Privacy Policy

1. Controller and contact

The data controller for Klebby is Emanuel Jose Vargas Luis (ENI, Portugal), Avenida do Atlantico 16, 14º, Escritorio 8, 1990-019 Lisboa, NIF PT233800263. For privacy requests, email privacy@klebby.com.

Klebby is for users aged 16 or older.

2. Data we process

We process account email and profile data, hashed passwords, server-side sessions, notes, tags, comments, board layout and sharing graph, invitee email addresses, notification preferences, push tokens, IP address, device/browser and basic log data, authentication, password-reset and email-verification tokens, subscription entitlement references, security logs, and support emails.

For local price previews, we send only your selected billing country and postal code to Paddle, without forwarding your IP address for the calculation. Preview location details are not stored by Klebby. Payment card details are handled by Paddle. Klebby does not store card numbers. We store the subscription/customer references needed to unlock Pro and handle support, plus billing and tax metadata received from Paddle such as country for VAT and invoice references.

The app keeps account-scoped note caches, unsynced changes and recovery copies on your device so you can work offline. Signing out removes access but can retain recoverable work for the same account; clearing local app or browser storage removes these copies. Exported or downloaded recovery files remain where you save them. We also process reports, reported-content snapshots, blocking relationships and moderation outcomes to handle abuse.

3. Why we use data

We use data to create and secure your account, provide the board, sync, sharing, comments, reminders, notifications, export, deletion, subscriptions, customer support, fraud prevention, abuse prevention, and service reliability.

4. Legal bases

The purposes above use these legal bases: contract covers account, app features, sync, sharing, support, subscriptions, cancellation, and withdrawal handling; legitimate interests cover security, abuse and fraud prevention, debugging, and reliability; consent covers push notifications and optional communications; legal obligation covers tax, accounting, consumer-law, and rights-request records.

• Contract: account, app features, sync, sharing, support, subscriptions, cancellation, and withdrawal handling.
• Legitimate interests: security, abuse and fraud prevention, debugging, reliability, and understanding whether the service works, balanced against your rights.
• Consent: push notifications and optional communications that require consent. You may withdraw consent at any time.
• Legal obligation: tax, accounting, consumer-law, security, and rights-request records where the law requires retention.

5. Sharing, providers, and recipients

Content is shared with other users only when you choose to share a tag or accept shared access. Those users may see the notes and comments covered by the share.

Klebby uses alwaysdata in France for EU hosting and transactional email through alwaysdata SMTP, and Paddle as merchant of record for web payments.

If you buy through Apple or Google, that store handles payment and subscription management under its own terms and privacy notice. Klebby verifies purchase and account-binding references with the relevant store to grant access and process subscription updates; it does not receive your full card number.

If you enable push notifications and the relevant channel is configured, your device token or browser push subscription and a localized alert are sent through Google Firebase Cloud Messaging (FCM) on Android, Apple Push Notification service (APNs) on iOS, or your browser’s push provider. Alerts can include the acting person’s name and note or tag information, which may appear on your lock screen. Delivery depends on your permissions, settings, network and provider.

On Android, the included Firebase messaging and installations SDKs can automatically send an installation identifier and app/device version metadata to Google before you enable notifications. This SDK processing is separate from registering a push token with Klebby and from our anonymous event counters; we do not use it for advertising tracking.

6. International transfers

alwaysdata hosts in the EU. Paddle, Google FCM, Apple APNs and browser push providers may process some data outside the EEA. Where that happens, Klebby relies on appropriate safeguards such as adequacy decisions, standard contractual clauses, and the providers' published transfer safeguards.

7. Cookies and checkout

Klebby uses essential cookies only, such as secure session cookies and preferences needed to run the service. We do not use advertising cookies on the marketing site.

Stored usage statistics are cookieless daily aggregate event counters, without saved IP addresses or device identifiers in those counters. Requests still pass through hosting and security logs, and the API uses IP addresses transiently for abuse rate limiting; this is separate from the stored aggregate statistics.

If you open Paddle checkout, Paddle may set cookies or similar technologies necessary for checkout, fraud prevention, tax, and payment processing under Paddle's own terms and privacy notices.

8. Retention

Account and content data is kept while your account is active. Deleted notes and related sync records use deletion markers to prevent old offline devices from recreating them; they are not automatically purged after a fixed 30-day window. On account deletion, private note text, private tag names and private-note comment text are erased, including content already marked deleted. Account identifiers are anonymized or removed. Content transferred to remaining collaborators and anonymized comments on shared notes are preserved. Deletion markers remain so offline devices cannot recreate deleted data.

Sessions expire and are deleted after their lifetime. Push tokens are kept until removed, invalid, or the account is deleted. Security logs are kept up to 12 months. Support emails are kept up to 24 months. Subscription and tax records are kept for the statutory accounting period, up to 10 years under Portuguese tax law, as required.

If you object to invitations, email privacy@klebby.com. We remove pending invitation links and keep only an address hash and the objection date to prevent further invitations while the objection remains in effect. The hash is still personal data. This record is independent of account deletion. You can ask to withdraw the objection; old invitations will not be restored.

9. Your rights and complaints

Depending on your situation, you can request access, export, correction, erasure, portability, restriction, objection, and withdrawal of consent. Email privacy@klebby.com to exercise these rights. We may need to verify your account before acting on a request.

You also have the right to complain to CNPD, the Portuguese data protection authority, at https://www.cnpd.pt/.

10. Security and changes

Passwords are hashed with Node's built-in crypto.scrypt. Sessions are stored server-side and sent in httpOnly, Secure, SameSite cookies. We use parameterized SQL, access checks for shared data, and EU hosting through alwaysdata.

We may update this policy when Klebby, law, or processors change. The page will show the current last-updated date.