Kiji Privacy Policy
Effective 27 September 2026.
This policy explains what personal data the Kiji app and its sync service collect, why, who else handles it, how long it is kept and what you can do about it. It applies to Kiji on iPhone, iPad and Mac.
1. Who is responsible
The controller of your personal data is Hamdi Jomaa, entrepreneur individuel (EI), a French sole trader, 41 B rue des Roches, 45210 Ferrières-en-Gâtinais, France, SIREN 927 699 579 ("we", "us"). Contact for anything in this policy, including exercising your rights: hamdijomaa.x@gmail.com. We have not appointed a data protection officer, as we are not required to; write to the same address.
2. What we collect and why
| Data | Why | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Account data: an internal random account ID; your email address; your name if you give it or your sign-in provider shares it; which sign-in method you used (Apple, Google, or email and password). A password is stored only as a hash by our hosting provider. | To create your account, sign you in and show your name in the app. | (b) contract |
| Your content: boards, todos, documents, folders, habits and habit entries, home-screen widgets, images and videos you add, your profile picture and profile name. | To store it and sync it between your devices. | (b) contract |
| Plan and purchase records: the product you bought, its price and currency, the App Store storefront (country), purchase, renewal, expiry, refund and revocation dates, and Apple's signed transaction data. Never your payment card details, which only Apple sees. | To unlock the plan you paid for, enforce its storage limit, and keep the accounting records the law requires. | (b) contract; (c) legal obligation for accounting records |
| Device token for notifications: the Apple Push Notification service (APNs) token of each device that allows notifications, the platform, and the app language. | To tell you about billing events (for example a failed renewal) in your language. Reminders you set are scheduled on your device as local notifications and never pass through our servers. | (b) contract |
| Usage analytics (off until you agree in the regions listed under "Analytics choice" below; on by default elsewhere, and you can switch them off at any time): app opened, backgrounded and updated; about 28 product events such as which sign-in method was used, that an item was created or completed and how many, and paywall and purchase steps; device model, OS and app version, language. Linked to your random account ID. Never the text, titles or contents of anything you write. No session recording, no automatic capture of taps or screens. | To understand which features are used and fix what does not work. | (a) consent in the regions where it is required; (f) legitimate interest in improving the product elsewhere — you can object at any time with the switch in Settings › Privacy |
| Purchase lifecycle events: our server sends events about purchases, renewals, cancellations and refunds (product, price, storefront, dates) to our analytics provider, linked to your random account ID. | To measure the business and detect billing problems. | (f) legitimate interest — you can object at any time by writing to us |
| Crash reports: when the app crashes or hits a serious error, a report with the technical error, the code location, device model, OS and app version. Messages are scrubbed of your content. | To find and fix bugs. | (f) legitimate interest in a working app — you can switch this off in Settings › Privacy |
| Support emails: whatever you choose to write to us. | To answer you. | (b) contract or (f) legitimate interest |
We do not collect advertising identifiers, do not track you across other companies' apps or websites, do not use your data for advertising, do not collect your precise location and do not use your content to train any model.
Analytics choice
Whether usage analytics start on or off depends on the country of your App Store account:
- Off until you agree if that country is in the European Union or the European Economic Area, or is the United Kingdom, Switzerland, the Republic of Korea, Brazil, Türkiye, the People's Republic of China, Canada, India, Vietnam, Indonesia or Saudi Arabia. Kiji asks you once; nothing is sent unless you say yes. The legal basis is your consent.
- On by default everywhere else. The legal basis is our legitimate interest in understanding which features are used and fixing what does not work, and you can object at any time.
Wherever you are, you can switch analytics off or on at any time in Settings › Privacy › Share usage analytics. Switching it off stops sending immediately and does not affect what was lawful before. Deleting your account deletes your analytics data. Crash reports have their own switch in the same place and are on by default everywhere.
Data that never leaves your device
- Contacts. If you allow it, Kiji reads only your own contact card ("My Card") to offer its photo as your profile picture. This happens on your device. Nothing from your contacts is uploaded unless you choose that photo as your profile picture, in which case only that photo is uploaded as your avatar.
- Face ID, Touch ID and passcode app lock. Handled entirely by Apple's system on your device. We never receive biometric data.
- Onboarding questionnaire. Your answers stay on your device and are used to prepare your starter content. If you accept the optional starter note, it may mention your answers, and like all your content it is stored in your own private account.
- Reminders are local notifications scheduled on your device.
3. Who else handles your data
We use the following service providers ("processors"). Each is bound by a data processing agreement and may use your data only to provide its service to us.
| Provider | Role | Where the data is |
|---|---|---|
| Supabase, Inc. (USA) | Database, authentication, file storage and server functions for accounts, content, purchase records and device tokens | Servers in the EU (AWS eu-west-1, Ireland). Supabase and its sub-processors may access data from outside the EU for support and operations. |
| PostHog, Inc. (USA) | Usage analytics (with your consent where it is required), purchase lifecycle events and crash reports | PostHog Cloud EU (Frankfurt, Germany) |
| Apple Inc. / Apple Distribution International | Sign in with Apple, App Store payments and subscriptions, push notification delivery, app distribution | Apple's own infrastructure. For payments Apple acts as an independent controller under its own privacy policy. |
| Google LLC / Google Ireland Ltd. | Google Sign-In, if you choose it (scopes: openid, email, profile) | Google's own infrastructure; Google acts under its own privacy policy for your Google account. |
| GitHub, Inc. (USA) | Hosts these legal pages; may log visitors' IP addresses for security | GitHub's infrastructure |
We do not sell, rent or share your personal data with anyone else, except where the law obliges us to (for example a valid court order).
4. International transfers
Your account and content are stored in the European Union. Some providers are US companies and may access data from the United States or other countries. Where personal data leaves the European Economic Area, Switzerland or the United Kingdom, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses, with the UK and Swiss addenda where relevant. You can ask us for a copy of the relevant safeguards.
5. How long we keep it
- Your content and account data: for as long as your account exists. When you delete an item, it is marked as deleted and removed from your devices. 90 days after deletion, its content (titles, text, notes, amounts) is erased from our servers; an empty marker with no content (its identifier, dates and position) is kept so that your other devices learn about the deletion. Deleting your account removes everything, including these markers, immediately (see below).
- Account deletion: when you delete your account, your account, content, files, profile picture, device tokens and Sign in with Apple grant are removed immediately, and your analytics profile is deleted. Encrypted backups kept by our hosting provider are overwritten within 30 days.
- Purchase and transaction records: kept for up to 10 years after the transaction, as French accounting and tax law requires, but unlinked from your account when you delete it: your account identifier is removed from them.
- Analytics and crash reports: kept by PostHog for as long as needed for the purposes above and at most as long as your account exists, unless earlier deleted.
- Support emails: as long as needed to handle your request, then deleted within 3 years of our last exchange.
6. Your rights
Depending on where you live, and in any case if you are in the EU, the EEA, the UK or Switzerland, you have the right to:
- access your data and get a copy of it;
- export it (portability): in the app, Settings › Export my data produces a file (JSON) with your content and account data;
- rectify it: most of it you can edit in the app directly;
- erase it: in the app, Settings › Account › Delete Account deletes your account and everything in it; or write to us from your account's email address;
- restrict or object to processing based on legitimate interest, including crash reports, purchase lifecycle events and, where they are on by default, usage analytics (the switch in Settings › Privacy does this at once);
- withdraw consent to analytics at any time in Settings › Privacy, without affecting what was done before;
- not to be subject to decisions based solely on automated processing — we make none.
Write to hamdijomaa.x@gmail.com. We answer within one month (extendable by two months for complex requests, in which case we tell you). We may ask you to confirm you control the account.
You may also lodge a complaint with a supervisory authority: in France the CNIL (www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or the authority of the country where you live or work.
7. Children
Kiji is not directed to children under 13, and in EU countries where local law sets a higher age for consent to online services (up to 16), not to children under that age without a parent's consent. We do not knowingly collect data from such children. If you believe a child has given us data, write to us and we will delete it.
8. Security
Data travels encrypted (TLS). Your content is protected by row-level access rules so that only your account can read it; images and videos are in a private storage area only your account can reach. Profile pictures are readable by anyone who has their exact web address, which is built from your random account ID and is not published anywhere; the list of pictures cannot be browsed. Server access is limited to us. No system is perfectly secure; if a breach is likely to put your rights at risk we will notify you and the authorities as the law requires.
9. California (CCPA / CPRA)
In the last 12 months we collected these categories of personal information: identifiers (email, account ID, device token); commercial information (purchase records); internet or other electronic network activity (usage analytics, crash reports); and the content you create. Sources: you, your device, Apple and Google. Purposes and retention are described above.
We do not sell and do not share personal information (as "share" is defined for cross-context behavioural advertising), do not use it for targeted advertising, and do not use or disclose sensitive personal information beyond what is needed to provide the service. Usage analytics are used only to improve Kiji, never for advertising; you can opt out of them at any time with the switch in Settings › Privacy › Share usage analytics, which stops sending immediately. California residents have the right to know, access, correct and delete their personal information and not to be discriminated against for exercising these rights. Send requests to the email above; you may use an authorised agent. The same applies to residents of other US states with similar laws.
10. Republic of Korea (PIPA): transfer of personal information abroad
To provide the service, personal information is transferred abroad as follows. The transfer takes place over the network when you use the app.
| Recipient (country) | Items transferred | Purpose | Retention |
|---|---|---|---|
| Supabase, Inc. (servers in Ireland, EU; company in the USA) | Account data, content, purchase records, device token | Hosting, authentication and sync | Until account deletion (transaction records up to 10 years) |
| PostHog, Inc. (servers in Germany, EU; company in the USA) | Account ID, usage events (with consent), purchase events, crash reports, device model, OS, app version | Analytics and error diagnosis | Until account deletion or withdrawal of consent |
| Apple Inc. (USA) | Sign-in and purchase data, device token | Sign-in, payment, notifications | Under Apple's policy |
| Google LLC (USA) | Sign-in data, if you use Google Sign-In | Sign-in | Under Google's policy |
You may refuse this transfer by not using the service or by deleting your account (Settings › Account › Delete Account); since the transfer is needed to provide the service, refusing means the service cannot be used. Analytics can be refused separately in Settings › Privacy. Contact for personal information matters: Hamdi Jomaa, hamdijomaa.x@gmail.com.
11. Your region
If you are in Brazil (LGPD), India (DPDP Act), the People's Republic of China (PIPL), Japan (APPI), Türkiye (KVKK), Switzerland (nFADP), Canada (PIPEDA), Vietnam (Personal Data Protection Law), Indonesia (PDP Law), Saudi Arabia (PDPL) or another country with a data protection law, you have the rights that law gives you — typically access, correction, deletion, portability, withdrawal of consent and complaint to your data protection authority — and you can exercise them as described in section 6. Transfers of your data abroad are made on the bases described in sections 3 and 4 (EU hosting, and Standard Contractual Clauses or equivalent safeguards for providers outside it); by using the service you are informed of the recipients, purposes and data concerned as listed in sections 3 and 10.
In the European Union and the European Economic Area, the United Kingdom, Switzerland, the Republic of Korea, Brazil, Türkiye, the People's Republic of China, Canada, India, Vietnam, Indonesia and Saudi Arabia (going by the country of your App Store account), usage analytics stay off until you agree to them. Everywhere else they are on by default and you can switch them off at any time in Settings › Privacy › Share usage analytics.
12. Changes
We may update this policy. The effective date at the top shows the current version. If a change materially affects how we use your data, we will tell you in the app before it takes effect and, where required, ask for your consent again.
13. Languages
This policy is available in several languages at https://hamdij0maa.github.io/kiji-legal/. If versions differ, the English version prevails, except where the law of your country requires otherwise.
Contact
Hamdi Jomaa, entrepreneur individuel (EI)
41 B rue des Roches
45210 Ferrières-en-Gâtinais, France
SIREN 927 699 579
hamdijomaa.x@gmail.com