Privacy Policy

Kiritsu ("Kiritsu", "we", "us") is a personal productivity and focus application operated by Kiritsu. This policy explains what we collect, why, and the choices you have. It applies to the Kiritsu website and app.

Account information. When you sign in with GitHub or Google, we receive your name, email address, and profile picture from that provider. We never see or store your password.

Content you create. The data you enter to use the product: tasks, routines, journeys, capstones, habits, daily check-ins (including the sleep hours and mood you log), focus sessions, and the statistics derived from them.

Payment information. Paid plans are processed by Stripe. We do not receive or store your card number: only a Stripe customer/subscription identifier and your current plan status. Your card details are handled entirely by Stripe under their privacy policy.

Spotify connection (optional). If you connect Spotify, we store an encrypted access/refresh token and basic profile data (your Spotify user id, display name, and plan tier) solely to play your music in the app. We never receive your Spotify password, and you can disconnect at any time. The refresh token is encrypted at rest.

Technical data. An essential, first-party cookie that keeps you signed in, plus standard server logs (such as request metadata) used to operate and secure the service.

We use your information only to provide and improve the product for you: to run your account, store and display your data, process subscriptions, enable the Spotify feature you opt into, and keep the service secure. We do not sell your data, show advertising, or use third-party tracking or analytics for ad profiling.

We use a single essential cookie to maintain your login session. We do not use advertising or cross-site tracking cookies. During the payment or Spotify connection flows, Stripe and Spotify may set their own cookies on their domains, governed by their respective policies.

To run Kiritsu we rely on a small number of trusted providers:

• Vercel: application hosting & content delivery
• Supabase: database (where your content is stored)
• Stripe: subscription payments
• Google & GitHub: sign-in (whichever you choose)
• Spotify: music playback, only if you connect it

These providers process data on our behalf under their own terms and security commitments. We share data with them only as needed to run the service, and never sell it.

We keep your data for as long as your account is active. When you delete your account, your data is permanently removed and any active subscription is cancelled. Backups and logs are cycled out on a rolling basis.

• Export. Download everything as JSON anytime from Settings → Your data.
• Deletion. Delete your account and all associated data from Settings → Danger zone.
• Access & correction. Most data is directly viewable and editable in the app; contact us for anything else.

Depending on where you live, under the LGPD in Brazil, the GDPR in the EU/UK, or the CCPA in California, among others, you may have additional rights over your personal data. To exercise any of them, contact us at contact@kiritsu.app.

Kiritsu is operated from Brazil, and we act as the data “controller” (controlador) under the Lei Geral de Proteção de Dados (Law No. 13.709/2018). We process your personal data on lawful bases such as performing our contract with you (running your account), your consent (for optional features like Spotify), and our legitimate interest in operating and securing the service.

Under the LGPD you may, at any time and free of charge, ask us to:

• confirm that we process your data, and access it;
• correct incomplete, inaccurate, or outdated data;
• anonymize, block, or delete unnecessary or excessive data;
• port your data to another provider (the JSON export helps with this);
• delete data we process based on your consent;
• learn with whom we have shared your data;
• withdraw consent, and be told the consequences of doing so.

To make a request, email contact@kiritsu.app. You may also lodge a complaint with Brazil’s data protection authority, the ANPD (Autoridade Nacional de Proteção de Dados).

All traffic is served over HTTPS, and sensitive credentials such as your Spotify refresh token are encrypted at rest. No system is perfectly secure, but we take reasonable measures to protect your data and limit access to it.

Our providers may process and store data in the United States and other countries. Where required, we rely on appropriate safeguards for such transfers. By using Kiritsu you understand your data may be processed outside your country of residence.

Kiritsu is not directed to children under 16, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the product evolves. We'll revise the "Effective" date above and, for material changes, provide a more prominent notice.

Questions or requests? Reach us at contact@kiritsu.app.