Kulanner Privacy Notice
Last updated: September 17, 2026
This notice explains how Kulanner handles personal data. Kulanner is a personal project. It does not currently use personal data for advertising. It uses Vercel Web Analytics to understand aggregate website usage.
Who is responsible for your data?
Kulanner is operated in Sweden. The operator is the data controller for the personal data described in this notice.
For privacy questions or requests, contact support@kulanner.com.
Who may use Kulanner?
Account creation and cloud synchronization are available to users aged 13 or older. Children under 13 may use the unsigned-in, local-only version with a parent or guardian’s supervision.
If we learn that an account belongs to a child under 13, we will delete the account and its cloud data.
Data Kulanner handles
When you join the waiting list
We store the Gmail address you submit and the time you joined in Supabase. By joining, you agree to receive an email about your place on the waiting list. Joining does not create an account or give us access to your Gmail inbox. The list is not publicly readable.
Your waiting-list details are kept until we have contacted you about your place or you ask to be removed. To withdraw your agreement and request removal, email support@kulanner.com.
When you use Kulanner without an account
Your tasks, actions, and notes are stored in your browser’s tab-scoped session storage. This planner content is not sent to Kulanner’s cloud database. It normally remains available when you refresh the same tab and is removed when that browser session ends. Your browser may provide controls for clearing it sooner.
The hosting service still receives technical information needed to deliver and secure the website, such as your IP address, request time, requested page, browser or device information, and security or error-log information.
When you create or use an account
Kulanner uses Google for sign-in. Google may provide:
- your email address;
- your name and profile image, if available;
- a unique identifier for your Google account; and
- authentication information needed to confirm that sign-in succeeded.
Kulanner does not receive your Google password.
When cloud synchronization is enabled, Kulanner also handles:
- your account identifier and account timestamps;
- task titles, descriptions, categories, and ordering;
- action titles, states, due dates, and update dates;
- note text and note dates; and
- timestamps associated with this planner content.
Website analytics
Kulanner uses Vercel Web Analytics to measure page views and understand aggregate traffic. Analytics data may include the visited URL, referring website, filtered query parameters, approximate location, and browser, operating system, and device type. We do not send planner content or account details as custom analytics events.
Vercel uses a hash derived from incoming requests to distinguish visitors, rather than analytics cookies. Visitor identifiers are discarded after 24 hours. The analytics dashboard provides aggregate statistics. See Vercel’s Web Analytics privacy documentation.
When you contact support
We handle your email address, your message, and any other information you choose to include so that we can respond to you and document the request when necessary.
Why Kulanner uses personal data
| Purpose | Personal data involved | Legal basis under the GDPR |
|---|---|---|
| Create your account, authenticate you, associate planner data with your account, synchronize it, and provide account deletion | Account identity, email address, authentication data, and planner content | Performance of the service you request, Article 6(1)(b) |
| Operate, troubleshoot, and secure the service and prevent abuse | Technical, security, authentication, and error-log data | Legitimate interests in providing a reliable and secure service, Article 6(1)(f) |
| Answer privacy requests and comply with applicable law | Contact details, request contents, account data, and records of the response | Compliance with legal obligations, Article 6(1)(c) |
Where processing is based on legitimate interests, you may object as described under Your rights below.
Cookies and browser storage
Kulanner uses browser storage to keep unsigned-in planner data within your browser session. For signed-in users, Kulanner uses cookies or similar browser storage that is necessary to maintain authentication and protect the account session.
Kulanner does not currently use advertising or analytics cookies. Vercel Web Analytics uses request-derived visitor hashes instead. If tools requiring consent are added, this notice and any required consent choices will be updated before those tools are enabled.
Service providers and other recipients
Kulanner uses the following providers:
- Google provides account authentication. Google’s own handling of your Google account is governed by the Google Privacy Policy.
- Supabase provides authentication and the database used for cloud synchronization. The configured primary database region is Ireland. See the Supabase Privacy Policy.
- Vercel hosts and delivers the website, provides Web Analytics, and may handle technical, operational, and security data when your browser connects to Kulanner. See the Vercel Privacy Notice.
- Email routing and mailbox providers process messages sent to the support address so that we can receive and answer them.
We may also disclose information when required by law, to protect legal rights, or to investigate fraud, abuse, or security incidents. Kulanner does not sell or rent personal data.
International data transfers
Although Kulanner’s configured Supabase database region is in Ireland, Google, Supabase, Vercel, and their subprocessors may process personal data in countries outside Sweden or the European Economic Area. Where the GDPR requires safeguards for a transfer, we rely on an adequacy decision or appropriate contractual safeguards provided by the relevant service provider, such as the European Commission’s Standard Contractual Clauses.
You may contact us if you want more information about the safeguards relevant to your data.
How long data is kept
- Unsigned-in planner data: kept in your browser’s session storage until the browser session ends or you clear it. Kulanner does not retain a cloud copy of this content.
- Active accounts: account and planner data are kept while your account remains active, unless you ask us to delete it sooner.
- Account deletion: deletion is handled manually. Email support@kulanner.com and the operator deletes the account and its planner data from the active system. Residual copies may remain temporarily in provider-managed backups, logs, or disaster-recovery systems until they are overwritten or deleted under the provider’s normal lifecycle.
- Technical and security records: kept only for as long as reasonably necessary to operate and secure the service, investigate incidents, or meet legal requirements. Provider-controlled logs follow the relevant provider’s retention practices.
- Support and privacy requests: kept for as long as needed to answer and document the request and to comply with applicable legal obligations, then deleted when no longer needed.
Security and sensitive information
Kulanner uses encrypted network connections, account authentication, database access controls, and provider security features intended to protect personal data. No online service can guarantee absolute security.
Task and note content is not end-to-end encrypted. Do not store passwords, payment credentials, medical information, highly confidential workplace information, or other sensitive data in Kulanner.
Your rights
Depending on the circumstances, the GDPR gives you the right to:
- ask for access to your personal data;
- correct inaccurate or incomplete data;
- delete your data;
- restrict certain processing;
- receive data you provided in a portable format;
- object to processing based on legitimate interests; and
- lodge a complaint with a data-protection authority.
You can delete your account and cloud planner data by emailing support@kulanner.com. We may need to verify your identity before acting on a request. We normally respond within one month, as required by the GDPR, subject to any permitted extension.
The Swedish supervisory authority is the Swedish Authority for Privacy Protection (IMY). You can find its contact details at imy.se.
Automated decisions
Kulanner does not use personal data for profiling or automated decisions that produce legal or similarly significant effects.
Changes to this notice
This notice may be updated when Kulanner’s features, providers, or legal obligations change. The date at the top will be revised, and material changes will be communicated in the service when appropriate.
Contact
For questions, privacy requests, or complaints about Kulanner’s handling of personal data, contact support@kulanner.com.