Privacy Policy

1. Controller

Alexander Schauff, Mühlenstr. 223a, 41236 Mönchengladbach, Germany.
Email: hello@commitme.io

We have not appointed a data protection officer, because we are not required to under Art. 37 GDPR and § 38 BDSG.

2. At a glance

CommitMe stores the goals, habits and completions you create, so that it can show them back to you and to the crew members you choose to share them with. We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models.

3. Data we process

• Account: email address and a hashed password.
• Profile: display name, username, optional avatar image, optional bio and title, and your timezone, which is detected from your browser so that days start and end at the right time for you.
• Your content: goals, milestones, habits, completion records, streaks and absence periods.
• Crews: which crews you belong to, which habits you have chosen to share with them, and reactions and nudges exchanged with other members.
• Coach conversations: the messages you send to the planner and the weekly reflection, and the responses. These are stored so a conversation can be continued and looked at again later. There is currently no button to delete a single conversation; email us and we will remove it.
• Notifications: if you enable push notifications, a device subscription identifier.
• Server logs: see section 5.

Providing this data is not a legal requirement, but an email address and a password are needed to create an account, and without an account the service cannot be used. Everything else, including your avatar, bio, crews and push notifications, is optional.

4. Legal bases

• Art. 6(1)(b) GDPR, performance of a contract: everything needed to operate your account and provide the service, including the coach.
• Art. 6(1)(a) GDPR, consent: push notifications. You can withdraw this at any time, in your device settings or your profile, with effect for the future. Withdrawing does not affect the lawfulness of what was processed before.
• Art. 6(1)(f) GDPR, legitimate interests: keeping the service secure and available, server logs, and measuring aggregate usage of our public pages.

5. Hosting, server logs and encryption

The site and the application run on a server rented from Contabo GmbH, Munich, and located in Germany. Contabo acts as a processor on our behalf.

Our web server automatically records a log entry for each request: IP address, date and time, the resource requested, the HTTP status, the referring page and your browser's user agent. This happens before any account exists and cannot be switched off; it is what allows us to run the server, detect abuse and investigate faults. The legal basis is Art. 6(1)(f) GDPR. These logs are rotated and deleted after 14 days.

The site uses TLS encryption, recognisable by https:// in the address bar. Data you send us cannot be read by third parties in transit.

6. Cookies and local storage

We do not use tracking or advertising cookies, and there is no consent banner because there is nothing to consent to. What we do set:

• Authentication cookies (names beginning sb-), set by Supabase to keep you signed in. They are removed when you sign out.
• Local storage in your browser, holding whether you have dismissed the "install this app" prompt and how many times you have visited. This never leaves your device.

These are necessary for the service to work, on the basis of Art. 6(1)(f) GDPR.

7. Analytics, on the public pages only

On our public pages, not inside the app, we measure reach with Umami, open-source software we host ourselves on our own server in Germany. It records page views, referrer, approximate region derived from the IP address, and which of our buttons was clicked. It sets no cookies, stores no IP address, and builds no profile across sites, which is why no consent is required. Legal basis is Art. 6(1)(f) GDPR, our interest in knowing whether the site works. The data is aggregate and stays on our server.

8. The coach, and what it does not decide

The coach is a large language model. When you talk to it, the content of that conversation, together with the goals and habits needed for it to answer usefully, is sent to Anthropic to generate a response.

It suggests. It does not decide anything about you. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR: nothing the coach produces has legal effect or similarly significantly affects you, and nothing about your account changes unless you act on a suggestion yourself.

9. Recipients and processors

We pass data to the following providers, each acting as a processor on our behalf under Art. 28 GDPR, and only to the extent needed to run the service:

• Supabase, database, authentication and file storage.
• Anthropic, the model behind the coach, as described in section 8.
• Resend, transactional email such as verification and account messages.
• OneSignal, delivery of push notifications, if you enable them.
• Contabo, server hosting in Germany.

Beyond these, we do not share your data. What you choose to share with a crew is visible to the members of that crew, which is the point of a crew, and we cannot control what those people do with what they see.

10. International transfers

Some of the providers above process data outside the European Economic Area, in particular in the United States. Where that happens, transfers are covered by the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR or by an adequacy decision under Art. 45 GDPR.

11. How long we keep things

• Server logs: 14 days, then deleted automatically.
• Account, profile, goals, habits, completions, crews and coach conversations: for as long as your account exists. Delete a habit or a goal in the app and it is removed at once.
• After account deletion: removed, except where a statutory retention period requires us to keep a record, in which case that data is restricted rather than used.
• Analytics: aggregate figures only, not tied to you.

12. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• have processing restricted (Art. 18);
• receive your data in a portable format (Art. 20);
• withdraw consent at any time, with effect for the future (Art. 7(3)).

To exercise any of these, email hello@commitme.io. We answer within one month.

13. Your right to object

Where we process your data on the basis of a legitimate interest under Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, under Art. 21(1) GDPR. If you object, we will stop processing that data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

An objection is free and needs no particular form. Send it to hello@commitme.io.

14. Right to lodge a complaint

You may complain to a supervisory authority, in particular in the member state of your residence, place of work, or the place of the alleged infringement. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf.

15. Changes

We may update this policy as the service changes. The date at the top shows when it was last revised.