-mails you send to the Operator’s addresses in the jarbi.ru domain (for example, privacy@jarbi.ru). Transferred: the e-mail address of the recipient or sender and the content of the e-mail. The data is processed using databases located within the territory of the Russian Federation. Basis: a personal data processing assignment under part 3 of Article 6 of Law 152-FZ in the “Yandex 360 for Business” offer (clause 11.2) and its Data Processing Agreement.
• Unisender Smart LLC (ООО «Юнисендер Смарт»; Unisender, INN 9731091240, a Russian legal entity) — an e-mail mailing service. It is engaged only to deliver informational and advertising e-mails to those users who have consented to them (see section 3); service (transactional) e-mails are not sent through it. Transferred: e-mail address. When sending e-mails, Unisender collects information about delivery and opening of e-mails and clicks on links on the Operator’s instructions. The infrastructure is located within the territory of the Russian Federation; data is not transferred outside the Russian Federation. Basis: a personal data processing assignment under part 3 of Article 6 of Law 152-FZ in the Unisender Terms of Use (clause 14.4).
• YANDEX LLC (ООО «ЯНДЕКС»; OGRN 1027700229193, INN 7736207543) — the Yandex Metrica web analytics service. It is connected only after your consent in the cookie banner and only in the web version of the Service (the jarbi.ru and app.jarbi.ru websites); in the mobile applications for Android and iOS, web analytics is not used at all. Transferred: IP address, Yandex Metrica cookie identifiers, pages viewed, referral source, information about behaviour on the page. Session recording (“Webvisor”) is disabled; the content of form fields is masked. Infrastructure — within the territory of the Russian Federation. Basis: a personal data processing assignment under part 3 of Article 6 of Law 152-FZ in the Yandex Metrica and AppMetrica Terms of Use (clause 5.4). For details, see the Cookie Policy.
• GitHub, Inc. (USA) — storage of the source code of the Service and automated build (CI/CD). Personal data of the Service’s users is not transferred to this service.

Independent operator — TBank JSC (АО «ТБанк»; OGRN 1027739642281, INN 7710140679): acceptance of payments and fiscalisation when a paid subscription is taken out. Transferred: e-mail address, amount and purpose of the payment, payer identifier and card binding identifier for recurring charges, information necessary to generate a cash receipt under Law 54-FZ. The full card number and the CVV code are entered on the bank’s side, are not transferred to the Operator and are not stored by it. The transfer takes place only when payment is made. The bank processes this data not on the Operator’s instructions but as an independent operator — by virtue of Federal Law No. 161-FZ of 27 June 2011 “On the National Payment System” and Federal Law No. 115-FZ of 7 August 2001 “On Combating the Legalisation (Laundering) of Criminally Obtained Income and the Financing of Terrorism”. The basis for the transfer is the performance of a contract with the user (clause 5, part 1, Article 6 of Law 152-FZ).

Error telemetry of the Service is processed on the operator’s own infrastructure within the territory of the Russian Federation. No third parties are engaged for telemetry.

The current register of processors is maintained internally and is provided to the personal data subject upon written request sent to privacy@jarbi.ru.

Pursuant to part 5 of Article 18 of Law 152-FZ, the recording, systematisation, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation (the REG.RU and Yandex.Cloud servers listed in section 4).

Cross-border transfer of personal data is limited to a single case — the delivery of push notifications of the mobile applications: the device push token and the content of the notification are processed by Google LLC (Firebase Cloud Messaging) and Apple Inc. (Apple Push Notification service), whose infrastructure is located, among other places, in the USA. The primary recording, systematisation, accumulation and storage of personal data are nevertheless carried out in databases in the territory of the Russian Federation. The user may disable push notifications in the settings of the application or the device — in that case no cross-border transfer takes place.

External calendar subscription to tasks (ICS feed). In the calendar settings, the Service issues a personal secret link to a calendar file (ICS format) containing task titles, due dates and reminders. If you, on your own initiative, add this link to a third-party calendar (Google Calendar, Apple Calendar or another), your calendar service will independently and regularly download this file — and the task titles together with the due dates will end up on the infrastructure of the calendar provider you have chosen, including outside the Russian Federation (for Google LLC and Apple Inc. — in the USA). The Operator does not itself transfer this data to third parties: the transfer is initiated by your action and takes place between your calendar service and the Service. To stop such transfer, delete the subscription in your calendar and/or refresh the secret link in the “Settings → Calendar” section — the previous link will stop working immediately.

No other transfers of personal data outside the Russian Federation are carried out; all other persons to whom personal data is transferred are Russian legal entities with infrastructure in the Russian Federation.

• User content — until deleted by the user or until the account is closed.
• Deletion of the account at the user’s request — the account data and user content are deleted immediately (hard-delete), including deletion of the user directory with files. Recovery is not possible. Backups containing data as of the time before the deletion are kept in the general backup rotation and are not used to restore a deleted account.
• Technical logs of requests and of application operation — kept for the time necessary for diagnostics and investigation of incidents.
• Data backups — created regularly, kept for operationally necessary periods and duplicated in off-site storage with a Russian cloud provider (Yandex.Cloud, a bucket in the territory of the Russian Federation). Backups are stored in encrypted form and are accessible only to the operator.
• Invitation data — until the account of the inviting user or of the invitee is deleted; the retention periods of the hashes are given in section 2.
• Information about the use of the Service — daily counters are kept for 365 days; summary content counters, dates of first actions, sign-up information and the sign-up source — until the account is deleted; when the account is deleted, they are deleted immediately. Summary indicators for all users from which user identifiers have been removed are kept without a time limit.
• Data on access provided by an organisation — information on the user’s participation — until their account is deleted; information about the organisation — until the record of it is deleted by the Service administrator.
• Log of actions of the Service administrators (which of the operator’s employees performed which action, including the employee’s e-mail address and IP address) — kept for security and incident investigation purposes and retained after deletion of the user’s account for the period necessary for those purposes.
• Data whose processing is mandatory by law (accounting and tax data, including cash receipts under Law 54-FZ) — for the periods established by applicable legislation.

The Service uses strictly necessary cookies (authentication session identifier, selected interface theme, consent given in the cookie banner). These cookies do not require separate consent under Article 6(1)(f) GDPR and the ePrivacy Directive, since the Service cannot work without them.

Analytics cookies (the Yandex Metrica web analytics service) are connected only after the user’s explicit consent expressed via the cookie banner on the first visit. Before consent is obtained, the Yandex Metrica code is not loaded. The content of form fields is masked and not recorded; session recording (“Webvisor”) is disabled. Your choice in the banner is stored in the browser, and for signed-in users the fact, date and version of the choice are additionally recorded on the Operator’s side — this is necessary to confirm the presence or absence of consent. Consent can be withdrawn at any time via the “Cookie settings” link or by deleting cookies in the browser; on withdrawal the page is reloaded, the Yandex Metrica code stops working, and the previously set _ym_* cookies are deleted. Web analytics is not used in the mobile applications for Android and iOS. The Service’s own usage statistics (sections 2 and 3) do not depend on the choice in the cookie banner: no cookies or third-party services are used for them. The sign-up source is stored only with consent to analytics cookies given under the cookie banner version of 2026-11-05 or later, which mentions recording where the user came from; consent given earlier covers Yandex Metrica only.

Advertising and marketing cookies are not used. For details on cookie categories, retention periods and management, see the Cookie Policy.

In accordance with Articles 14–17 and 21 of Law 152-FZ, Chapter III of the GDPR and the CCPA, the user has the right to:

• obtain confirmation of the fact of processing of their data and the information listed in part 7 of Article 14 of Law 152-FZ;
• obtain a copy of their personal data in a structured machine-readable format (JSON) — the “Download my data” button in the “Account” section; if the function is unavailable — upon written request to the address specified below;
• demand clarification, blocking or destruction of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• withdraw consent to processing — where processing is based on consent;
• object to processing based on the operator’s legitimate interest (GDPR);
• appeal against actions or inaction of the operator to the competent authority for the protection of the rights of personal data subjects (for the Russian Federation — Roskomnadzor; for the EU/EEA — the relevant national DPA; for California — the California Privacy Protection Agency) or in court;
• for residents of California (CCPA): the right to opt out of the “sale/sharing” of personal data — the operator does not sell personal data.

Requests are sent in writing to privacy@jarbi.ru or to the operator’s postal address specified in section 1. Information is provided within 10 working days from the date of the request; this period may be extended by no more than 5 working days by sending the subject a reasoned notice (Article 20 of Law 152-FZ). For GDPR requests, the response period is one month.

In accordance with Articles 18.1 and 19 of Law 152-FZ, the operator has taken the following measures:

• a person responsible for organising the processing of personal data has been appointed;
• local regulations on personal data processing have been approved;
• data is encrypted in transit, and backups are encrypted at rest;
• users’ passwords are stored as cryptographic hashes using strong algorithms;
• access to the server infrastructure is restricted and controlled; technical logs of requests and of application operation are kept and used for diagnostics and incident investigation;
• an account-level security event log is kept (sign-in, failed sign-in attempt, change of password and e-mail address, account deletion request). The user can view their own log in the “Account” section; information about the address and device is depersonalised after the retention period expires;
• a firewall and automatic protection against automated attacks (password brute-forcing) are used.

If an unlawful or accidental transfer of personal data that has resulted in a violation of the rights of data subjects is established, the operator will notify the competent authority within the time limits and in the manner established by part 3.1 of Article 21 of Law 152-FZ (24 hours — initial notification, 72 hours — information on the results of the internal investigation). For users located in the EU/EEA, the operator will, in addition, notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of the incident, if the incident is likely to result in a risk to the rights and freedoms of data subjects (Article 33 GDPR). Affected users will be notified without undue delay by available means of communication.

The operator’s obligations to protect personal data, to notify the competent authority of incidents and to inform the state system for detecting, preventing and eliminating the consequences of computer attacks are established by law and are not limited by the Terms of Use or other agreements with the user. If a user’s data is lost or damaged without access by unauthorised persons (for example, in the event of an equipment failure), the operator restores it from a backup and informs the affected users of the period for which the data could not be restored.

The Service is not intended for persons under 16 years of age. The operator does not knowingly collect data of such persons. If such data is discovered, it is subject to deletion at the request of a legal representative.

The operator will notify users of material changes within the Service and/or by e-mail no later than 14 calendar days before the changes take effect. The current version is always available athttps://app.jarbi.ru/legal/privacywith the effective date indicated at the beginning of the document. If a change means a new purpose of processing or an extension of the data processed on the basis of consent, the operator requests new consent; until it is obtained, such processing is not carried out.