Privacy policy

The data controller for Tickleaf (the website at tickleaf.app, the web app and the iPhone and Android apps) is Ketryon AB, organisation number 559551-1030, Solbackavägen 13D, 632 22 Eskilstuna, Sweden.

For anything about your data, write to hello@ketryon.com. A person reads every message.

• Your email address — to create your account and sign you in. There are no passwords.
• What you write in Tickleaf — tasks, their notes, days, times and durations. Your loops and their colours and the days you closed them. Time you log with the timer, and the task it's for. Your settings.
• Sign-in records — when you ask for a sign-in email we store your address, when it was sent and a hashed version of the code and link (never the code itself), so we can check it and limit guessing.
• Billing, if you take out Plus — Stripe handles the payment: your name, billing address, card and any tax ID go to Stripe, never to us. We keep only the link to your Stripe customer, and see your plan, its dates and your invoices. Buy Plus in a phone app and Apple or Google takes the payment instead. RevenueCat keeps the record of that purchase (which subscription, its dates and receipt), linked to your account's id but not your email, and we see only your plan and its dates.
• Google Calendar, if you connect it — for each Google account you connect, its email address, Google's id for it and a token that lets Tickleaf read its calendars. Your events are read when you open the calendar and shown to you. If you turn on reminders for calendar events, upcoming ones are kept briefly to remind you. See Google Calendar below.
• What you say in Plan, if you talk (Plus) — your phone turns your words into text (Apple's speech recognition on iPhone, Google's on Android). Tickleaf never receives or records the audio. Only the text is sent to us and on to Anthropic, which splits it into lines for you to check. We don't store it. See Talking in Plan below.
• Reminders, if you turn them on in a browser — the address your browser gives us to send it notifications, its two keys, its time zone (so a 14:30 task nudges at 14:30 there) and whether it's on a Mac. While the Mac menu-bar app runs, we note when it last did, so a browser on that Mac stays quiet. We keep a short list of which reminders were sent, by task and time, so none goes twice.
• Suggestions and votes on the roadmap, if you make them — what you suggest, what you say you were trying to do, where you sent it from (the web, or a phone app and its version), and which ideas you voted for. Your suggestion's title and our public line about it appear on tickleaf.app/roadmap once we've read it. Your name and email never do, and what you were trying to do stays private.
• Anonymous visit counts, on the website — Vercel Web Analytics counts page views (the page, where you came from, your country, device type and browser) and a few actions: signing up, starting Plus, downloading or deleting your data. It uses no cookies and isn't tied to your account. Visitors are told apart by a hash of the request that's thrown away after 24 hours. The phone apps send none of this.
• Visit statistics with Google Analytics, on the website, if you agree — counts visits, where they come from and which pages are used. Google's tag loads on every page but is told to deny everything until you choose. Until then, and if you decline, it sets no cookies and sends only cookieless measurements without identifiers. If you accept, it sets cookies that recognise your browser between visits. The address it receives never includes a query string, it is never tied to your account, and nothing is used for advertising. The phone apps send none of this.
• Technical logs — like every website, our hosting keeps short-lived request logs (IP address, browser, time, page) to run and protect the service. When something breaks on our servers, an error report (the page, browser and error, without your IP address or content) goes to Honeybadger so we can fix it.

What we don't collect: no cookies for statistics unless you accept them, no cross-site tracking, no advertising identifiers, no location, no contacts, no data bought from anyone else. We don't sell or share your data for advertising, and we don't use it to train AI models.

Under the GDPR every use of personal data needs a legal basis. Ours:

We use these processors. Each has a data processing agreement with us and may only use your data to provide their service to us.

Where a provider handles data outside the EU/EEA, the transfer is protected by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

A reminder to a browser travels through that browser's own push service (Google for Chrome and Edge, Mozilla for Firefox, Apple for Safari). It's encrypted for your browser alone, so the push service can't read it. A reminder to a phone goes through Expo to Apple's push service on an iPhone or Google's on Android, with the task's title and time.

A copy of your tasks and loops also lives on your own devices (in the browser's storage, or in the app), so Tickleaf works offline. Signing out removes that copy.

If you get the app from the App Store or Google Play, Apple or Google process your download and purchase under their own privacy policies. We don't receive anything from them that identifies you.

Talking is optional and part of Plus. The first time, Tickleaf explains how it works and asks for your OK. Then your phone asks for the microphone.

• Your phone writes it down. Speech recognition is done by your phone's system: Apple on iPhone, Google on Android. Depending on your language and device, they may process the audio on their own servers, under their own privacy policies. Tickleaf never receives the audio and nothing is recorded.
• Only the text goes on. The text is sent to our server and from there to Anthropic (Claude), which splits it into separate things with their days and times. Anthropic processes it as our processor and doesn't use it to train its models. It may keep it for a limited time to check for misuse, then deletes it.
• You check before anything is added. The lines come back to Plan for you to change, and nothing is saved until you add it. We don't store the text.

You can stop at any time: don't use the mic, or turn off the microphone for Tickleaf in your phone's settings. Signing out asks again next time.

Connecting Google Calendar (Settings → Calendars, part of Plus) is optional. When you do, you allow Tickleaf to:

• See the list of your calendars — their ids, colours and whether they're shown in Google Calendar, to know which to read.
• Read the events in them — title, start and end, and whether you've declined — for the days you have open in Tickleaf's calendar.

That access is read-only: Tickleaf can't create, change or delete anything in your Google Calendar. Events are fetched from Google when your calendar asks for them and sent straight to your browser, without being written to our database, our logs or your device's storage. For each Google account you connect, we keep its email address, Google's id for the account, and the token Google issues for access, encrypted.

Only if you turn on reminders for calendar events (Settings → Reminders) do we keep your upcoming events: for each timed event from yesterday to 30 days ahead, its title (encrypted) and its start and end, and nothing else. They're read again when Google tells us a calendar changed, and deleted as soon as you turn event reminders off or disconnect the Google account.

Data from Google is used only to show you your own events in Tickleaf. It isn't sold, used for advertising, read by people (unless you ask us to look into a problem, or the law requires it), or used to train AI models.

Tickleaf's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To stop it, choose Disconnect beside a Google account in Settings: we ask Google to revoke that account's token and delete it, with its email and id. You can also remove Tickleaf at your Google account's third-party access page. Deleting your Tickleaf account does both, for every Google account you connected.

• Your account and content — for as long as you have an account. Delete it (Settings → Delete account) and your tasks, loops, settings and sign-in records are removed immediately, and so is RevenueCat's record of any App Store or Google Play purchase. Our database keeps a rolling one-day history for recovery, so the last traces are gone within 24 hours.
• Roadmap — votes go with your account. A suggestion we haven't read yet is deleted with your account. One already on the roadmap stays there, no longer linked to you.
• Google Calendar — each connected Google account's email, id and token until you disconnect it or delete your account. Upcoming events are kept only while reminders for calendar events are on, for the next 30 days, and deleted when you turn them off or disconnect.
• Reminders in a browser — its push address until you turn them off, sign out there, the browser stops them, or you delete your account. The list of sent reminders is cleared after two days.
• Reminders on a phone — its push token until you turn them off, sign out there, the phone stops them, or you delete your account.
• What you say in Plan — not kept by us: the text is used to make the lines and then dropped. Anthropic may keep it for a limited time to check for misuse.
• Things you delete — deleted tasks and loops are removed for good, on every device.
• Payment records — invoices and payments for Plus are kept for seven years, as Swedish bookkeeping law requires, even after you delete your account.
• Sign-in codes and links — work for 15 minutes, once.
• Technical logs — kept by our hosting for days, not months.
• Error reports — deleted by Honeybadger after at most 90 days.
• Anonymous visit counts — kept as totals for up to a year. The hash that tells visits apart is thrown away after 24 hours.
• Google Analytics — up to 14 months.
• Emails you send us — as long as needed to help you, then deleted.

All of these are strictly necessary for the service you asked for, which is why we don't ask for consent first.

These two are set only if you accept statistics in the cookie banner. Change or withdraw your choice any time with Cookie settings at the top of this page or in the website's footer. Withdrawing deletes them straight away.

Tickleaf sends an email when you ask to sign in, and one when an idea you voted for on the roadmap is done or won't happen. We don't send newsletters or marketing. If that ever changes, we'll ask first.

• All traffic uses HTTPS. Our providers encrypt data at rest.
• The tokens that read the Google accounts you connect are stored encrypted (AES-256-GCM), with the key kept apart from the database.
• No passwords exist to be stolen. Sign-in codes are stored only as hashes, expire after 15 minutes and lock after 5 wrong tries.
• Sessions are signed, so they can't be forged. Sync access is scoped so each account can only ever receive its own data.
• Only the people who build Tickleaf can reach the production systems, and only when needed.

Under the GDPR you can:

• Get a copy of your data (access) and receive it in a portable format.
• Correct it.
• Delete it — do it yourself in Settings, or ask us.
• Object to, or ask us to restrict, uses based on legitimate interest.

Write to hello@ketryon.com and we'll answer within one month. If you think we've handled your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or the authority where you live.

Tickleaf isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has signed up, tell us and we'll delete the account.

If we change how we use your data, we'll update this page and the date at the top. If a change matters — a new kind of data, a new purpose — we'll tell you in the app or by email before it applies.

Ketryon AB, organisation number 559551-1030, VAT number SE559551103001, Solbackavägen 13D, 632 22 Eskilstuna, Sweden. Email hello@ketryon.com.