Privacy Policy

In brief

Kanban Planner collects none of your content. There is no user account, no server operated by the provider, no analytics and no advertising. Your tasks stay on your devices and in your own private iCloud. The one exception: to verify purchases and subscriptions, the app uses the service RevenueCat, which processes technical purchase data for that purpose (see below).

This website sets no cookies and stores nothing in your browser.

Controller

Kristmann Technologies
Owner: Claudius Kristmann
Michael-Ludwig-Rohrer-Straße 1/1
76437 Rastatt
Germany

Email: support@kristmanntechnologies.de
Phone: +49 178 7835439

Which permissions does the app request?

The app requests exactly one system permission, and only once you need it:

Notifications. Requested as soon as you turn on “Remind me when due” in the app's settings — not at first launch. If you decline, the app keeps working in full; only the reminders stay silent. You can change the decision at any time in your device's system settings.

File attachments are chosen through the system's file picker. The app receives only the file you selected yourself — it gets no access to your files, your photo library or any other folder.

Not requested: camera, photo library, microphone, location, contacts, calendar and health data. The app does not ask for them because it does not use them.

What data does the app process?

Your content. Plans, columns, tasks, checklists, dates, goals, labels and attachments that you create yourself. They are stored exclusively on your device, locally.

iCloud sync. If iCloud is enabled, the app syncs your content between your devices through your private iCloud database. That data sits in your own iCloud account. The provider of this app has no access to it and can neither view nor evaluate it. Apple is responsible for operating iCloud; Apple's privacy terms apply. Syncing can be switched off in the app's settings.

GitHub integration (optional). If you connect a GitHub account, the app retrieves issues and pull requests of the repositories you specify, on your behalf. The access token is held in your device's keychain (in the iCloud keychain if you choose) and is sent to GitHub only. GitHub's privacy terms apply.

AI integration through the MCP server (optional). If you install the separately offered MCP server, an AI program on your own Mac — Claude Code, for instance — accesses the same local data store. The server runs on your machine and sends nothing to the provider of this app. Which content reaches which AI service is determined by the program you use; that program's privacy terms apply.

Purchases and subscriptions. Apple processes the payment for Pro; the app receives no payment details. To verify purchases and manage subscription status, the app uses the service RevenueCat (section “Purchases through RevenueCat”).

Notifications. Due-date reminders are scheduled locally on the device. Likewise, the app can — only if you allow notifications — create a local reminder two days before a Pro trial ends. It is created on your device, with no server. No push messages are sent through anyone else's servers.

Feedback. “Feedback & requests” in the app opens a prepared email that includes the app version, device model and system version. You see these details before sending and can delete them.

Purchases through RevenueCat

For Pro purchases and subscriptions, the app uses the SDK of RevenueCat, Inc., USA (a processor acting for the provider). The provider still runs no servers of its own; RevenueCat is not an analytics or advertising service.

What data. The SDK sends purchase and receipt data and subscription data (such as product, purchase date, term, status), an anonymous, app-generated user ID (no name, no email — the app has no account), and device and app information (such as OS version, app version, device model, language or country) to RevenueCat. When connecting, RevenueCat also receives your IP address, as a technical necessity. Your content (plans, cards, attachments) is not transmitted. Payment details themselves stay with Apple.

Purpose. RevenueCat verifies purchases with Apple, manages subscription status (whether Pro is unlocked, including after “Restore Purchases” and across several devices) and provides the provider with purchase statistics. There is no advertising and no tracking across apps.

Legal basis. Art. 6(1)(b) GDPR (performance of a contract: verifying and unlocking your purchase) and, as far as purchase statistics are concerned, Art. 6(1)(f) GDPR (the provider's legitimate interest in evaluating its business in aggregate form).

Recipient and third-country transfer. The recipient is RevenueCat, Inc., USA. The data is processed in the United States (according to RevenueCat, in Amazon Web Services data centers). A data processing agreement is in place with RevenueCat; for the transfer to the US, it provides for the EU Standard Contractual Clauses.

Retention. RevenueCat keeps the purchase data only as long as needed to manage the subscription.

More in RevenueCat's privacy policy. If you want access to or deletion of your purchase data, write to the provider; we pass the request on to RevenueCat.

What the app does not do

• No analytics, tracking or advertising SDKs — the RevenueCat SDK serves purchase handling only
• No sharing of your content with third parties; only the purchase data described above goes to RevenueCat
• No profiling
• No access by the provider to your content

This website

This website presents the app. It has no sign-in, no forms and no comment fields. It sets no cookies and stores nothing in your browser. That is why there is no consent banner here — there is nothing to consent to. The language choice lives entirely in the address.

To measure traffic, the site may use Plausible Analytics, a cookieless tool that records only aggregate, non-identifying visit counts. It is currently switched off, and it never runs inside the app.

The provider itself collects and stores nothing in the process. As with any website, the host receives the technical connection data without which no page could be delivered. The provider does not evaluate it.

Legal bases for processing (Art. 6 GDPR)

Where the GDPR applies, the processing described above rests on the following bases:

• Art. 6(1)(b) GDPR (performance of a contract) for providing the app and its features, including verifying and unlocking Pro after a purchase or subscription (with RevenueCat as processor).
• Art. 6(1)(a) GDPR (consent) for everything you switch on explicitly: notifications, iCloud sync, the GitHub integration and the AI integration through the MCP server. You can withdraw a consent at any time with effect for the future — in the app's settings or your device's.
• Art. 6(1)(f) GDPR (legitimate interests) for operating this website and, where enabled, measuring its traffic in aggregate, non-identifying form, and for purchase statistics through RevenueCat.

Data retention

Your content stays for as long as you keep it. You delete it by removing it in the app or by uninstalling the app; iCloud data is managed in your device's iCloud settings. The provider holds no copy of it and can therefore neither retain nor delete anything. For purchase data at RevenueCat, see the section “Purchases through RevenueCat”.

If you write to us by email, we keep the message for as long as handling your request requires.

Your rights under the GDPR

As a data subject you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)).

In practice: because the provider runs no user account and stores none of your content on its own servers, that data is already directly in your hands — on your device and in your iCloud account. For data in your iCloud account, Apple is your point of contact; for data in your repositories, GitHub is; purchase data at RevenueCat you reach through the provider. For anything the provider does in fact process, use the address below.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for the provider is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg; you may equally approach the authority of the German state in which you live. The Federal Commissioner for Data Protection maintains a list.

Children's privacy

Kanban Planner is not directed to children under 16, and no personal data of children is knowingly collected. If you believe we hold a child's data, please write to us and we will take care of it.

Changes

This policy will be adjusted when the app or the law changes. The current version is always on this page; the date above states its status. Material changes will be highlighted here.

Contact

Questions about privacy: claudius@kristmann.de