Kramm ("we," "us," "our") operates kramm.app and the Kramm Android app (app.kramm.mobile). This policy explains what data we collect, why, and your rights.

1. Data we collect

Account data: email, display name, auth tokens — via Supabase Auth (and proxied through kramm.app/auth/v1 so the consent screen shows kramm.app). Passwords are never stored in plaintext (Supabase bcrypt).
User content: tasks, habits, Pomodoro sessions, budget transactions, custom board items, chat messages — stored in Supabase Postgres with Row Level Security (RLS) scoped to your user_id.
OAuth tokens (optional): if you connect Google Drive/Notion/Strava/GitHub etc., we store encrypted access/refresh tokens (AES-256 via KRAMM_PLUGIN_ENCRYPTION_KEY) in Supabase. We never log token values.
AI inputs (optional): text you send to "Parse natural language" / "Smart breakdown" is forwarded to Groq (llama-3.3-70b) or Gemini for processing. Inputs are not used to train models. See Groq & Google data policies.
Device & diagnostics: OS version, app version, crash traces, IP-derived region, performance timings. On Android (Capacitor WebView) we do not collect Ad ID, precise location, or contacts.

2. How we use data

Provide and sync your workspace across web and Android (real-time via Supabase Realtime).
Run AI features you explicitly trigger (task breakdown, morning brief, nightly analysis cron at 02:00 UTC).
Secure the service (rate limiting in middleware.ts, abuse detection, encrypted at rest + TLS in transit).
Improve reliability (aggregated crash counts, no PII in logs).

3. Sharing

We do not sell your data. We share only with service processors needed to run Kramm:

Supabase (database, auth, storage, realtime) — DPA, SOC 2.
Vercel (hosting kramm.app) — edge middleware, CSP headers in next.config.ts.
Groq / Google Generative AI (only text you submit to AI routes, 20s timeout, 5k char limit).
OAuth providers you connect (Google, Notion, GitHub, etc.) — per their scopes.

4. Data retention & deletion

Your data is retained until you delete it. You can export everything via Settings → Export, and delete your account via Settings → Danger Zone or by emailing privacy@kramm.app. We hard-delete within 30 days (backups expire in 60 days). The Android app uses the same deletion path.

5. Security

TLS everywhere, HSTS max-age 63072000, CSP (next.config.ts) + X-Frame-Options SAMEORIGIN (middleware.ts).
Postgres RLS: every user-data query includes where user_id = auth.uid().
Short-lived JWTs (Supabase, 1h), refresh rotation, rate-limited auth (/api/auth 20/min).
No secrets in logs or client bundles (checked via security checklist §21).

6. Data safety (Google Play)

Declared in Play Console → Data safety:

Collected: email address, user-generated content (tasks/habits), app activity (tasks completed), crash logs — all encrypted in transit & at rest, user can request deletion.
Not collected: precise location, Ad ID, contacts, financial account numbers (budget entries are user-typed amounts, not linked bank data).
Sharing: only to processors above, not to advertisers.

7. Children

Kramm is not directed to children under 13. Minimum age 13.

8. Your rights

Access, correction, export, deletion, objection — contact privacy@kramm.app. GDPR/CCPA requests honored within 30 days.

9. Changes

We will post updates here and bump the date. Material changes notified in-app.

10. Contact

Kramm — privacy@kramm.app — https://kramm.app/privacy
Postal: Kramm, c/o support, kramm.app

Privacy Policy