Privacy policy

Last updated: 2026-11-12

This policy explains what personal data Tocalu (https://www.tocalu.app) processes, why, and your rights under the EU General Data Protection Regulation (GDPR).

Controller

[Nome e cognome o ragione sociale], [Indirizzo]. Contact: alessio.gemmi@gmail.com.

Data we process

• Account: email address, display name, language; if you sign in with Google or Apple, the identifier they provide.
• Group content: groups, people added (including people without an account, by name only), chores, points, requests, shared expenses and any photos you upload. Photos are re-encoded and stripped of metadata (e.g. GPS location).
• Technical data: IP address and request data in server logs, a technical session cookie, and your push subscription if you enable notifications.

Purposes and legal bases

• Providing the service you asked for (contract, Art. 6(1)(b)): account, groups, scores, notifications, recaps.
• Security and abuse prevention (legitimate interest, Art. 6(1)(f)): technical logs, rate limits.
• Legal obligations (Art. 6(1)(c)): billing records for payments.

We don't use your data for advertising, we don't sell it and we don't profile you.

Recipients

Providers that help us run the service, acting as processors: [fornitore dell'hosting] (hosting and email), and your browser's push services (Google, Mozilla, Apple, Microsoft) if you turn on notifications. Some of them may process data outside the EU under appropriate safeguards (standard contractual clauses or an adequacy decision).

Other members of your groups see your name and what you record in the group. If you share a recap, the public page shows the group's names and scores to anyone with the link.

Retention

As long as you have an account. You can delete it at any time from the app ("Delete account"): we erase your account, the groups you created, chores, expenses and photos. Technical logs are kept for up to 12 months; billing records for as long as the law requires.

Your rights

You can request access, rectification, erasure, restriction, portability, and object to processing by writing to alessio.gemmi@gmail.com. You can also lodge a complaint with your data protection authority.

Children

The service is intended for people aged 14 and over (or the minimum age in your country). Younger people can be added by an adult as people without an account, by name only.