Privacy Policy
A short policy, because we collect little: your Kurm account and the sign-in and licence records the app needs, what you type into the contact form, and what an order needs.
What we collect, and why
Nothing for browsing the site. Downloading Kurm Optimizer, signing in to it and buying a plan need a free Kurm account (below).
What you send through Customer Service: the type of message (idea, complaint or problem), your email address, your name if you give it, your message, and the page address and time it was sent. It arrives as an email in our inbox, Kurmoptimizer@gmail.com, so we can read it and reply to you. If you email us directly, we get whatever you put in that email.
When you make an account (needed to download the app and to buy a plan): your email address and a password, which is stored only as a hash by our account provider Supabase and never seen by us. If you sign in with Google instead, Google sends your email address, name and profile picture; Supabase's sign-in service keeps what Google sends with the sign-in record, but we do not copy your name or picture into your account, show them, or use them. We do not store a display name or a profile picture. We keep when the account was made, how you sign in, and which version of the Terms of Service you agreed to when you created the account, and when (the record of your consent). While you are signed in, your session is kept in your own browser (localStorage) so you stay signed in; signing out removes it. When you buy a plan, your account email is given to Stripe as the order's email, with your account's id so the order is filed under your account, and your account page lists the orders Stripe holds for your account (date, plan, amount and status). That list is read from Stripe each time you open the page; we do not copy it into your account.
Your plan: for each plan on your account we keep a licence record: the tier, when it starts and when it ends (Forever has no end), where it came from (the free plan, a Stripe order and its reference, or a grant from us) and when it was recorded. It holds no card details. The Stripe order also records which version of the Terms of Service you agreed to at checkout, and when.
When you sign in to the desktop app: your email and password, or Google, go to Supabase to sign you in, as on the site. For each account we keep one desktop session record: the id of the app's sign-in session, when it started and when the app last checked in. While it runs, the app checks in about once a minute. We use these records only for licensing: to tell the app which plan your account has, and to keep one desktop session active per account at a time, so signing in on another computer signs the earlier one out. The app keeps your sign-in on your computer, encrypted for your Windows user, so you stay signed in; signing out deletes it.
What we do not collect
We do not collect telemetry from the desktop application: it does not send us what you do in it, your settings, your hardware details or your files. The only thing it sends us is the sign-in and plan check described above.
We never see your card details. Payments, once open, are made in Stripe's own payment form, shown inside our checkout page, and go straight to Stripe; they never touch our servers.
We do not use advertising or analytics cookies, and we set no cookies of our own. Cloudflare, which hosts the site, may set strictly necessary security cookies to block abusive traffic.
Who else sees your data
Cloudflare hosts the site, carries contact form messages to our inbox, and runs the store service that creates orders and serves the download. It briefly uses your IP address to limit how many messages one connection can send; we do not keep it. Google runs the Gmail inbox the messages arrive in, and the Google sign-in if you use it. Supabase, in the United States, runs our accounts: it stores account data, licence records and desktop session records on our behalf and sends the confirmation and password reset emails. Stripe takes payments and handles chargebacks, and keeps its own record of each payment under its own privacy policy.
We do not sell personal data, and we do not share it for advertising.
How long we keep it
Messages are kept in our inbox while we deal with them and for as long as they help us answer you later, unless you ask us to delete them.
Licence and desktop session records are kept until you delete your account. Order records are kept for our tax records.
Accounts are kept until you delete yours. You can do that yourself at any time: sign in, open your account page and choose Delete account. That permanently deletes the account, its profile (email, sign-in details and consent record), its licence records and its desktop session record straight away, and ends its sign-ins everywhere, including in the app. It cannot be undone.
What deleting an account does not remove: Stripe's payment records, which Stripe keeps under its own privacy policy and which the law requires to be kept, and our order records, which are needed for our tax records. Purchases are not refunded, and the plans on the account end with it. Your purchase history is no longer shown on the site, and a new account made later does not get the old plans back.
Your rights
You can ask for a copy of the data we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. You can delete your account yourself on your account page. Ask through Customer Service or by email to Kurmoptimizer@gmail.com, and we will respond within one business day and complete the request within 30 days. Anything we must keep for tax we keep without your name or email.
If you are in the UK or EU you may complain to your data protection authority. If you are in California you have the rights described in the CCPA, including the right to know and the right to delete; we do not sell personal information, so there is nothing to opt out of.
Children
The site and accounts are not meant for children under 13, and people under 13 may not make an account. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, contact Customer Service and we will delete it.
Security
The site is served over HTTPS only. Passwords are stored only as hashes by Supabase, and the account database lets each signed-in person read only their own account. Licence and desktop session records can be changed only by our own server functions, never from the site or the app, and you can read only your own.