Kaairo (“we”) is a gamified tasks & habits app — task management, routines, focus sessions and analytics, with achievements and XP — available at kaairo.app. This policy explains what data we collect, why, and what control you have over it.
1. What data we collect
1.1. Account data
- Name, email and password (hashed, never stored in plain text).
- If you sign in with Google, we receive your public name, email and profile photo from that account.
- Preferred language, avatar, and notification preferences (sounds, reminders, weekly email summary).
1.2. Content you create
- Tasks, routines, focus sessions, XP, level, streaks and unlocked achievements.
- Local notes you add to Google events or tasks (see section 2), stored only in Kaairo.
1.3. Technical and analytics data
- We use PostHog to understand how the product is used (pages visited, actions like completing a task or unlocking an achievement). This helps us improve the product — we do not sell or share this data with third parties for advertising.
- IP address and user agent, for security (detecting abusive login attempts) and server logs.
2. Google Calendar and Google Tasks integration
If you choose to connect your Google account to Kaairo, we request read-only access to the calendar.readonly and tasks.readonly scopes. This lets us show your Google Calendar events and Google Tasks alongside your Kaairo tasks, on your dashboard.
- We never write, edit, delete or create events or tasks in your Google account — access is strictly read-only.
- Google Calendar/Tasks data is fetched in real time to display on your dashboard and is not stored persistently beyond a small optional local annotation (e.g. marking something as done within Kaairo), which is never written back to your Google account.
- This data is never shared with third parties, is not used for advertising, and is not used to train artificial intelligence or machine learning models.
- The access token to your Google account is stored encrypted and only used for the read requests described above.
- You can revoke this access at any time under Profile → Google Calendar → Disconnect within Kaairo, or directly on your Google Account permissions page. Revoking access does not affect tasks and routines created directly in Kaairo.
3. Emails we send
We use Resend as our transactional email provider for: account confirmation, password recovery, and an optional weekly progress summary (you can turn off the weekly summary in your profile settings). We do not send unsolicited marketing emails.
4. Where and how we store data
Your data is stored in a PostgreSQL database, on servers we manage, with restricted access. Passwords are stored hashed (bcrypt); sensitive tokens (such as Google access) are encrypted at rest.
5. How long we keep your data
We keep your data while your account is active. If you delete your account, it enters a 30-day recovery period (during which you can reverse the deletion by contacting us), after which the data is permanently erased from our production systems.
6. Your rights
- Access, correct or update your data directly in your account settings.
- Delete your account and associated data at any time, under Profile → Account → Delete account.
- Request a copy of your data or ask any question about this policy by contacting us at the email below.
7. Changes to this policy
We may update this policy occasionally. Material changes will be communicated within the app or by email.