privacy policy

This policy explains how personal data is processed when you visit kladdle.com and when you use the kladdle app at app.kladdle.com. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. controller

Marius Bleif
c/o JL Consulting Group GmbH#1652
Zürcherstrasse 84
8852 Altendorf
Schweiz
hello@kladdle.com

2. the website

When you visit kladdle.com, the hosting provider records the technical data any web server records: your IP address, the date and time, the page requested, the browser and operating system, and the referring page. These server logs are used only to deliver the site and to keep it secure, and are deleted by the provider after a short period.

Hosting: Netlify, Inc., 512 2nd Street, San Francisco, CA 94107, USA. Netlify is certified under the Swiss-U.S. Data Privacy Framework.

2.1 your cookie choice

On your first visit, kladdle asks whether it may store cookies on your device. Your answer is kept in a cookie named kladdle_consent on kladdle.com and its subdomains, so the website and the app ask only once. It is kept for one year after "accept all" and six months after "decline". You can change your answer at any time here.

change your cookie choice

2.2 analytics

kladdle uses PostHog to learn how the website and the app are used: which pages are seen, which buttons are clicked, where visitors come from (the referring page and the campaign labels in the link, such as utm_source), the browser, the operating system, the device type, and an approximate location derived from the IP address. What is recorded depends on your cookie choice:

• If you accept, PostHog stores a random identifier in a cookie and in your browser's local storage on kladdle.com and its subdomains, so that your visits to the website and the app are recognised as the same person over time. Your sessions may also be recorded as a replay of what appears on screen and where you move and click; text you type into fields is masked and not recorded.
• If you decline, or have not answered yet, nothing is stored on your device. PostHog counts your visit with an identifier it computes on its own servers from your IP address, your browser and a value that changes every day, so your visits are not linked from one day to the next. No session is recorded.

Analytics provider: PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. The data is stored in PostHog's European region, in Frankfurt, Germany.

3. the app

When you use kladdle, the following data is processed to provide the service you asked for. Nothing is used for advertising. How the app is used is measured as described in section 2.2, following the same cookie choice.

3.1 sign-in

You sign in with a Google, Microsoft or Apple account. The provider passes your name, email address and a technical account identifier to kladdle; no password is stored. The provider learns that you use kladdle and nothing about what you keep in it. The providers' own policies apply to your account with them: Google LLC, Microsoft Corporation and Apple Inc., all in the USA.

3.2 waiting list

While kladdle is in closed beta, signing in for the first time puts you on the waiting list. Your account is created with the name and email address your sign-in provider passes on (section 3.1), and the address is used to tell you when a place opens. You can ask to be removed from the list, and your account deleted, at any time.

3.3 your content

Tasks, objectives, habits, tags, durations, dates and the settings you choose. This is the data the app exists to keep. It is stored with the database provider Convex, Inc., San Francisco, USA, in a data centre in the eastern United States.

3.4 calendars

If you connect a calendar, kladdle stores the calendar's subscription address and reads the events it publishes, in order to plan around them. A published calendar address gives access to that calendar, so it is stored and treated like a secret. Calendar data is read and never written back through the calendar's own interface.

3.5 invitations

To hold time in a calendar, kladdle emails a calendar invitation from an address of the kladdle domain to the address you chose. The invitation contains the title of the task and the planned time. Email is sent through Mailgun (Sinch Mailgun, Mailgun Technologies, Inc., San Antonio, TX, USA), on Mailgun's European installation, and replies to invitations are received the same way. Email is not end-to-end encrypted; the mail provider and any administrator of the receiving mailbox can read the invitation.

3.6 technical data

The app's hosting provider records the same server logs as the website (section 2). The database provider records access logs needed to operate the service. Usage of the app is measured as described in section 2.2.

4. purposes and legal basis

Data is processed to provide the service you signed up for, to keep it secure, to answer your requests and to meet legal obligations. Under the FADP no separate legal basis is required for processing that is proportionate to those purposes. Where the GDPR applies, the legal bases are the performance of a contract (Art. 6(1)(b)), our legitimate interest in running a secure service and in counting visits without storing anything on your device (Art. 6(1)(f)) and, for analytics with cookies, session recordings and anything else, your consent (Art. 6(1)(a)), which you may withdraw at any time through section 2.1 of this policy.

5. disclosure to third parties

Personal data is passed on only to the processors named in this policy, who act on our instructions under data processing agreements: Netlify (hosting), Convex (database), Mailgun (email), PostHog (analytics), and the sign-in provider you chose. It is disclosed to no one else unless the law requires it.

6. transfer abroad

Netlify, Convex and the sign-in providers are based in the United States. Transfers there rest on the Swiss-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC). PostHog is based in the United States; the analytics data is stored in its European region, and any access from the United States rests on the same safeguards. Mailgun processes email on servers in the European Union.

7. retention

Your content is kept for as long as your account exists. When you delete your account, or ask us to, your data is deleted from the live database without delay and from backups within their regular cycle. Server and email logs are kept by the providers for a short period and then deleted. Analytics data is kept for at most one year and then deleted. Data we must keep by law is kept for the statutory period.

8. security

Data is transmitted encrypted (TLS) and stored with providers that encrypt it at rest. Access to the production systems is limited to the controller. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. your rights

You may ask, at any time and free of charge, for access to the personal data we hold about you, for its correction or deletion, for a copy of the data you provided in a common electronic format, and for processing to be restricted or stopped. Write to hello@kladdle.com; we may ask you to prove your identity first. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern, Switzerland, and, if the GDPR applies to you, with the supervisory authority of your country of residence.

10. changes

This policy may be revised when the service or the law changes. The version published here is the one that applies.