Privacy notice

Who we are

Getrid decides how your data is used: it is the data controller under KVKK and the GDPR. There is no advertising and no trade in data behind it.

Write to [email protected] about anything on this page.

What we keep

• Your account: your username, e-mail address and password. The password is kept only as a one-way hash; nobody can read it back.
• What you write: the titles and notes of your items, project goals and weekly review notes. They are stored encrypted.
• The names that organise them: buckets, tags, places, areas, project and flow names, the people you wait on. They are stored unencrypted, so they can be searched.
• Your settings and history: the name you show, your language, time zone and day plan, and a record of the changes to your items, so you can undo and look back.
• Your consent record: which version of the terms you accepted and of this notice you were shown, when and in which language.
• If you turn notifications on: the address your browser's push service gave this device.
• Technical data: your IP address and the time of each request, to limit sign-in attempts and to find faults.

If you set up your system as a guest, what you enter is kept in the server's memory for at most 24 hours. It moves into your account when you sign up and is dropped if you do not.

Why, and on what legal basis

• To run the service you signed up for: store your lists, show them and keep your devices in step, send the e-mails your account needs (confirming your address, choosing a new password) and the notifications you turned on. Legal basis: the contract between us (KVKK art. 5(2)(c), GDPR art. 6(1)(b)).
• To keep the service safe: limit sign-in attempts, stop abuse, find faults. Legal basis: our legitimate interest (KVKK art. 5(2)(f), GDPR art. 6(1)(f)).
• To meet a legal obligation, if one arises (KVKK art. 5(2)(ç), GDPR art. 6(1)(c)).

We do nothing else with your data, so we ask no consent for anything else: no advertising, no selling or renting of data, no profiling, no marketing e-mails.

Who else handles it

• Amazon Web Services (AWS): the servers and the database, in Stockholm, Sweden. The backups stay there too.
• Cloudflare: the domain, the encrypted connection (HTTPS) and protection against attacks; every request passes through it.
• Brevo (France): sends the e-mails your account needs.
• Your browser's push service (Google, Apple or Mozilla), only if you turn notifications on; the content is encrypted on the way.
• Telegram: when a new account opens, we get a message with its username, number and language; never your e-mail address or anything you wrote.

Mail you send to a getrid.dev address goes through Cloudflare to our mailbox.

We share your data with nobody else, unless a court or an authority requires it by law.

Transfers abroad

These providers work outside Türkiye, so using Getrid means your data is transferred abroad (KVKK art. 9): to the European Union (AWS in Sweden, Brevo in France) and to the United States and other countries (Cloudflare, push services, Telegram). They handle it under their own terms and security measures, only for their part of the service.

How long we keep it

• Your account and everything in it: as long as the account exists. When you delete it, all of it goes at once.
• Backups: one a day, each kept for at most 30 days. A deleted account leaves them within that time.
• Sessions: they end after 30 days without use, and at the latest 180 days after you signed in.
• Links in account e-mails: 48 hours to confirm your address, 1 hour to choose a new password.
• Server logs (IP address, request, time): capped in size and overwritten as new ones arrive.

Cookies

We use only the cookies the site needs to work and to remember the choices you made. There are no analytics, advertising or third-party cookies, so there is no cookie banner either.

• gtd_session: keeps you signed in (until you sign out or the session ends).
• gtd_device: recognises a browser you signed in on, so failed attempts by others cannot lock you out (one year).
• gtd_known: notes that someone signed in on this browser, so an ended session leads to the sign-in page (one year).
• gtd_lang, gtd_theme, gtd_tz: your language, light or dark, and time zone (one year).
• gtd_now: the choices on the Now card (one year).
• gtd_guide, gtd_guided: your guide as a guest (24 hours), and that this browser went through it (one year).

Your rights

You can see and change almost everything in the app, and delete your account yourself (the Inbox drawer, Delete account). KVKK art. 11 and GDPR art. 15–22 also give you the right to learn whether and how your data is processed and to whom it was passed; to have it corrected or deleted, and those it was passed to told so; to object to a result against you reached only by automated processing; to get a copy in a usable format; and to claim compensation for unlawful processing.

To use them, write to [email protected] from the address on your account. We answer within 30 days, free of charge.

If our answer does not satisfy you, you can complain to Türkiye's Personal Data Protection Authority (KVKK) or to the data protection authority where you live.

Security

Every connection is encrypted (HTTPS). Passwords are kept as hashes, what you write is encrypted in the database with a key kept apart from it, sign-in attempts are limited, and the server can only be reached through Cloudflare. No system is perfectly safe: if a breach puts your data at risk, we tell you and the authority as the law requires.

Children

Getrid is for people aged 16 and over. If you learn that someone younger opened an account, write to us and we delete it.

Changes

When this notice changes, the date at its top changes too. We tell you of important changes by e-mail before they take effect.