Your privacy matters. This policy explains exactly what data we collect, how it is used, and how you can control it. For data requests or queries: kintsugiutils@gmail.com
1. Who's Behind Kintsugi Utils
Kintsugi Utils is built by a small team based in Hong Kong. We're a personal utility app — calculators, a task list, habits, a focus timer, and an AI diary — and we take privacy seriously because we use the app too. This policy walks you through what we collect, why, and what control you have. We follow the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and the EU/UK GDPR, plus other applicable privacy laws. Got a data question? Email kintsugiutils@gmail.com.
2. What We Collect and Why
We keep data collection to the bare minimum. Here's the full breakdown: • Account info (your email and a hashed password): so you can log in securely. Legal basis: we need it to provide the service you signed up for. • Usage patterns (which features you use, how long, any errors): helps us figure out what's working and what to improve. Legal basis: our legitimate interest in making the app better, or your consent where required. • Analytics (optional, needs your okay): big-picture, anonymous stats like page views. Legal basis: your consent. • Ad data: we show ads on the web app through Google AdSense. Google may collect device data (such as IP address, browser type, and a cookie-based advertising identifier) to serve and measure ads. Legal basis: your consent, which you can manage in Settings → Privacy & Consent or via your browser's cookie controls. • Marketing emails (optional, needs your okay): occasional updates about new features. Legal basis: your consent. • Your content (diary entries, tasks, habits): stored on your device by default. Only goes to our servers if you turn on cloud sync. We don't sell your data. We don't profile you or make automated decisions about you.
3. Ads — The Google Side of Things
We show ads on the web app through Google AdSense, Google's advertising platform. • Google may use cookies and a cookie-based advertising identifier to serve ads based on your prior visits and interests. • You can opt out of personalised advertising at any time via Google's Ads Settings (ads.google.com), your browser's cookie controls, or Settings → Privacy & Consent. • If you're in the EU or UK, we won't serve personalised ads unless you explicitly opt in. • Google, not us, controls the data it collects for advertising. Its privacy practices are explained at policies.google.com/privacy and policies.google.com/technologies/ads. Google acts as an independent data controller for that data. • Third-party vendors and Google may use cookies and device identifiers to measure ad performance and serve relevant ads. You can review and disable these in Google's Ads Settings.
4. Cookies — The Short Version
A few types of cookies are involved: • Essential ones: keep you logged in and the app secure. Can't turn these off. • Analytics ones: anonymous usage stats. Only active if you say yes. • Ad ones: Google AdSense sets cookies to serve and measure ads. These include measurement cookies (e.g. _ga, _gads) and, where you've consented, personalisation cookies. You can block them in your browser or in Google's Ads Settings. • Marketing/preference ones: remember your settings and send you updates. Only active if you say yes. Manage everything in Settings → Privacy & Consent, or use your browser's cookie settings.
5. Where Your Data Lives
Most of what the app stores — your tasks, habits, diary, settings — stays right on your device in your browser's local storage. It doesn't travel anywhere unless you use a feature that needs the network. One feature does: the AI-assist in the Diary. When you use it, the diary text you submit is sent to our AI provider to generate a response. It's sent over an encrypted connection, used only to produce your entry, and isn't used to train models or stored beyond what's needed to fulfil the request. Your other diary entries stay on your device. For your account credentials, data is stored on servers with encryption at rest (AES-256) and in transit (TLS 1.2+). Only a small number of authorised people can access it, and only when there's a real need.
6. How Long We Keep Things
• On your device: stays until you clear it (Settings → Data) or wipe your browser. • Account info: kept while your account is active. Deleted within 30 days after you close your account. • Usage/analytics: anonymised within 90 days; individual event logs gone within 12 months. • Marketing data: kept until you withdraw consent or ask us to delete it. • Ad data: managed by Google per its retention rules (policies.google.com/privacy). Google may retain ad-related data such as cookies for up to 13 months, per its advertising cookies policy.
7. Your Rights — What You Can Do
Under GDPR and PDPO, you've got real power over your data: • See it: ask for a copy of what we hold about you. • Fix it: tell us if something's wrong and we'll correct it. • Delete it: ask us to erase your data ("right to be forgotten"). • Pause it: ask us to stop processing while something gets sorted out. • Take it: get your data in a portable format (Settings → Data has an export tool). • Object: say no to processing based on our legitimate interests. • Take back consent: withdraw any consent you've given, anytime. This doesn't affect anything that happened before you withdrew. Email kintsugiutils@gmail.com to use any of these rights. We'll get back to you within 30 days (PDPO) or one month (GDPR).
8. Who Gets to See Your Data
We only share data with: • Our AI provider — but only the diary text you submit when you use the AI-assist feature, to generate your entry. • Google, for advertising — Google AdSense collects and processes ad-related data (cookies, device identifiers) as an independent data controller. See policies.google.com/privacy. • Service providers (hosting) — they act as our data processors under strict agreements. • Law enforcement — only if legally required. • Ourselves — in anonymised, aggregate form for analytics, and only if you've consented. We never sell, rent, or trade your data. For the full list of sub-processors, see our Data Processing Agreement.
9. Moving Data Across Borders
If you're in the EEA or UK, your data might be processed outside those regions — for example, in Hong Kong or the US. When that happens, we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework to make sure your data stays protected.
10. Kids and the App
Kintsugi Utils isn't made for children under 13 (or 16 in EU countries where that's the age threshold). We verify age on first launch. If we find out we've accidentally collected data from someone younger, we'll delete it promptly. Parents and guardians: reach us at kintsugiutils@gmail.com.
11. We'll Keep This Updated
Privacy laws change, and so might our practices. We'll update the "Last Updated" date whenever we revise this policy. For significant changes, we'll notify you in the app or by email if we have your address.
12. Questions or Complaints
Privacy questions or data requests: kintsugiutils@gmail.com If you're in the EU and we haven't resolved things to your satisfaction, you can complain to your local Data Protection Authority. In Hong Kong, that's the Office of the Privacy Commissioner for Personal Data at pcpd.org.hk. We'd appreciate the chance to fix things first before you escalate — but the choice is yours.