Privacy policy

1. Who the controller is

The controller of your personal data is Jan Theobald Bradáč, company ID 23381345, Přepychy 241, 517 32. For anything concerning your data, write to mail@hanee.cz. We have not appointed a data protection officer, as the law does not require one given the scope and nature of our processing.

2. What data we process

We process the following categories of data:

• Account owner registration data: name, e-mail, password (stored only as an irreversible hash), optionally phone number and date of birth.
• Group member profiles: name, profile colour and icon, optionally e-mail, phone number and date of birth. A profile may belong to a child — see the separate section below.
• Content you put into the app: calendar events (title, description, place, time), lists and their items, due dates, who things are assigned to, who ticked what off, birthdays and anniversaries.
• Operational and technical data: sign-in tokens (stored as a hash), IP address and browser details for active sessions, time of last activity.
• Group activity record: who changed what in the group (for example created a list or deleted an event), so members can keep track of what is happening.
• Security records: for failed sign-in attempts we store the e-mail address, IP address, browser details and the reason for failure.
• Notifications: the app prepares reminders (an upcoming event, a birthday, an overdue item) and keeps their finished text, which therefore includes the name of the event or item concerned. Lists locked with a PIN never produce reminders at all.
• If you turn on system notifications on a device: the address your browser's push service should deliver to, two keys used to encrypt them, an optional device label ("Kitchen tablet") and browser details. Without turning them on we store none of this.

3. Why we process data and on what legal basis

Every processing operation has a purpose and a legal basis under Art. 6 GDPR:

• To provide the app to you (account, group, profiles, your content). Legal basis: performance of a contract. Without this data the service cannot be provided.
• To keep the service running and secure (security records, sign-in rate limiting, abuse prevention). Legal basis: our legitimate interest.
• To handle your questions and requests. Legal basis: performance of a contract, or legitimate interest.
• To remind you of what you put into the app (in-app notifications). Legal basis: performance of a contract (it is a feature the app offers). System notifications on your phone or browser are additionally something you turn on yourself, and you can turn them off at any time, either in the app or in your browser settings.
• If you support us with a financial contribution, we keep records of the payment. Legal basis: compliance with a legal obligation (accounting and tax).
• We do not use your data for advertising, we do not pass it on for marketing, and we do not carry out any automated decision-making or profiling based on it.

4. Children's data

Hanee is designed so that a child needs neither their own account nor an e-mail address — their profile is created and managed by the adult who set up the group, acting as the child's legal guardian. In the Czech Republic a child can consent to processing by information society services from the age of 15; for younger children the legal guardian is responsible. We do not show children advertising, we do not profile them and we do not share their data with anyone.

5. How long we keep data

• Account, group and your content: for as long as you use Hanee. When you request deletion of your account there is a 14-day period during which you can withdraw the request; after that we permanently erase your account, your profile and your private lists. What you shared with your family (shared lists, calendar events, birthdays and anniversaries) stays with the family, no longer linked to your profile. When the last member leaves, the whole group is erased with all its content.
• Content you delete in the app (items, lists, folders, events, birthdays and anniversaries): we keep it for another 30 days, then it is permanently erased.
• Sign-in tokens: valid for 30 days from last use, then removed automatically. Signing out invalidates the token immediately.
• Security records of failed sign-ins: 30 days at most.
• Group activity record: for as long as the group exists; deleted together with it.
• Notifications: we keep the last 1,000 per group; older ones are removed automatically. They are also removed once whatever they were about is gone.
• System notifications you turned on: we delete a device subscription when you sign out on that device, when the push service reports it as gone (typically an uninstalled app), or when no notification has been delivered to it for more than 180 days.
• Contribution records: for as long as accounting and tax rules require.

6. Who we share data with

We do not sell your data and we do not pass it to anyone for marketing purposes. Running the service does take a few suppliers, which process data for us as processors — under a data processing agreement and only on our instructions. All of them are based in the European Union:

• Hosting (Forpsi, Czechia) – runs the server the app and the database live on, so all of your data sits there.
• Site protection and the hanee.cz domain (WEDOS, Czechia) – all traffic between your browser and our server passes through the WEDOS network.
• Sending e-mail (Scaleway, France) – the transactional e-mails we send you pass through them.
• Mailbox (WEDOS, Czechia) – runs the mailbox we use to communicate with you.

If you connect an external calendar yourself, the app sends a request to the address you entered. What the calendar's operator does with that request is governed by their terms. If you turn on system notifications, every such notification passes through your browser's push service. We send only a title and a short body, so typically the name of an event or item and a time. With system notifications off, nothing goes to a push service. We may disclose data to public authorities where the law requires it.

7. Where the data is stored

Data is stored on servers in the European Union, and every supplier listed above is based in the EU too. The one exception is system notifications, if you turn them on yourself: those have to pass through your browser's push service, which may sit outside the EU (Google, Apple). Should any of this change, we will say so in advance and put appropriate safeguards in place under the GDPR.

8. How we protect data

We do not store passwords in readable form, only as an irreversible hash; the same goes for sign-in tokens. Traffic between your device and the server is encrypted. Access to the data is limited to the few people who need it to run the service. No security is absolute — if a breach occurred that posed a risk to your rights, we would report it to the Czech data protection authority within 72 hours and, where the risk is high, inform you as well.

9. Cookies and browser storage

We use only cookies and browser storage that are necessary for the service to work properly (for example your sign-in token, your settings and a saved copy of the app so it opens without a signal). We do not use any tracking, analytics or profiling techniques.

10. What rights you have

In relation to your data you have the following rights under the GDPR:

• Right of access — to find out what data we process about you and get a copy of it.
• Right to rectification — to have inaccurate data corrected; you can fix most of it yourself in the app.
• Right to erasure — to have your data deleted; you can delete your account and group yourself.
• Right to restriction of processing — to have processing paused until something is resolved.
• Right to data portability — to receive your data in a machine-readable format.
• Right to object — to processing based on our legitimate interest.
• Right to lodge a complaint with the Czech data protection authority (uoou.gov.cz) if you believe we are not handling your data properly.

11. How to exercise your rights

Write to mail@hanee.cz and tell us what you need. We will deal with it within one month at the latest; if it were to take longer (which the GDPR allows for complex requests), we will let you know and explain why. We do not charge for handling an ordinary request. To make sure we do not hand data to the wrong person, we may ask you to verify that the request really comes from you.

12. Changes to this policy

We may update this policy — for example when we add a feature, change hosting provider or introduce payments. We will tell you about substantive changes in the app or by e-mail. The date of the last change is shown in the header.