Legal
Tickleaf holds the things you have to do, which can be personal. Here's exactly what we keep, why, where, and how to make it disappear.
Last updated 1 October 2026 · See also Terms of use
The short version
- We collect your email address and what you write in Tickleaf. Nothing else.
- No ads, no tracking, no analytics. We never sell your data or use it to train AI.
- Your data is stored in the EU, with a copy on your own devices.
- One cookie, only to keep you signed in.
- Delete your account in Settings and everything goes, on every device.
- You can ask for a copy of your data at any time.
The summary helps you read the full text below; the full text is what applies.
01Who we are
Tickleaf is made by Ketryon, in Sweden. We decide how your data is used, so we're responsible for it.
The data controller for Tickleaf (the website at tickleaf.app, the web app and the iPhone and Android apps) is Ketryon AB, organisation number 559551-1030, Solbackavägen 13D, 632 22 Eskilstuna, Sweden.
For anything about your data, write to hello@ketryon.com. A person reads every message.
02What we collect
Your email address, and the things you put into Tickleaf. That's the whole list.
- Your email address — to create your account and sign you in. There are no passwords.
- What you write in Tickleaf — tasks, their notes, days, times, durations and colours; your loops and the days you closed them; your settings.
- Sign-in records — when you ask for a sign-in email we store your address, when it was sent and a hashed version of the code and link (never the code itself), so we can check it and limit guessing.
- Technical logs — like every website, our hosting keeps short-lived request logs (IP address, browser, time, page) to run and protect the service.
What we don't collect: no analytics or tracking scripts, no advertising identifiers, no location, no contacts, no data bought from anyone else. We don't sell or share your data for advertising, and we don't use it to train AI models.
03Why we use it
To run Tickleaf for you, and to keep it secure. Nothing else.
Under the GDPR every use of personal data needs a legal basis. Ours:
| Use | Data | Legal basis |
|---|---|---|
| Creating your account and signing you in | Email, sign-in records | Contract — needed to provide Tickleaf (Art. 6(1)(b)) |
| Storing and syncing your tasks and loops across devices | Your content, settings | Contract (Art. 6(1)(b)) |
| Stopping abuse: limiting sign-in emails and wrong codes | Email, sign-in records, logs | Legitimate interest in a secure service (Art. 6(1)(f)) |
| Keeping the service running and fixing faults | Technical logs | Legitimate interest (Art. 6(1)(f)) |
| Answering when you write to us | Your message, email | Legitimate interest (Art. 6(1)(f)) |
| Meeting legal duties, e.g. bookkeeping if you ever pay | What the law requires | Legal obligation (Art. 6(1)(c)) |
04Where it's kept, and who helps
Your data is stored in the EU. A few providers help run Tickleaf, only on our instructions.
We use these processors. Each has a data processing agreement with us and may only use your data to provide their service to us.
| Provider | What they do | Where |
|---|---|---|
| Neon | Our database: your account and content | EU (Frankfurt, Germany) |
| PowerSync (JourneyApps) | Keeps your devices in sync with the database | EU region |
| Vercel | Hosts the website and app, and handles requests | Global network; processing may happen outside the EU |
| Resend | Sends sign-in emails | United States |
Where a provider handles data outside the EU/EEA, the transfer is protected by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
A copy of your tasks and loops also lives on your own devices (in the browser's storage, or in the app), so Tickleaf works offline. Signing out removes that copy.
If you get the app from the App Store or Google Play, Apple or Google process your download and purchase under their own privacy policies; we don't receive anything from them that identifies you.
05How long we keep it
Until you delete your account. Then it's gone — from the live database at once, from backups within a day.
- Your account and content — for as long as you have an account. Delete it (Settings → Delete account) and your tasks, loops, settings and sign-in records are removed immediately. Our database keeps a rolling one-day history for recovery, so the last traces are gone within 24 hours.
- Things you delete — deleted tasks and loops are removed for good, on every device.
- Sign-in codes and links — work for 15 minutes, once.
- Technical logs — kept by our hosting for days, not months.
- Emails you send us — as long as needed to help you, then deleted.
07Emails
We only email you sign-in codes you asked for.
Tickleaf sends an email only when you ask to sign in. We don't send newsletters or marketing. If that ever changes, we'll ask first.
08Security
Encrypted in transit, no passwords to leak, and every account sealed off from every other.
- All traffic uses HTTPS; our providers encrypt data at rest.
- No passwords exist to be stolen. Sign-in codes are stored only as hashes, expire after 15 minutes and lock after five wrong tries.
- Sessions are signed, so they can't be forged; sync access is scoped so each account can only ever receive its own data.
- Only the people who build Tickleaf can reach the production systems, and only when needed.
09Your rights
See it, fix it, take it, delete it — and complain if we get it wrong.
Under the GDPR you can:
- get a copy of your data (access) and receive it in a portable format;
- correct it;
- delete it — do it yourself in Settings, or ask us;
- object to, or ask us to restrict, uses based on legitimate interest.
Write to hello@ketryon.com and we'll answer within one month. If you think we've handled your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or the authority where you live.
10Children
Tickleaf isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has signed up, tell us and we'll delete the account.
11Changes to this policy
If we change how we use your data, we'll update this page and the date at the top. If a change matters — a new kind of data, a new purpose — we'll tell you in the app or by email before it applies.
12Contact
Ketryon AB, organisation number 559551-1030, VAT number SE559551103001, Solbackavägen 13D, 632 22 Eskilstuna, Sweden. Email hello@ketryon.com.