Privacy Policy

Last updated: 2026-09-08

1. Introduction

CoachKeeper ("we", "us", "our") is a personal knowledge management application. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our service, in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. We act as the data controller for your personal data.

2. Data We Collect

Account Data

Email address (used for authentication and account recovery) and a securely hashed password (bcrypt). We never store your password in plain text.

User-Created Content

Notes (rich text documents), Todos (structured tasks with checklists), Events (calendar items), and Sources (uploaded files). This content is stored on our servers to provide the service.

AI Chat Messages & Embeddings

Messages you send through the AI assistant are processed to generate responses. Chat conversations are stored in your account so you can revisit them; you can delete individual conversations at any time, and all chat history is erased when you delete your account. To power semantic search and retrieval, the text content of your notes, todos, and events is additionally converted into vector embeddings by our AI processor (see Section 4) whenever you create or edit them. If you enable the optional memory feature, selected AI memories persist between sessions and can be viewed and deleted in Settings.

Browser Storage (localStorage)

With your consent, we store UI preferences locally in your browser: theme settings, layout dimensions, editor font, tab state, agent configuration, and onboarding state. These are never transmitted to our servers. You can reject or withdraw this consent at any time.

Usage Measurement

To see which parts of CoachKeeper are used and whether the daily planning loop works for people, we record a small, fixed set of usage events against your account: which view was open and for how long (active time only), when something was captured, planned, scheduled or completed, when a day was planned or closed, when the assistant or search was used, and the steps of the first-run tour. Each event carries at most a handful of coded values (for example the kind of item, or a view name). We never record the text of a note, task, event, link or message, page titles, your IP address or your device details, we set no analytics cookie or identifier, and the data never leaves our own database. It is read only in aggregate. You can switch this off at any time in the consent banner or under Settings › Privacy & Data; switching it off also deletes everything recorded so far.

3. Legal Basis for Processing

Contract Performance (Art. 6(1)(b) GDPR)

Processing your account data and user-created content is necessary to provide the CoachKeeper service you signed up for.

Consent (Art. 6(1)(a) GDPR)

Browser localStorage preferences are only stored with your explicit consent, which you can withdraw at any time via Settings or the consent banner.

Legitimate Interest (Art. 6(1)(f) GDPR)

Security measures (rate limiting, HTTPS enforcement, security headers), request logging for service reliability and abuse prevention, and first-party usage measurement as described in Section 2 — our interest is understanding which parts of the product are used so we can improve it; the data is minimal, pseudonymous, kept only on our own systems and read only in aggregate, and you can object with one switch at any time (Art. 21).

4. Sub-Processors & Third-Party Services

We share data with the following third-party processors, solely for the purposes described:

OpenAI (migration to EU in progress) Currently: San Francisco, USA. Planned: EU (Azure AI Foundry, Sweden/Netherlands)

AI chat processing, tool-calling, conversation analysis, web search, and embedding generation. Your chat messages and relevant context (note summaries, todo lists, calendar events) are sent to generate AI responses. In addition, the text content of your notes, todos, and events is sent to generate vector embeddings that power semantic search — this happens automatically when you create or edit content. We are actively migrating to Azure OpenAI Service hosted in the EU to ensure data residency within the European Economic Area.

Currently subject to OpenAI's Data Processing Addendum. After migration, Microsoft's Azure DPA will govern processing with full EU data residency.

Hetzner Online GmbH Falkenstein & Helsinki, Germany/Finland (EU)

Infrastructure provider: application hosting on a dedicated server in Helsinki, Finland. User-uploaded files (sources, documents, images) are stored in Hetzner Object Storage (S3-compatible) in the same Helsinki region. File data does not leave the European Economic Area.

Subject to Hetzner's Data Processing Agreement (Art. 28 GDPR). Hetzner is a German company subject to German and EU data protection law.

Neon Inc. Database region: AWS eu-central-1 (Frankfurt, Germany, EU)

Managed PostgreSQL database hosting. Your account data and user-created content (notes, todos, events, chat history, embeddings) are stored in a database operated by Neon on AWS infrastructure in the EU.

Subject to Neon's Data Processing Addendum (Art. 28 GDPR).

Stripe Payments Europe, Ltd. Dublin, Ireland (EU)

Payment processing for paid subscriptions (only if you subscribe to a paid plan). Your email address and payment details are processed by Stripe; CoachKeeper never stores card numbers — we store only a Stripe customer reference and your subscription status.

Subject to Stripe's Data Processing Agreement (Art. 28 GDPR).

Resend, Inc. USA (transfer safeguarded by Standard Contractual Clauses)

Transactional email delivery: account verification and password recovery. Only your email address and the message content are shared. A direct SMTP fallback may be used if the primary provider is unavailable.

5. Google Calendar Integration (Optional)

If you choose to connect Google Calendar, CoachKeeper requests access to Google user data through Google's OAuth consent screen. This integration is entirely optional — CoachKeeper works fully without it — and you can disconnect at any time from Settings > Calendar.

Scopes We Request

  • See, create, change, and delete events on calendars this application creates (.../auth/calendar.app.created): CoachKeeper creates a single dedicated calendar named "CoachKeeper" in your Google account and writes your CoachKeeper events there. This scope does not permit us to modify any of your other calendars or the events on them.
  • See the list of Google calendars you're subscribed to (.../auth/calendar.calendarlist.readonly): returns the names and identifiers of your calendars, not their contents. It exists so the availability check below can cover every calendar you keep, rather than only your primary one.
  • View your availability in your calendars (.../auth/calendar.freebusy): returns busy and free time blocks only — start and end times, with no titles, descriptions, guests, or locations. It is used solely so that suggested time blocks do not overlap with commitments you already have. CoachKeeper cannot read the contents of your events with this permission.

We Deliberately Ask for Less

Google offers broader calendar permissions that would let an application read every event on every calendar you own. CoachKeeper does not request them. The two permissions above are the narrowest pair that still deliver the feature, which is why connecting CoachKeeper does not show the "unverified app" warning Google displays for applications requesting sensitive calendar access.

How We Use This Data

Google Calendar data is used exclusively to provide the calendar-sync features you enabled: writing your CoachKeeper events to the dedicated CoachKeeper calendar in your Google account, reflecting changes you make to those events in Google back into CoachKeeper, and checking your availability when scheduling. We do not use Google user data for advertising, we do not sell or transfer it to third parties, and we do not use it to develop, improve, or train any generalized machine-learning or AI model.

Google Data and the AI Assistant

When you ask the AI assistant to schedule something, the busy and free time blocks needed to answer that request may be sent to our AI processor (see Section 4) to generate the response. Because CoachKeeper only requests availability, no titles, descriptions, guests, or locations from your other calendars are ever available to the assistant. This happens only for actions you initiate, and the AI processor is contractually prohibited from training on the data.

Limited Use Disclosure

CoachKeeper's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What We Store

We store an encrypted Google refresh token (so sync continues without repeated sign-ins), the identifier of the CoachKeeper calendar we created, and sync bookkeeping for that calendar such as per-event Google identifiers and incremental change tokens. Availability results from your other calendars are used at the moment you schedule something and are not stored.

Revoking Access

Disconnect at any time from Settings > Calendar, which deletes the stored refresh token and all Google event identifiers from our database. You may also revoke access directly at myaccount.google.com/permissions. Disconnecting does not delete the CoachKeeper calendar already created in your Google account — you can remove that from Google Calendar yourself.

6. Data Retention

  • Active Account: Your data is retained for as long as your account is active.
  • Soft-Deleted Items: Notes, todos, and events you delete are moved to trash. They are permanently purged after your configured retention period (7, 14, 30, or 90 days — configurable in Settings).
  • AI Chat: Conversation history is stored in your account until you delete the conversation or your account. Optional AI memories can be individually deleted or bulk-cleared in Settings.
  • Usage Measurement: Usage events are deleted after 13 months, immediately when you switch measurement off, and with your account.
  • Account Deletion: When you delete your account, all associated data is permanently and irreversibly removed, including notes, todos, events, sources, uploaded files, AI memories, chat history, embeddings, calendar connections (with the Google grant revoked), and action logs.

7. Your Rights

Under the GDPR, you have the following rights, all exercisable through the Settings page:

  • Right of Access (Art. 15): Export all your data as a ZIP archive (notes as Markdown, todos and events as JSON, AI memories).
  • Right to Rectification (Art. 16): Edit any of your content directly within the application.
  • Right to Erasure (Art. 17): Delete your entire account and all associated data with password verification. This action is permanent and irreversible.
  • Right to Data Portability (Art. 20): Download your data in structured, machine-readable formats (JSON, Markdown).
  • Right to Restriction (Art. 18): Contact us to request restriction of processing.
  • Right to Object (Art. 21): Switch off usage measurement at any time in Settings > Privacy & Data (this also deletes what was recorded). For any other processing based on legitimate interest, contact us.
  • Right to Withdraw Consent (Art. 7(3)): Withdraw your localStorage consent at any time via Settings > Privacy & Data > Manage Cookie Preferences.
  • Right to Lodge a Complaint (Art. 77): You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

8. International Data Transfers

Currently, AI-related data is processed by OpenAI in the United States. We are migrating to Azure OpenAI Service hosted in the EU (Sweden/Netherlands) to eliminate international data transfers for AI processing. Until migration is complete, we rely on OpenAI's published Data Processing Addendum for transfer safeguards. This section will be updated upon completion of the EU migration.

9. Security Measures

We implement the following technical and organizational measures to protect your data:

  • HTTPS with HSTS (HTTP Strict Transport Security) enforced in production
  • Authentication via httpOnly, Secure, SameSite cookies — tokens are never accessible to JavaScript
  • Content Security Policy (CSP) headers preventing cross-site scripting attacks
  • Password hashing with bcrypt (industry-standard adaptive hashing)
  • Rate limiting on authentication endpoints to prevent brute-force attacks
  • Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy

10. Data Controller & Contact

[PLACEHOLDER — legal name, legal form, and postal address of the data controller. Fill in from legal-ops before deploying.]

For any questions about this privacy policy or to exercise your rights, contact the data controller at:

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated through the application. Continued use of the service after changes constitutes acceptance of the updated policy.