Privacy policy

Who processes the data

The controller of personal data is Jan Kadlec, [address – to be completed], company ID (IČO) [to be completed]. Contact for questions about personal data: [e-mail – to be completed].

Buduji se is a diary. Only you see your entries. Your employer won't see them, even if they give you the app as a benefit: there is no view for employers or administrators.

Without and with an account

The app also works without an account. Then all your entries are only on your device (your phone or your browser) and we have no access to them.

When you sign in and explicitly agree to it, your entries sync to our server in the EU, so they are backed up and available on your other devices too. Without your consent nothing is sent to the server. We run the server ourselves (Coolify) with netcup GmbH, in a data centre in Nuremberg, Germany. The connection to the server is encrypted (HTTPS).

What data and why

Diary entries: priorities, what went well, thoughts, the colour of the day, the day split, habits, plans and challenges. They serve only to make the diary work. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). Because the diary also contains health data (sleep and the half-year check-in), we sync it to the server only with your explicit consent (Art. 9(2)(a)). The server records when you agreed and to which version of the text.

Sleep: the times you fell asleep and woke up, typed in or read from Health Connect or Apple Health. This is health data (Art. 9 GDPR). We read it from your phone only with your explicit consent, and it reaches the server only with your consent to sync (Art. 9(2)(a)). The app reads no other health data. You can withdraw both consents at any time in Settings.

Half-year check-in: answers to five well-being questions (WHO-5) and a note. We treat them as health data: they reach the server only with your consent to sync (Art. 9(2)(a)).

Account: your e-mail, your name if Google or Apple sends it, and your account identifier at Google or Apple. Used for signing in and syncing.

Calendar: only with your consent (Art. 6(1)(a)). The app reads the titles, starts and ends of one day's events to suggest your work hours. It does not read descriptions, places or attendees. It remembers corrections you make only as a short code of the title, not as text.

Office (mobile app only): off by default, turned on only with your consent (Art. 6(1)(a)) and with permission to use location in the background. The phone stores one place you mark as your office, a radius around it, and the times you entered and left that radius. The app stores no other places and no routes. This data is not sent to our server or anyone else and does not sync. In the evening the app suggests work hours from it; they go into the diary only when you confirm them, and are then treated like work hours you typed in yourself. Location is determined by the phone's operating system (Android through Google Play services, iPhone through Apple's services) according to its own settings.

Server technical logs: the request's method and address, the result and how long it took, without the content of entries. [To be completed: whether and for how long IP addresses are kept in the reverse proxy.]

Who we share data with

netcup GmbH (Germany, data centre in Nuremberg): running the server. It processes data only on our instructions. [To be completed: the processing agreement under Art. 28 and where the backups are.]

OpenRouter (USA) and the AI model providers OpenRouter passes the request to: only when splitting the day by your calendar, and only with your consent. They get the titles and times of one day's events, nothing else. We choose only providers that do not keep the data or train on it. They may run outside the EU. [To be completed: the legal mechanism for transfers outside the EU, e.g. standard contractual clauses or the EU-US Data Privacy Framework.]

Google: signing in with Google, and Google Calendar. The app reads the calendar directly from your device, with the permission you give Google.

Apple: signing in with Apple. Apple Health data stays on your phone; the app takes from it only the sleep times it saves to your diary.

We do not sell data or use it for advertising.

How long

We keep your entries for as long as you have an account. Deleting your account in Settings deletes the account and all your entries on the server. They disappear from backups within [14–30] days at the latest.

If you withdraw your consent to sync, sync stops on all your devices and you choose whether we delete the copy on the server right away or keep it there until you delete your account. [For legal review: whether the copy may stay on the server after consent is withdrawn.]

We do not store calendar events at all. A sign-in expires after 90 days; then you just sign in again.

The phone keeps your office arrival and departure times for 14 days. Turning the office off in Settings deletes the office location and the whole history.

Without an account, only you have the data, on your device. You delete it by uninstalling the app or clearing your browser data.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability and to object. You can export all your data in Settings, and delete your account there too.

You can withdraw your consent for sync, sleep, calendar or office at any time in Settings. Withdrawing does not affect processing that happened before.

You can lodge a complaint with the Czech data protection authority, Úřad pro ochranu osobních údajů (uoou.gov.cz).

The AI only sorts events into work and personal. This has no legal effects on you, and you can correct every classification.

Contact and changes

Send questions and requests to [e-mail – to be completed]. If this policy changes, you will find out in the app.