Privacy Policy.

Who is responsible

The controller for this app is Alain Kessler, a sole proprietorship registered in Switzerland, operating under the brand Klar. For any privacy question or request, contact support@getklar.org.

What we collect

Account data.We store your email address to sign you in and to keep your routines across devices. On iPhone, with Sign in with Apple you may use Apple's private relay email; that works fine. A display name and a small emoji are optional and set by you.

Your routines. The name you type, how often a week you want to do it, whether it has an end date, and the days you tick off. The name is free text you write yourself — it is stored as you typed it, so write it however you like.

Sharing, if you use it.You can let one person follow one routine. They see that routine's name and which days of the week you ticked off, and nothing else — not your other routines, not your email. It is read-only in both directions: they cannot tick a day off for you, and you cannot for them. If you have set a display name, the person you share with can see it. You can stop sharing at any time, which takes their access away immediately.

Purchase status. Purchases are processed by Apple or Google, and we never receive your card or payment details. Our subscription provider RevenueCat, which knows your account ID, tells the app whether your subscription is active. What the app records about a purchase is listed under usage statistics below.

Places, if you bind a routine to one. When you set a place for a routine, we store its position and radius with that routine, so the check-in can tell whether you are there. When you tick the routine off, your phone measures where it is and compares that with the place itself; that measurement is not sent to us. Without a place, the app never asks for your location.

Notifications. If you allow notifications, your phone gets a push token that we store with your account, so reminders and, in a pact, messages between you and your partner can reach it. It is deleted when you sign out or delete your account.

Usage statistics. The app reports which screens are opened, when it is started and closed, the steps of the first-run setup and the steps of a purchase, to our analytics provider PostHog in the European Union. For a purchase these are: that the paywall was shown and whether the plans loaded, that you started a purchase or a restore, which product at which displayed price (and introductory price), and how it ended (completed, cancelled, pending, failed, or nothing to restore). At every start the app also reports whether the connection to the store worked and which plans loaded, and, if linking your account to RevenueCat or reading your subscription status fails, that it failed. If something goes wrong, the event carries the technical error code and message from Apple or RevenueCat. We also record whether a purchase was a test purchase and whether you were signed in at the time, and from where the paywall was opened (for example from adding a routine). The app also counts what you do with it, without any content: that a routine was created or deleted, with its kind and how often it repeats; that a day was ticked off, and whether it was today or an earlier day; whether notifications are allowed and what you answered when the app asked; and whether a first-run setup was resumed after the app was closed. After you sign in, these events are linked to your account ID, never to your name or email. They contain no routine names, no places, no information about which apps you shut, and no card or payment details.

A one-time clipboard read.If you arrived through a link from someone who recommends the app, that link places a short token on your clipboard. On the first cold start the app reads the clipboard once, and only accepts text matching that exact token format. iOS shows its own “pasted from” notice when this happens. Anything else on your clipboard is ignored and never leaves your device, and the check does not run again.

What stays on your phone

Which apps you shut.This is the important one. On iPhone, blocking runs on Apple's Screen Time framework, and the selection you make is an opaque token that Apple keeps on the device. On Android, the app needs usage access to see which app is in front and permission to draw over other apps to cover it; the list of apps you picked is stored on the phone only. On both, Basalt never learns which apps or websites you chose. What we store is only that something is shut, and whether the web filter is on — never what is behind it.

Reminders. The daily nudge is a local notification scheduled on your phone, with no server involved; we do not know whether it fired or whether you opened it.

The camera. Used to read an invite code off another screen, and, if you choose, to take a photo that stands in for a place when the phone cannot tell where it is. That photo is shown to you once and then dropped. Nothing is recorded, nothing is uploaded, and no image ever leaves the device.

Your calendar.If you export a plan, the app writes sessions into a calendar named “Basalt” that belongs to you. We do not read your other calendars or events.

Appearance and layout. Your light/dark choice and how you arranged the widget are kept on the device.

What we do not do

No advertising and no ad networks. No cross-app or cross-site tracking, and no advertising identifier. No location tracking: the only position we keep is a place you set yourself. No access to your contacts, your photo library or your microphone. No feed, no public profiles, and nothing about you is visible to anyone you have not explicitly shared a routine with. We do not sell or rent personal data to anyone.

Why we process this data

To provide the app and your account, to keep your routines and your history, to unlock and restore the paid features, and to understand how the app is used, including where a purchase fails. Legal bases under the GDPR are the performance of our contract with you (Art. 6 para. 1 lit. b) and our legitimate interest in basic, privacy friendly usage statistics (Art. 6 para. 1 lit. f). The Swiss Data Protection Act (DSG) applies in parallel.

Service providers

We use a small set of processors, each only to run the service:

Apple for Sign in with Apple, for Screen Time, and for payments on iPhone. Google for payments on Android and for delivering notifications there. PostHog for usage statistics, located in the European Union. Supabase for account authentication and database hosting, located in the European Union. RevenueCat for managing subscription entitlements. These providers process data on our behalf under data processing agreements.

Where data is stored and how long

Account data and your routines are stored on Supabase servers in the European Union (Ireland region). We keep them for as long as your account exists. You can delete your account at any time in the app under Settings; that removes your account, your routines, every day you have ticked off, the places you set, and any share you had set up. Usage statistics that were already sent stay with PostHog, linked only to the account ID of an account that no longer exists.

Your rights

You have the right to access, correct, delete and export your personal data, and to object to or restrict its processing. The fastest way to delete everything is the in-app account deletion. For any other request, write to support@getklar.org. You also have the right to lodge a complaint with a data protection authority.

Children

Basalt is intended for a general audience and is not directed to children. We do not knowingly collect personal data from children under 13, or under 16 in the European Union. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as the app evolves. The current version is always available at this page, with the date shown below. Material changes will be reflected here before they take effect.