Privacy Policy
Effective Date: 2026-06-16
Last Updated: 2026-08-01
1. Data Controller
Kitlo ("we", "us", "our") operates the Kitlo mobile application.
Entity: Kitlo
Contact: privacy@kitlo.app
2. Data We Collect
| Data Type | Purpose | Retention |
|---|---|---|
| Email address | Account authentication | Until account deletion |
| Password (hashed) | Authentication | Until account deletion |
| Gear inventory (items, brands, models) | Core app functionality | Until account deletion |
| Activity records (date, distance, gear used) | Core app functionality | Until account deletion |
| Device identifiers | Crash reporting (Sentry) | 90 days |
| Usage analytics (anonymized) | Product improvement (PostHog) | 12 months |
Optional Third-Party Data
When you explicitly connect these services:
- Strava: Activity data (distance, duration, route) synced to enrich your gear tracking.
- Apple Health / Google Health Connect: Activity metrics (distance, duration) imported for gear usage correlation.
Managing your Strava connection. You control Strava sync at three levels:
- Pause Sync stops importing new activities while keeping your existing activities and gear history. Your Strava authorization stays active and you can resume at any time.
- Disconnect & Remove revokes Kitlo's access at Strava and deletes the activities imported from Strava, including their source details (Strava activity ID, route, name, date, distance). Gear mileage and condition derived from those activities are recalculated accordingly, and we confirm completion in the app.
- Delete Account removes your entire Kitlo account and all associated data.
If you revoke Kitlo's access from Strava directly, we treat it the same as Disconnect & Remove and delete your Strava-imported data on our side. Activities you recorded manually or imported from another source are not affected.
3. How We Use Your Data
- Provide and maintain the Kitlo service
- Track gear usage and condition over time
- Send transactional emails (password reset, verification)
- Diagnose crashes and improve app stability (Sentry)
- Understand aggregate usage patterns (PostHog, anonymized)
4. Data Storage & Processing
- Primary application infrastructure: Supabase (Europe region - Ireland)
- Crash reporting: Sentry (EU data residency)
- Analytics: PostHog (EU Cloud)
We select European hosting regions for our primary application and supporting services where available. Personal data may also be processed in other countries when you use an optional integration or when a service provider uses approved subprocessors.
Where personal data is transferred internationally, we use a lawful transfer mechanism where required, such as an adequacy decision, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another legally recognized safeguard.
5. Third-Party Processors
| Processor | Purpose | Privacy Policy |
|---|---|---|
| Supabase | Database, authentication, storage | https://supabase.com/privacy |
| Sentry | Error monitoring | https://sentry.io/privacy/ |
| PostHog | Product analytics | https://posthog.com/privacy |
| Strava (optional) | Activity sync | https://www.strava.com/legal/privacy |
| Apple (optional) | HealthKit data | https://www.apple.com/privacy/ |
| Google (optional) | Health Connect data | https://policies.google.com/privacy |
6. Your Privacy Rights
Depending on where you live and subject to applicable law, you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Delete your account and all associated data
- Export your data in a portable format
- Object to processing based on legitimate interest
- Restrict certain processing
- Withdraw consent for optional integrations at any time
- Appeal a decision we make about a privacy request, where applicable
These rights include rights available under the EU GDPR, UK GDPR, and applicable United States state privacy laws. To exercise a right, contact privacy@kitlo.app. We may need to verify your identity before completing a request.
7. Data Retention
- Account data is retained until you delete your account
- Activities imported from Strava are deleted when you Disconnect & Remove Strava or revoke Kitlo's access at Strava, and their derived gear metrics are recalculated
- Crash reports are retained for 90 days
- Analytics data is retained for 12 months in anonymized form
8. United States Residents
Residents of California and certain other United States states may have additional rights under applicable state privacy laws, including:
- Right to Know: What personal information we collect and how we use it
- Right to Delete: Request deletion of your personal information
- Right to Correct: Request correction of inaccurate personal information
- Right to Opt-Out: We do not sell personal information or share it for cross-context behavioral advertising
- Non-Discrimination: We will not discriminate against you for exercising your rights
Some rights apply only when statutory eligibility or business thresholds are met. You may contact privacy@kitlo.app to submit a request or ask which rights apply to you.
9. Children's Privacy
Kitlo is not directed at children under 16. We do not knowingly collect personal information from children under 16.
10. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes via email or in-app notification.
11. Contact
For privacy inquiries: privacy@kitlo.app