What we do with your data
What KROKY collects, why it needs it, who else sees it and how to get rid of it. Plain language, no legal fog.
Effective: 2026-08-04 - Last updated: 2026-08-04
Who is responsible for your data
KROKY is built and maintained by Maksim Drazdou, an independent developer, who acts as the data controller for everything described here.
For any question about your data, write to support@kroky.app.
What we collect
Only what the app cannot work without. We do not sell your data and we do not build advertising profiles.
Account
Your phone number (used for the sign-in code), your name and avatar if you added them, the interface language you picked, a password if you set one (stored only as a hash), and your Google or Apple account identifier if you linked social sign-in.
What you create
Tasks and events with their dates, colours and icons, comments and files attached to tasks, your contact list inside the app, and who belongs to which group.
Technical data
Push notification token, device model and OS version, app version, crash reports and server request logs.
Why we need it
Sign-in and account safety: verifying your number with a one-time code and limiting login attempts.
Running the app: syncing tasks between participants and showing your name and avatar to those you plan with.
Notifications: telling you about a new task, comment, invitation or reminder, but only if you allowed push notifications.
Stability: finding and fixing bugs from crash reports and error logs.
Legal bases under the GDPR and similar laws: performing our contract with you (running the service), your consent (address-book access, push notifications) and our legitimate interest (security and stability).
Access to the contacts on your phone
The app asks for access to your address book only when you open the invite screen, and uses it for one thing: letting you pick who to invite.
When you pick someone, only that person's phone number is sent to the server to create the invitation. Your address book is never uploaded in full, never stored on our servers and never used for anything else.
You can revoke access at any time in your phone settings, and you can still invite people by typing a number or sharing an invite link.
Who else receives your data
Only the services the app cannot run without, and only as much as each of them needs. They process data for us and may not use it for their own purposes.
Hosting, Beget: runs our servers and database; the servers are located in Russia.
Sign-in code delivery, Telegram Gateway and SMS Aero: deliver the code by SMS or via Telegram. They receive the phone number and the code, nothing else.
Apple, Google and OneSignal: deliver push notifications to your device.
Sentry: collects crash reports: device model, OS and app version, and the technical trace of the error.
Some of these services are located outside your country. Where a transfer needs a legal safeguard, we rely on contractual data-protection clauses. We may also disclose data when a lawful, binding request obliges us to.
How long we keep it
While your account exists, your data is stored so the app can work. When you delete the account, your profile and contact links are disabled immediately and everything is fully removed from servers and backups within 30 days.
If you change your mind and sign in again within those 30 days, deletion is cancelled and the account is restored.
Crash reports and server logs are kept for up to 90 days, then deleted.
You can delete your account in the app (Profile → Delete account) or on the account deletion page of this site.
Your rights
Get a copy of your data and find out exactly what we store about you.
Correct your name, avatar or phone number.
Delete your account and data yourself, without writing to support.
Receive your data in a machine-readable format (data portability).
Object to or restrict processing that relies on legitimate interest.
Withdraw consent at any time by turning off address-book access or push notifications in your phone settings.
Complain to the data protection authority in your country.
Write to support@kroky.app and we answer within 30 days. To protect other people's accounts, we may ask you to confirm that you own the number.
Where you live matters
KROKY is used in many countries. The rights above apply to everyone; on top of them, some regions add specifics.
European Economic Area and the UK
The GDPR and UK GDPR apply as described in this policy: the legal bases are in section 3, your rights in section 7, and you can complain to your local supervisory authority.
United States, incl. California
We do not sell your personal information and do not share it for cross-context behavioural advertising. You can request access or deletion at any time, and you will never be treated worse for exercising these rights.
Russia, Belarus and the CIS
Data is stored on servers located in Russia (section 5), which also satisfies Russian data-localisation rules. Requests about your data work the same way for everyone, by email.
Children
KROKY is a family app, and children are part of family plans. Still, you need to be at least 13 to create an account of your own, or older where your country's law sets a higher age.
A younger child can use KROKY only when a parent or legal guardian sets up the account, supervises it and accepts this policy on the child's behalf. A parent can write to us at any time and we will delete the child's account and data.
Outside of that parental setup we do not knowingly collect children's data. If you believe it has happened, write to us and we will delete it.
Security
The connection to the server is encrypted (TLS), access to the database is restricted, passwords are stored only as hashes, and signing in requires a one-time code sent to your number.
No protection is absolute, so avoid putting anything in a task whose leak would be critical for you.
Changes to this policy
If the rules change, we will update this page and the date at the top. We will announce significant changes in the app before they take effect.
How to reach us
For anything about your data, access or deletion, just write: the developer answers personally.
support@kroky.app