Overview

Krll ("we", "us") makes a productivity app that turns everyday tasks into real-world contributions to ocean cleanup. This Privacy Policy explains what personal data we collect, why, and the choices you have. We are based in Paris, France, and are the data controller for the personal data described here. For account, security, or privacy requests, email contact@krllapp.com.

Data we collect

We collect only what we need to run Krll:

• Account details: your first and last name, and an email address and/or phone number. You may also add a username and profile photo.
• Sign-in identifiers: if you sign in with Apple, Google, or Microsoft, we receive a unique identifier from that provider — never your provider password. If you use a password, it is stored only as a bcrypt hash.
• Verification codes: one-time codes we send to your email or phone to confirm it. They are stored only as a hash and expire quickly.
• Content you create: your tasks, lists, notes, and settings. Shared tasks and their comments are end-to-end encrypted — we store them only as ciphertext we cannot read.
• Social data: the friends, connections, referrals, and blocks you create in the app.
• Activity and rewards: points, in-app cash, levels, quiz results, donation history, and shop purchases.
• Subscriptions: if you buy Krll Pro, Apple handles payment; we receive a transaction identifier and subscription status, not your card details.
• Device and usage data: device tokens for notifications, platform and app version, last-online time, and aggregated diagnostics.

How we use your data

We use your data to:

• Provide, sync, and maintain Krll across your devices.
• Authenticate you and verify your email or phone.
• Send notifications and service messages you have opted into.
• Run the points, rewards, and ocean-cleanup contribution features.
• Keep the service secure and prevent abuse.
• Fix bugs and improve stability and features.

We do not sell your personal data, and we do not use it for third-party advertising.

Legal basis for processing

Under the General Data Protection Regulation (GDPR), we process your data on the following bases: performance of a contract (to provide the app you signed up for), your consent (for optional communications, integrations, and non-essential cookies), and our legitimate interests (to secure and improve the service). You may withdraw consent at any time.

Sharing and third parties

We share data only with trusted providers who help us run Krll, and only as needed:

• Hosting and file storage: Google Cloud Platform.
• Email delivery: Resend.
• Analytics and crash reporting: Google (Firebase and Crashlytics), used to understand usage in aggregate and to fix crashes.
• Payments and subscriptions: Apple.
• Push notification delivery: Apple (APNs).
• Optional integrations you enable, such as Google Calendar or Microsoft Outlook, receive only what is needed to sync.

These providers act under data-processing agreements. We may also disclose data where required by law. We never sell your personal data.

Data retention

We keep your personal data while your account is active. When you delete your account, we remove or anonymize your data: identifying details are scrubbed so your email, username, and phone free up immediately, and password hashes are not retained. An anonymized record may be kept for up to five years to meet legal, security, and fraud-prevention obligations, after which it is permanently deleted.

Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten") — you can also delete your account directly in the app.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Lodge a complaint with a supervisory authority (in France, the CNIL).

To exercise any of these rights, email contact@krllapp.com.

How we protect your data

We protect your data with encryption in transit, hashed passwords and verification codes, and strict access controls. Shared tasks and their comments are end-to-end encrypted, so we cannot read their contents. For more detail, see our Security page.

Cookies

On our website we use essential cookies to run the site and, with your consent, optional cookies to understand usage and remember preferences. You can review and change your choices at any time on our Cookie Preferences page.

Children's privacy

Krll is not directed to children under 13 (or the higher minimum age required in your country), and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, email contact@krllapp.com and we will delete it.

International transfers

We process data in the European Union where possible. Some providers — such as Apple, Google, and Resend — may process data outside the EU/EEA; where they do, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "last updated" date above and, where appropriate, notify you.

Contact us

Questions about this Privacy Policy or your data? Email contact@krllapp.com or reach us through our Contact page.