Privacy Policy
Effective Date: 2026-06-16
Last Updated: 2026-07-16
1. Data Controller
Kitlo ("we", "us", "our") operates the Kitlo mobile application.
Entity: Kitlo
Contact: privacy@kitlo.app
2. Data We Collect
| Data Type | Purpose | Retention |
|---|---|---|
| Email address | Account authentication | Until account deletion |
| Password (hashed) | Authentication | Until account deletion |
| Gear inventory (items, brands, models) | Core app functionality | Until account deletion |
| Activity records (date, distance, gear used) | Core app functionality | Until account deletion |
| Device identifiers | Crash reporting (Sentry) | 90 days |
| Usage analytics (anonymized) | Product improvement (PostHog) | 12 months |
Optional Third-Party Data
When you explicitly connect these services:
- Strava: Activity data (distance, duration, route) synced to enrich your gear tracking.
- Apple Health / Google Health Connect: Activity metrics (distance, duration) imported for gear usage correlation.
3. How We Use Your Data
- Provide and maintain the Kitlo service
- Track gear usage and condition over time
- Send transactional emails (password reset, verification)
- Diagnose crashes and improve app stability (Sentry)
- Understand aggregate usage patterns (PostHog, anonymized)
4. Data Storage & Processing
- Primary application infrastructure: Supabase (Europe region - Ireland)
- Crash reporting: Sentry (EU data residency)
- Analytics: PostHog (EU Cloud)
We select European hosting regions for our primary application and supporting services where available. Personal data may also be processed in other countries when you use an optional integration or when a service provider uses approved subprocessors.
Where personal data is transferred internationally, we use a lawful transfer mechanism where required, such as an adequacy decision, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another legally recognized safeguard.
5. Third-Party Processors
| Processor | Purpose | Privacy Policy |
|---|---|---|
| Supabase | Database, authentication, storage | https://supabase.com/privacy |
| Sentry | Error monitoring | https://sentry.io/privacy/ |
| PostHog | Product analytics | https://posthog.com/privacy |
| Strava (optional) | Activity sync | https://www.strava.com/legal/privacy |
| Apple (optional) | HealthKit data | https://www.apple.com/privacy/ |
| Google (optional) | Health Connect data | https://policies.google.com/privacy |
6. Your Privacy Rights
Depending on where you live and subject to applicable law, you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Delete your account and all associated data
- Export your data in a portable format
- Object to processing based on legitimate interest
- Restrict certain processing
- Withdraw consent for optional integrations at any time
- Appeal a decision we make about a privacy request, where applicable
These rights include rights available under the EU GDPR, UK GDPR, and applicable United States state privacy laws. To exercise a right, contact privacy@kitlo.app. We may need to verify your identity before completing a request.
7. Data Retention
- Account data is retained until you delete your account
- Crash reports are retained for 90 days
- Analytics data is retained for 12 months in anonymized form
8. United States Residents
Residents of California and certain other United States states may have additional rights under applicable state privacy laws, including:
- Right to Know: What personal information we collect and how we use it
- Right to Delete: Request deletion of your personal information
- Right to Correct: Request correction of inaccurate personal information
- Right to Opt-Out: We do not sell personal information or share it for cross-context behavioral advertising
- Non-Discrimination: We will not discriminate against you for exercising your rights
Some rights apply only when statutory eligibility or business thresholds are met. You may contact privacy@kitlo.app to submit a request or ask which rights apply to you.
9. Children's Privacy
Kitlo is not directed at children under 16. We do not knowingly collect personal information from children under 16.
10. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes via email or in-app notification.
11. Contact
For privacy inquiries: privacy@kitlo.app