Privacy Policy

The controller responsible for data processing is:

Jan Lennard Klein, Am Mergelgarten 4, 61440 Oberursel (Taunus), Germany. Contact: support@trykata.app.

We have not appointed a data protection officer; we are not legally required to.

Depending on how you use the app, we process:

• Account data: your email address and authentication details (via Supabase Auth).
• Profile data: display name, optional username and optional profile picture.
• Habit & check-in data: the habits you create, completions, streaks, and your daily check-in notes.
• Photos: your daily check-in photos and profile picture, stored privately and served only through short-lived signed URLs.
• Alarms and sleep rhythm: the alarms you set and, if enabled, your bedtime and morning reminder. These settings stay on your device.
• Social data: friend requests and friendships, and — for check-ins you choose to share — the reactions and comments exchanged with your friends.
• Moderation data: reports you submit and users you block, so we can act on abuse.
• Notification token: if you enable reminders, a token used to deliver notifications.
• Technical data: the logs needed to operate and secure the service.

We do not ask for or store your phone number, and we do not read your address book — see “Contacts” below.

Check-ins are private by default. A check-in is only visible to others if you switch on “Share with friends” for that check-in, and only to people whose friend request you accepted (or who accepted yours). This is enforced on the server, not just in the app.

Friends can then see that check-in's photo and note and can react and comment. Deleting the check-in removes it, along with its reactions and comments, for everyone.

Blocking a person hides your content from them and theirs from you.

If you invite someone from your contacts, the app opens your device's system contact picker. Only the single contact you select is passed to the app, and it is used solely to pre-fill an invitation message that you send yourself.

Your address book is never read in full, never transmitted to us, and never stored — there is no matching of your contacts against our users.

We process your data to provide the app's core features (Art. 6 (1)(b) GDPR — performance of a contract), to keep the service secure and reliable (Art. 6 (1)(f) — legitimate interest), and, where required, based on your consent (Art. 6 (1)(a)), e.g. for notifications.

Sharing a check-in with friends happens on your instruction — you decide per check-in.

Processing reports and blocks is based on our legitimate interest in keeping the service free of abusive content (Art. 6 (1)(f)).

We use the following service providers as processors under Art. 28 GDPR:

• Supabase (database, authentication, file storage) — EU region.
• Expo / EAS (app builds and update delivery).
• Apple (App Store distribution and push notification delivery).
• Sentry (crash and error reporting, EU region) — diagnostics only, no personal content.

Where a provider processes data outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

We keep your data for as long as your account exists. When you delete your account, your profile, habits, check-ins, photos, friendships, reactions and comments are deleted, subject to any legal retention obligations.

Reports about content are kept for up to 12 months after they are resolved, so that repeated abuse can be recognised. They contain the reporting account and the reported item, not your other data.

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and to object to processing. Where processing is based on consent, you may withdraw it at any time with effect for the future.

You can delete your account and associated data directly in the app under Settings.

You also have the right to lodge a complaint with a supervisory authority. Ours is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.

Because Kata has social features, it is not intended for anyone under 13, or under the higher minimum age required in your country (in Germany, users under 16 need consent from a parent or guardian).

We do not knowingly collect data from children below that age — if you believe we have, contact us and we will delete it.

For any privacy request, contact: support@trykata.app.