Privacy Policy

Overview

Krll ("we", "us") makes a productivity app that turns everyday tasks into real-world contributions to ocean cleanup. This Privacy Policy explains what personal data we collect, why, and the choices you have. We are based in Paris, France, and are the data controller for the personal data described here. For account, security, or privacy requests, email contact@krllapp.com.

Data we collect

We collect only what we need to run Krll:

• Account details: your first and last name, and an email address and/or phone number. You may also add a username and profile photo.
• Sign-in identifiers: if you sign in with Apple, Google, or Microsoft, we receive a unique identifier from that provider — never your provider password. If you use a password, it is stored only as a bcrypt hash.
• Verification codes: one-time codes we send to your email or phone to confirm it. They are stored only as a hash and expire quickly.
• Content you create: your tasks, lists, notes, and settings. Shared tasks and their comments are end-to-end encrypted — we store them only as ciphertext we cannot read.
• Voice input: dictation is optional. When you dictate a task, your speech is transcribed on your device where possible. When on-device recognition is unavailable, the audio is sent to Apple to be transcribed under Apple's terms, and Krll keeps only the resulting text, which becomes your task content.
• Social data: the friends, connections, referrals, and blocks you create in the app.
• Contacts: contact matching is optional. If you allow access to your device's address book, Krll computes one-way SHA-256 hashes of your contacts' phone numbers and email addresses and uploads only those hashes to find which of your contacts already use Krll. The raw phone numbers and email addresses never leave your device, and you can decline the contacts permission.
• Activity and rewards: points, in-app cash, levels, donation history, and shop purchases.
• Advertising identifiers: on iOS, if you allow tracking in the App Tracking Transparency prompt, your device's advertising identifier (IDFA) is shared with Google AdMob to personalise the ads shown in the free tier. If you decline, ads are served without it.
• Subscriptions: if you buy Krll Pro, Apple handles payment; we receive a transaction identifier and subscription status, not your card details.
• Device and usage data: device tokens for notifications, platform and app version, last-online time, and aggregated diagnostics.

How we use your data

We use your data to:

• Provide, sync, and maintain Krll across your devices.
• Authenticate you and verify your email or phone.
• Send notifications and service messages you have opted into.
• Run the points, rewards, and ocean-cleanup contribution features.
• Keep the service secure and prevent abuse.
• Fix bugs and improve stability and features.

Krll is free to use with advertising. Users without a Krll Pro subscription see ads served by Google AdMob. Whether those ads are personalised depends on the choice you make in the in-app consent form (and, on iOS, the App Tracking Transparency prompt); you can change it at any time in Settings. We do not sell your personal data.

Marketing emails

If you subscribe to our newsletter on the website, you are added to the list immediately — submitting the form is how you give consent. We store your email address, the time you subscribed, and your IP address as your consent record, and use them only to send you Krll news and launch updates. Every email contains an unsubscribe link, and unsubscribing stops all marketing email immediately. It does not affect account or security emails.

Legal basis for processing

Under the General Data Protection Regulation (GDPR), we process your data on the following bases: performance of a contract (to provide the app you signed up for), your consent (for optional communications, integrations, and non-essential cookies), and our legitimate interests (to secure and improve the service). You may withdraw consent at any time.

Sharing and third parties

We share data only with trusted providers who help us run Krll, and only as needed:

• Hosting: Render.
• File storage: Google Cloud Storage.
• Email delivery: Resend.
• Analytics: Google Analytics for Firebase, used to understand app usage in aggregate.
• Payments and subscriptions: Apple.
• Push notification delivery: Apple (APNs).
• Device calendar: with your permission, Krll reads and writes your device's Apple Calendar (EventKit) to sync your tasks as events. This stays on your device unless you separately connect a cloud calendar such as Google Calendar or Microsoft Outlook.
• Optional integrations you enable, such as Google Calendar, Microsoft Outlook, Google Meet, Zoom, or Microsoft Teams, receive only what is needed to sync.
• Advertising: Google AdMob serves ads in the free tier and, with your consent, personalises them. Your consent choice is collected and stored through Google's User Messaging Platform (UMP).
• Video meetings you create from a task: Google (Meet), Zoom, or Microsoft (Teams) receive the task title and the meeting time to create the meeting. When you connect a meeting account we store the access token you grant, encrypted, so we can create, update, and cancel that meeting on your behalf until you disconnect the account.

These providers act under data-processing agreements. We may also disclose data where required by law. We never sell your personal data.

Data retention

We keep your personal data while your account is active. When you delete your account, we remove or anonymize your data: identifying details are scrubbed so your email, username, and phone free up immediately, and password hashes are not retained. An anonymized record may be kept for up to five years to meet legal, security, and fraud-prevention obligations, after which it is permanently deleted.

Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten") — you can also delete your account directly in the app.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Lodge a complaint with a supervisory authority (in France, the CNIL).

To exercise any of these rights, email contact@krllapp.com.

How we protect your data

We protect your data with encryption in transit, hashed passwords and verification codes, and strict access controls. Shared tasks and their comments are end-to-end encrypted, so we cannot read their contents. Browser pairing: to use Krll on the web, you pair a browser from your phone. Your private encryption key is wrapped for that browser only and relayed through our server in a form we cannot read. You can revoke a paired browser at any time from the app, which invalidates its access. For more detail, see our Security page.

Cookies

On our website we use essential cookies to run the site and, with your consent, optional cookies to understand usage and remember preferences. You can review and change your choices at any time on our Cookie Preferences page.

Children's privacy

Krll is not directed to children under 13 (or the higher minimum age required in your country), and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, email contact@krllapp.com and we will delete it.

International transfers

We process data in the European Union where possible. Some providers — such as Apple, Google, and Resend — may process data outside the EU/EEA; where they do, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "last updated" date above and, where appropriate, notify you.

Contact us

Questions about this Privacy Policy or your data? Email contact@krllapp.com or reach us through our Contact page.