Politique de confidentialité

Clanzu helps adults keep one daily promise together with a small circle of people. This policy explains what we collect, why, who can see it and what you can do about it. We wrote it to be read, not skimmed past.

Who we are

Clanzu (“we”, “us”) operates the website clanzu.com, the web app at web.clanzu.com and the Clanzu apps. For anything about your data, write to privacy@clanzu.com. Your data is stored in Germany, in the European Union.

What we collect

• Account: your email address and a securely hashed password, or, if you use Sign in with Apple, the identifier Apple gives us and the email address you chose to share (this may be a private relay address).
• Profile: the display name you choose, your language and time zone, and your confirmation that you are 18 or older.
• Activity: your vows and goals, daily check-ins, optional notes, the support you send and receive, your circle and clan memberships, votes and reports.
• Notifications: if you turn on push notifications, the push subscription your browser or device creates. You can turn this off at any time.
• Security and operations: active sessions and the devices they belong to, and short-lived, keyed (HMAC) values derived from network data that we use for rate limiting and abuse prevention. We do not store raw IP addresses for these purposes.
• Product analytics: a limited, pseudonymous record of in-app events (for example, “check-in completed”) that is not linked to your email address.

We do not use advertising trackers, we do not sell or rent your data, and we do not share it with data brokers.

Why we use it

• To run the service you signed up for: create your account, match you to a circle, show your progress and deliver support and notifications (performance of a contract, Art. 6(1)(b) GDPR).
• To keep Clanzu safe and working: prevent abuse, investigate reports, fix bugs and protect accounts (legitimate interests, Art. 6(1)(f) GDPR).
• To send push notifications, only after you turn them on (consent, Art. 6(1)(a) GDPR).
• To meet legal obligations, where they apply (Art. 6(1)(c) GDPR).

Who can see what

Your profile is private by default. Members of your circle see your display name, whether you checked in today and the support exchanged in the circle. Private notes stay private. Your email address is never shown to other members. Clan pages show aggregate activity, not personal details.

Service providers

We use a small number of processors under data processing agreements: a hosting provider in Germany that stores our data, an email delivery service for sign-in and account messages, and the push services operated by browser and device makers (Apple, Google, Microsoft, Mozilla) to deliver notifications you enabled. If you use Sign in with Apple, Apple processes your sign-in under its own privacy policy.

How long we keep it

• Account and profile data: for as long as your account exists.
• Data exports you request: deleted after 7 days.
• Invite and rate-limit records: about 30 days or less.
• Pseudonymous analytics: up to 13 months.

When you delete your account, we remove or irreversibly pseudonymize your personal data within 30 days. Shared history that other members rely on (for example, that a circle member checked in on a given day) is kept only in a form that no longer identifies you. Backups roll over and expire within 30 days after that.

Your rights

You can access, correct, export and delete your data, restrict or object to certain processing, and withdraw consent at any time. You can export your data and request deletion in the app under Settings → Privacy and data, or by writing to privacy@clanzu.com. You also have the right to complain to a data protection supervisory authority.

Sign in with Apple

If you sign in with Apple, we receive only what Apple shares with your permission: a stable identifier and, optionally, your name and an email address (which may be a private relay address). We use them only to create and secure your account. You can stop using Sign in with Apple for Clanzu in your Apple ID settings at any time.

Age

Clanzu is for adults aged 18 or older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.

Security

Traffic is encrypted with TLS, passwords are stored only as strong hashes, and access to production systems is limited and logged. No system is perfectly secure, so please use a unique password.

Changes

If we change this policy in a meaningful way, we will tell you in the app or by email before the change takes effect. The date at the top shows the latest version.