Privacy policy

Data controller

The controller is Paweł Drojecki, ul. Grudziądzka 57b/28, 87-100 Toruń, Poland, tax identification number (NIP) 9562382715. For data protection enquiries, contact [email protected]. This policy covers the website, web application and mobile application.

Data, sources and visibility

We receive your email address, display name, account details and support messages from you. Your sign-in provider supplies an identifier and information needed to manage your session. We also process connection information and security events.

Space data includes names, household members, tasks, votes, points, rounds and statistics. Another member of a space may enter your name or nickname, assign tasks and record activity. That member is the source of this information; it does not always come from the person it concerns.

Data in a shared space is available to its authorised members. Anyone adding other people should share this policy with them and enter only necessary information. This does not replace the controller’s information obligations towards people who do not have an account.

Stripe handles payment details. The app stores customer and subscription identifiers and billing status, rather than complete card numbers. Mobile notifications use a device token linked to the account: an APNs token in the native iOS app, or an Expo token in clients using Expo.

Optional voice and text assistant

You can manage your household by voice or text in the chat. Messages, recordings, conversation context and the space data needed for a request (tasks, categories, member names, completions, results and time-off points) are sent to OpenAI. Invitation details entered in a message are also part of its content. CleanStrategy checks permissions and performs actions; changes to tasks and categories, rounds and time-off points are shown for confirmation. Before the first use of AI, the app asks for explicit, optional consent to send this data to OpenAI. Declining leaves other features available. You can withdraw consent in the chat under “How to use and privacy”; withdrawal blocks new recordings, messages and retries of pending commands. Consent is stored locally for each account and removed on sign-out. You can use the interface without the chat.

The microphone starts only after you tap record and grant system permission. Recordings last up to one minute; stopping and sending starts transcription. Leaving the chat or moving the app to the background interrupts recording. You can disable microphone access in device settings and type messages instead.

CleanStrategy deletes the local recording file after sending or cancelling it. The server processes audio in memory without saving a recording file. Conversation history is held on the app screen. An unresolved message remains locally until its result is retrieved or you sign out, so retrying does not record points twice. The server keeps the request identifier and hash, proposed actions, reference state needed to check changes and result receipts until the account or space is deleted. Planning requests do not save responses in OpenAI service history (store=false), and agent tracing is disabled. Under OpenAI’s standard API policy, message and response content may remain in security logs for up to 30 days, or longer when required by law or to prevent harm. For the transcription endpoint used, OpenAI states that content is not retained after processing the request. We do not claim to have enabled a custom Zero Data Retention programme.

Purposes and legal bases

Accounts, sign-in, features requested by the user and subscriptions: performance of a contract or steps before entering into one (Article 6(1)(b) GDPR). Sign-in information is necessary to create an account; payment details are necessary for a paid order.

Data about people added to a shared space without their own account: the legitimate interest in organising shared chores (Article 6(1)(f)), taking those people’s rights into account. You may object to this processing. Do not enter unnecessary data, especially about children.

Security, fault diagnosis, handling ordinary enquiries and establishing or defending claims: the controller’s legitimate interests (Article 6(1)(f)). Records required by law, including accounting records: compliance with a legal obligation (Article 6(1)(c)).

Optional sharing of data with OpenAI through the assistant: consent (Article 6(1)(a)). Withdrawal applies to future processing and does not affect the lawfulness of earlier processing. It does not undo actions already performed or automatically delete receipts needed to prevent duplicate records.

Optional push notifications: consent (Article 6(1)(a)). Declining does not block your account. Withdrawal does not affect the lawfulness of earlier processing. You can disable permission in device settings or ask us by email to delete your token.

Recipients and infrastructure

DigitalOcean hosts the infrastructure in the Frankfurt region, according to the provider’s information. This hosting location does not mean that all other services process data exclusively within the EEA.

Descope handles accounts and sign-in in its US service region (Northern Virginia). MongoDB Atlas stores application data on AWS in Paris, France. Automatic Atlas backups are disabled on the current free MongoDB Atlas plan. Stripe handles payments and subscriptions, including card details and the full billing address entered into the native PaymentSheet form. The Stripe library also collects form interaction information for functionality and analytics. CleanStrategy does not store full card numbers or CVC codes. Expo relays notifications for clients using that service. The native iOS app receives notifications directly through Apple Push Notification service. Apple and Google may process data in connection with app distribution and notification delivery.

OpenAI transcribes recordings and plans actions in the optional chat. We do not send the app session token or automatically send your account email address. Information you enter in a message, including an invitee’s address, is shared as part of the request.

A recipient’s scope and role depend on the service and agreement. A provider may be a processor or a separate controller, for example for its own payment obligations. We do not assume the same role for every operation.

Transfers outside the EEA — verification required

[TO COMPLETE BEFORE PUBLICATION: Confirm processing countries for Stripe, Expo, OpenAI and Apple/Google services. For every provider, confirm the relevant contracting entities, transfer basis, safeguards and how to obtain a copy. Descope project region: USA; API hosting: Germany; MongoDB database: France. Configuration and agreements supporting claims of SCC or DPF coverage have not been verified.]

Retention and deletion

When signing in with Apple, you can hide your email address. We then receive an Apple relay address rather than your private address. Account deletion includes an attempt to revoke Apple authorisation. If a stored token is unavailable, the app provides instructions for manually revoking access in Apple Account settings. A missing token does not block deletion of account data.

Account data is needed while the account is maintained. When you request deletion, we determine which data to delete and any grounds for retaining particular information. Merely referring to security or legal claims does not justify retaining the whole account.

Billing records are retained in accordance with applicable tax and accounting obligations. Information about a specific dispute is needed until it is resolved and the relevant limitation period has expired. Correspondence is assessed according to the enquiry’s purpose and the same criteria.

A push token is replaced when a new token is registered. The app removes it from the account before successful sign-out; account deletion also covers this token. Disabling system permission alone does not guarantee immediate removal of the token from the server. You can request its removal by email.

After account deletion, we remove the profile, memberships, device tokens and assistant commands linked to the account. Shared tasks and results may remain available to other members; the member is renamed “Deleted account” and unlinked from the account. Personal information entered into task content must be identified separately for deletion. Spaces with no members are deleted.

We retain a minimal register of deleted account identifiers to reject old session tokens and delayed billing events. The register currently has no automatic expiry. This does not mean that the full account profile is retained. Billing references and transaction reports are assessed separately for accounting and security obligations.

[TO COMPLETE BEFORE PUBLICATION: Implement the approved retention periods of 7 days for regular backups, 30 days after acceptance for manual migration copies, and 7 days for additional logs we manage. Confirm provider runtime log retention and payment report retention. Automatic Atlas backups are disabled; we do not claim a retention period for regular backups that are not being made. No additional log forwarding system has been configured.]

Your rights

Within the limits of the GDPR, you can request access, a copy, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests and withdraw consent. These rights also apply to someone added to a space by another person.

Email [email protected]. If there are reasonable doubts, we will ask for the information needed to confirm your identity. We respond without undue delay and within one month. For complex or numerous requests, this may be extended by two months; we will explain the reasons within the first month.

You may complain to the President of the Personal Data Protection Office in Poland (uodo.gov.pl), or the competent supervisory authority in the country of your habitual residence, place of work or the alleged infringement.

Minors and policy changes

Keep children’s data to a minimum; a nickname is usually enough to organise chores. Parental consent to data processing and consent to enter into a contract are separate matters and depend on age and the processing basis. Do not enter children’s payment details.

We publish changes to this policy with an updated date. A new processing purpose requires notice before processing begins for that purpose. Publishing the document is not, in itself, consent.