Privacy policy

Controller

The controller responsible for data processing is Jörg Dennis Krüger, c/o JDKRUEGER SAS, Avenida Calle 116 # 9-56, Bogotá, Colombia. Privacy contact: klartag.privacy@jdk.de

Hosting and server location

Klartag runs on its own server (VPS) with Hostinger International Ltd. The server location is the USA (measured via the Hostinger geofeed RFC 8805, 2026-08-13). This is a transfer to a third country within the meaning of the GDPR. It is covered by Hostinger's standard contractual clauses.

What data we collect

For your account we store your email, name, and password. The password is only stored as an Argon2id hash. We set one session cookie named klartag_session (httpOnly, technically necessary, 30-day lifetime). There are no tracking cookies.

Content data means your tasks, notes, forwarded emails, and focus settings. They are stored for as long as your account exists. Deletion is possible on request by email; they will then be removed completely.

AI processing

Task texts are sent to the AI services OpenCode Zen and OpenCode Go (opencode.ai) as processors for classification (sorting, breaking down, drafting delegation mails). Only the task texts are sent, no account data. The legal basis is Art. 6(1)(b) GDPR (performance of a contract: this is exactly what the service does).

Zoho connection

The Zoho connection is only activated when you connect it yourself (OAuth). Klartag then reads and writes calendar entries, sends mails from your own Zoho mailbox, and creates tasks in Zoho Projects. Your access tokens are stored encrypted (AES-256-GCM). The provider is Zoho Corporation; the data center depends on the user account (here: USA). You can disconnect at any time in the settings.

Audience measurement

We count page views with self-hosted software (Umami) on our own server (location USA, see Hosting). No cookies are set and no data is passed on to third parties. We record the page visited, the referring page, approximate origin at country level, browser, operating system, and screen size. The IP address is not stored; it only feeds into a daily, non-reversible checksum so that repeat visits on the same day are not counted twice. It is not possible to trace anything back to individual people. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in a data-minimal statistic about which content is read. Anyone who has enabled the browser's Do Not Track setting is not counted.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You can also lodge a complaint with a supervisory authority.

Contact

Send questions about privacy to klartag.privacy@jdk.de.