Privacy Policy
1. Data controller
The controller of your personal data is Kitfolio (hereinafter “we”, “us” or “Kitfolio”).
Contact for privacy questions: privacy@kitfolio.me
You can also request access to, correction of, or deletion of your data by email to the address above.
2. What personal data we collect
We collect the following categories of data:
- Account data: name and email address (provided at sign-up).
- Authentication: password hash (bcrypt via ASP.NET Core Identity; plaintext passwords are never stored).
- Content you create: packing lists, templates and item names. This is your content; we process it solely to provide the service to you and those you share with.
- Technical log data: IP address, timestamp and request ID, stored for security and debugging purposes. The app's log file on our own server is deleted automatically after 30 days. Other operational logs on the server are deleted on a rolling basis once they reach a fixed size. The copy sent to Grafana (section 6) has a shortened IP address and is deleted after the retention period stated there.
- Cookies: two HttpOnly cookies that keep you signed in, and a few for language, the last list you opened, guest access and sign-in with Google (section 9). No tracking or marketing cookies.
Access invites: if you invite someone to Kitfolio, we store their email address, who invited them, when the invite was sent, accepted or withdrawn, and how many times it was re-sent. The person invited gets at most three emails per invite. A withdrawn invite is deleted after 30 days. If your account is deleted, the invites you sent that nobody accepted are deleted, and the accepted ones are unlinked from your account. Basis: legitimate interest in operating and improving the service (Art. 6(1)(f)).
Waitlist: if you join the beta waitlist, we store your email address, when you joined, the language and which page on kitfolio.me you joined from: the path only (for example /en/app/from-template/no/hyttetur) and, if present, the campaign name in the link (utm_source), never the rest of the address or your IP address. When a seat opens, we let you in and send you one email about it through SMTP2GO. To be taken off the list, email us. Basis: legitimate interest in operating and improving the service (Art. 6(1)(f)).
Feedback: if you send us feedback from the account page, we store the message, the mood you picked (if any), the app version, the language, the page you came from and your browser, to improve the service. A copy reaches us by email through SMTP2GO. Your feedback is deleted together with your account.
3. Legal basis for processing (GDPR Article 6)
- Performance of a contract (Art. 6(1)(b)): account data, content and authentication are processed to provide the service you signed up for.
- Legitimate interest (Art. 6(1)(f)): technical log data is processed to protect the security of the service, detect abuse and debug technical problems.
- Compliance with a legal obligation (Art. 6(1)(c)): where Norwegian law requires us to store or disclose data.
4. Data retention and deletion
- Active account: data is retained for as long as the account is active and the service is in use.
- Account deletion: you can delete your account at any time from the account settings. Then you are signed out on every device at once, and the account is closed. After 30 days the rest is deleted for good:
- Your name and email address are removed. Wherever you took part, it says «Slettet bruker» (Norwegian for “Deleted user”).
- Lists and templates you own and share with no one are deleted. A list shared only through a guest link counts as not shared. A template a list still uses stays hidden, without your name, until no list uses it.
- Lists you have shared with others stay for the people in them, and so does a list shown inside one of them. Templates you have shared with others are normally taken over by one of their members instead, without your name (first the editor who has been in it longest). A member who has reached their template limit or has deleted their own account is passed over. If no one can take it over, it goes like a template you share with no one.
- Your memberships of other people’s lists and templates are removed.
- Sign-in data, settings, feedback and Kitfolio invites you sent that nobody accepted are deleted. Pending invites to lists and templates you have shared go with the list or template.
- Deleted lists and templates: when you delete a list or template, we keep it for 60 days in case it was a mistake. After that it is deleted for good, with its activity log. A deleted template that lists still use stays hidden (no one sees it) beyond the 60 days, until no list uses it.
- Delivery messages: when something changes, the server creates a message that carries the change to the others on the list and to our emails. These messages can contain item names, names and email addresses, and are deleted 90 days after delivery. This applies also after your account is deleted. Messages with your name or email address that were never delivered are deleted 90 days after they were created. A change message that could not be delivered stays as a basis for troubleshooting.
- Technical log data: the app's log file is deleted automatically after 30 days regardless of account status (see section 2).
5. Where data is stored: data in Europe
All data is stored exclusively on servers at Hetzner Online GmbH, an EU-based cloud provider with data centres in Germany and Finland. The database and all your content stay in the EEA.
A few sub-processors in section 6 may process some data outside the EEA. When they do, we use a lawful transfer basis, named next to each of them.
Hetzner Online GmbH is our data processor for server infrastructure. We have entered into a data processing agreement (DPA) in accordance with GDPR Article 28.
6. Sub-processors
We use a few providers to run Kitfolio. They process data on our behalf and on our instructions. Here is every one of them, and what they get.
- Hetzner Online GmbH (hosting and storage). Purpose: servers and database. Data: everything you store in Kitfolio. Basis: contract (Art. 6(1)(b)). Transfer: none, the data stays in the EEA.
- SMTP2GO (sending email). Purpose: sending sign-in links, invitations, account notices and the reminders in section 7. Data: your email address, your first name, the name of the list or template, and the text of the email. Basis: contract (Art. 6(1)(b)); the reminders on legitimate interest (Art. 6(1)(f)). Transfer: SMTP2GO is a New Zealand company, a country the EU recognises as safe (adequacy decision).
- Grafana Labs, Grafana Cloud (logs and metrics). Purpose: operations, debugging and security. Data: technical logs and metrics, such as time, the address of the page requested, status code, request ID and internal user ID. Before logs are sent we strip most of it: the IP address is shortened (the last part zeroed), email addresses and sign-in tokens are replaced, and browser details and query parameters are removed. Retention: 14 days. Basis: legitimate interest (Art. 6(1)(f)). Transfer: stored in the EU; Grafana Labs is a US company, so we rely on the EU Standard Contractual Clauses (SCCs) and the EU–US Data Privacy Framework.
7. Emails about your trips
If a packing list has dates, we may send you two emails. Only the owner of the list gets them.
- The evening before: one email between 17:00 and 21:00 the day before the trip, if something is still not packed. It gives the list name and how many things are left.
- When the trip is over: one email in the daytime after the last day of the trip, with the list name and a link to close the trip.
Both are on until you turn them off. You turn them off under Account, with “Email the evening before the trip” and “Email when the trip is over”. Every email also has a link at the bottom, “Turn it off”. It turns off only that one email, without signing in. The link works for 60 days.
8. Sharing of data
We do not sell your personal data. We share data only:
- With the sub-processors in section 6: only what each needs for its job.
- With users you invite: content in shared packing lists and templates is visible to those you explicitly share with.
- On legal request: where Norwegian law or a court order requires disclosure.
9. Cookies
Kitfolio uses only the cookies the service needs to work. No marketing cookies, no tracking pixels, no third-party scripts. All of them are sent over encrypted connections only (Secure).
Usage statistics without cookies: we count page views and a few events (such as “list created”) with Umami, which we host ourselves on our own server at Hetzner in the EU. It sets no cookies. Umami uses your IP address only to estimate country and region at that moment and does not store it; browser, operating system and screen size are stored coarsely. We send no names, e-mail addresses, list names or page titles. Invitation links, codes and list IDs are removed from the address before anything is sent. If you arrive through a link with a campaign tag (utm_source, for instance from a printout), your browser remembers the tag in this tab (sessionStorage, kitfolio.utmSource; only a–z, 0–9 and hyphens, at most 32 characters), and Umami gets one event, “arrival”, with the tag. The same tag goes along when you create a list or an account. Otherwise query strings are never sent. If your browser sends Do Not Track or Global Privacy Control (GPC), you are not counted. The basis is our legitimate interest in improving the service (GDPR Article 6(1)(f)).
Errors and performance: when something goes wrong in the browser, and to measure how fast pages load (Web Vitals), the app sends a technical report through our own server to Grafana Cloud, which is already listed among our processors above. The report holds the error message and where in the code it occurred, which page it concerned, the browser type and a random session ID that is forgotten when the tab closes. Before anything is sent, we remove identifiers from error messages and addresses in your browser: invitation links and codes, e-mail addresses, IDs and query strings. We do not send names, list contents, cookies or form data, and your IP address is not forwarded to Grafana. The basis is our legitimate interest in keeping the service working (GDPR Article 6(1)(f)).
Because we use only strictly necessary cookies, neither Norwegian law nor EU Directive 2009/136/EC requires consent for them.
10. Your rights
As a data subject you have the following rights under GDPR Chapter III:
- Access (Art. 15): request a copy of all data we hold about you.
- Rectification (Art. 16): request that inaccurate data be corrected.
- Erasure (Art. 17): request that your data be deleted (the “right to be forgotten”).
- Restriction (Art. 18): request that processing be restricted in certain situations.
- Data portability (Art. 20): request to receive your data in a machine-readable format, or download it yourself from the account page (“Download my data”), once every 24 hours.
- Objection (Art. 21): object to processing based on legitimate interest.
Send requests to privacy@kitfolio.me. We respond within 30 days (GDPR Art. 12(3)).
You also have the right to lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet (www.datatilsynet.no), if you believe the processing of your data infringes the GDPR.
11. Changes to this privacy policy
We may update this policy. For material changes we will notify you by email to the address associated with your account, with at least 14 days’ notice. Minor changes (e.g. clarifications without material effect) are made without notice, but the date at the top is always updated.