Privacy Policy

1. Data controller

The controller within the meaning of the GDPR (Art. 4 No. 7) and the Swiss revDSG (Art. 5 lit. j) is:

2. What data we collect

• Account data — name, email address, and a hashed password when you register.
• Profile data — a chosen avatar or uploaded photo, a personal colour, and your role within a household.
• Household & task data — the household name and type, tasks you create, and calendar assignments.
• Session data — a session cookie to keep you logged in, stored server-side and expiring after 14 days of inactivity. No tracking.

3. Legal basis for processing

• Art. 6(1)(b) GDPR — account data and household/task data: performance of the service contract.
• Art. 6(1)(f) GDPR — session cookie: legitimate interest in secure authentication.

4. Data storage

All data is stored in a database on the server running this application. Uploaded profile photos are stored in the /uploads directory on the same server. No data is shared with third-party cloud services. No transfers to countries outside the EU/EEA or Switzerland take place.

5. Retention periods

Personal data is deleted as soon as it is no longer needed for the purpose for which it was collected. Account data is deleted upon your request or when your account is removed. Session data expires automatically after 14 days of inactivity.

6. Cookies

We use only one technically necessary session cookie (connect.sid) to maintain your login session. No analytics, advertising, or tracking cookies are used. Technically necessary cookies do not require consent (Art. 5(3) ePrivacy Directive).

7. Your rights (Art. 15–22 GDPR / revDSG)

You have the right to:

• Access (Art. 15 GDPR / Art. 25 revDSG) — request a copy of the data we hold about you.
• Rectification (Art. 16 GDPR) — correct inaccurate data; most profile fields are editable directly in the app.
• Erasure (Art. 17 GDPR / Art. 32 revDSG) — request full account deletion: hello@kutter.li.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) — we will provide your data in a machine-readable format on request.
• Object (Art. 21 GDPR) — to processing based on legitimate interests.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR):

• Switzerland: FDPIC — www.edoeb.admin.ch
• Germany: BfDI (Federal Commissioner for Data Protection) or the competent state authority.
• Austria: DSB (Austrian Data Protection Authority) — www.dsb.gv.at

8. Changes to this policy

We may update this policy from time to time. The current version is always available at /privacy. For significant changes, registered users will be notified by email.