🔔
Reminder for SimplicityLog in
🚧 This page is a structural draft, not a published policy. Every yellow box below marks something that needs a real decision or a real piece of information before this can go live — see the list at the bottom for a single consolidated view.

Privacy Policy

Last updated: Draft — not yet published

1. Who we are

Reminder for Simplicity ("we", "us") provides a shared reminders, shopping list, wishlist, chores, school, and activities app for families.

Needs a decision / real content: Legal entity name, organisationsnummer (or equivalent), and registered address — needed here as the formal "data controller" identity before this page can be published.

2. What personal data we collect

  • Account data: name, email address, phone (optional), preferred currency, timezone, and either a hashed password or a hashed PIN.
  • If you sign in with Google: your name, email, and profile picture as provided by Google.
  • Content you create: reminders, chores, shopping list and wishlist items, school and activity entries, calendar sync tokens, and suggestions/votes you post.
  • Child profiles: a name, a hashed PIN, and a real email address (yours, an alias, or the child's own) — set up and managed by an approved adult in the household.

3. Why we process it

  • To provide the service you signed up for (performance of a contract) — storing and showing your reminders, lists, and household data.
  • Legitimate interest — sending the email reminders you asked for, keeping accounts secure (e.g. the admin approval gate for new signups).
Needs a decision / real content: Confirm we send no marketing/promotional email today (only transactional: reminders, invites, password reset, approval notices). If that ever changes, this section needs a consent-based legal basis added.

4. Children's data & parental consent

Child profiles are created by an already-approved adult in the household, not by the child directly. A real email address is required at creation (see auth changes, 2026-07-27).

Needs a decision / real content: Open decision, not yet made (see TODO.md Körordning, steg 3): a declared minimum age for child profiles, and confirmation of who is treated as giving consent — the inviting parent, or a separate consent step. This section can't be finalized until that's decided.

5. Where your data is stored

Our database (Supabase) is hosted in the eu-central-1 region (Frankfurt, Germany) — inside the EU.

Needs a decision / real content: Confirm the hosting/processing region used by Vercel (our application host) and whether it offers EU data residency or an equivalent commitment — Vercel is a US-headquartered company.

6. Who else processes data on our behalf

  • Supabase — database hosting (EU region, see above).
  • Vercel — application hosting.
  • Resend — transactional email delivery.
  • Google — only if you choose to sign in with Google or subscribe to our outgoing calendar feed from a Google Calendar.
Needs a decision / real content: Confirm the data processing agreement (DPA) / EU-US Data Privacy Framework status for Vercel and Resend (both US companies). Also: the current outgoing email sender address (onboarding@resend.dev) is a Resend test domain — needs a real domain before this page (or the product) is presented to real users, independent of the privacy question.

7. How long we keep your data

Needs a decision / real content: Open decision, not yet made (see TODO.md Körordning, steg 4): a retention period after account deletion. Self-service "delete my account" isn't built yet either — until it is, deletion has to be requested manually.

8. Your rights

  • Access & export — already available: Profile → "Export your data" downloads everything as JSON.
  • Correct — edit your own name, email, phone, etc. directly in Profile.
  • Delete — [not self-service yet; contact us (see section 10) until it is.]
  • Object / restrict processing — [describe the process once decided.]
  • Complain to a supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY).

9. Cookies & tracking

We use only strictly necessary cookies (keeping you signed in). We don't currently use any analytics or advertising trackers.

Needs a decision / real content: Keep this true, or update this section, if any analytics tool is ever added.

10. Security

Passwords and PINs are stored hashed, never in plain text. Data in transit is encrypted (HTTPS).

11. Changes to this policy

We'll update the date at the top of this page whenever it changes.

Needs a decision / real content: Decide how users are notified of material changes — email, an in-app banner, or neither for minor edits.

12. Contact

Needs a decision / real content: A real contact email/address for privacy questions — not a test address.

Everything that needs a decision or real content before this can be published

  1. Legal entity name, org number, registered address (§1)
  2. Minimum age for child profiles + who gives consent (§4) — open Körordning item
  3. Vercel's data residency / DPA status (§5, §6)
  4. Resend's DPA status + a real sending domain (§6)
  5. Data retention period after account deletion (§7)
  6. Self-service account deletion — not built yet (§8)
  7. Real contact email/address (§12)