Privacy

Who is responsible

Jatkuu is operated by a private individual in Germany (full provider details are published before the public launch). You can reach us at hello@jatkuu.com for anything related to your data. This notice explains what Jatkuu stores, where, for how long, and which rights you have under the General Data Protection Regulation (GDPR).

How Jatkuu works

Jatkuu has no accounts, no passwords and no email sign-up. When you open Jatkuu for the first time, your device creates a cryptographic key pair. The public key identifies you in a room; the private key stays on your device and signs every change you make. A 12 word recovery phrase lets you restore that identity on a new phone. We never see your recovery phrase or your private key.

A room is a private space that you share with the people you invite. Everything in a room is visible to every member of that room.

What we store

For each member of a room, the room stores:

• Display name, avatar (emoji), color and timezone that you choose
• Habits and their schedules, and your check-ins (done, partial, skipped) with the reasons you record
• Mood entries
• Pings and reactions you send or receive
• Weekly insights, if you have turned that feature on
• Push subscriptions (the device endpoint your browser issues for notifications), if you have turned notifications on
• Your public key
• Optional: a recovery email address and a sealed copy of your identity key, only if you add one under Settings, Recovery. We use them for one purpose, sending you a recovery link when you ask for one, and delete both the moment you remove the email. Because the copy is sealed with a key we hold, adding an email means we could technically restore your identity; we only ever do so through a link sent to that address, and every recovery is logged.

What we do not store

• No name beyond the display name you pick, no email address (unless you add a recovery email, see above), no phone number, no password
• No private key and no recovery phrase
• No advertising identifiers, no device fingerprint

Connection data

Your IP address is processed technically to deliver the service and to limit abuse (for example rate limits on joining a room). It is not stored together with your room data.

Rooms are shared

Everything listed above is shared with all members of the room. Anyone who has the room link can join the room and see its contents. Please only share links with people you trust. Who is in a room is always visible in Settings.

Where your data is stored

Jatkuu runs on Cloudflare (Workers and Durable Objects). Each room is stored in its own database with a location preference for the European Union. Data is encrypted at rest. The room secret is carried only in the fragment of the room link (the part after #), so it is never sent to our servers in a request path and never appears in server logs.

Your device keeps a local copy of your rooms so Jatkuu works offline. That copy stays in your browser storage until you delete it or remove Jatkuu.

Processors

We use one processor who handles data on our behalf under a data processing agreement:

• Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA: hosting, storage and delivery of Jatkuu, and the optional AI features, which run on Cloudflare Workers AI on Cloudflare's own infrastructure. No other company receives your data. Transfers to the United States are covered by the EU standard contractual clauses included in Cloudflare's data processing addendum.

Bot check when a room is created

When a new room is registered, Cloudflare Turnstile checks that the request comes from a browser and not from a script. It runs invisibly, evaluates technical signals of the browser and may store a short-lived cookie on Cloudflare's own domain (challenges.cloudflare.com) for that purpose. We only learn whether the check passed. Legal basis: our legitimate interest in keeping the service free of automated abuse (Art. 6(1)(f) GDPR).

Optional AI features

Jatkuu can suggest habits from a goal, suggest reasons, and write a short weekly insight. These features are off until you turn them on, and you can turn them off again in Settings at any time.

When you use them, our server sends to the AI model, which runs on Cloudflare Workers AI and not at any other provider: habit titles and schedules, aggregate counts (for example how often a habit was done per weekday), mood values and the free-text reasons you typed. We never send display names, room ids, member ids or exact timestamps. Please keep that in mind when you type free-text reasons. Cloudflare processes each request to produce the answer and does not use it to train models.

Push notifications

Notifications are off until you allow them. If you do, your browser issues a push subscription (a device endpoint) that we store in the room so we can send reminders, activity digests, pings and celebrations. Notification content is limited to what a room member can already see. You can revoke notifications in Settings or in your browser settings; we then delete the subscription.

Legal bases

• Providing the service, including syncing rooms between members and storing your habits: Art. 6(1)(b) GDPR (performance of a contract).
• Push notifications: Art. 6(1)(a) GDPR (consent). Revocable in Settings.
• AI features: Art. 6(1)(a) GDPR (consent). Revocable in Settings.
• Abuse prevention and technical delivery (for example rate limits): Art. 6(1)(f) GDPR (legitimate interest in running a secure service).

How long we keep data

We keep your data for as long as you are a member of a room. You can delete it yourself at any time in Settings:

• “Delete my data in this room” deletes your check-ins, moods, pings, reactions, push subscriptions and public key. A placeholder member named “Former member” remains so shared history stays consistent for the others.
• “Delete room” (room admin) destroys the whole room for every member.

Export

“Export my data” in Settings downloads everything Jatkuu holds about you in a room as a JSON file. This is how we fulfil your right to data portability.

No cookies, no tracking

Jatkuu sets no cookies and uses no analytics or advertising SDKs. To keep Jatkuu fast we may collect anonymous performance samples (page timing values such as how long the first paint took). These samples contain no identifiers and cannot be linked to you or your room.

Your rights

Under the GDPR you have the right to:

• Access the data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, with effect for the future (Art. 7(3))

How to exercise your rights

Access, erasure and portability are built into Settings and work without contacting us. For everything else, or if something does not work, write to hello@jatkuu.com. Because Jatkuu has no accounts, please include your member id or room id (shown in Settings) so we can find your data. We answer within 30 days.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, https://www.datenschutz-berlin.de.

Children

Jatkuu is not directed at persons under 16 years of age. If you are under 16, please do not use Jatkuu. If you believe a child has created an identity in Jatkuu, contact us and we will delete the data.

Changes to this notice

We update this notice when Jatkuu changes in a way that affects your data. The date at the top tells you when it was last changed. Substantial changes are announced inside Jatkuu.