Privacy Policy

Effective and last updated September 26, 2026

This policy explains what personal data Kaizen collects when you use our website (my-kaizen.com), our web app (my-kaizen.app), and our apps for iPhone, iPad, Android, and Windows. It covers why we collect it, who processes it for us, how long we keep it, and what your rights are.

Who we are

Kaizen is run by MK Development, a sole proprietorship (eenmanszaak) owned by Max Kruiswegt, at Westerparkstraat 2U, 2042 AW Zandvoort, the Netherlands. Chamber of Commerce (KvK) number 89767810, VAT number NL004755047B80. MK Development is the controller of your personal data, which means we decide how and why it is used. Max Kruiswegt is responsible for data protection and is the person to contact about it, including under laws outside the EU that ask us to name one. For anything about this policy or your data, email [email protected]. We have not appointed a data protection officer under the GDPR.

The short version

• We collect what we need to run your account and sync it across your devices: your email address, your username, and what you create in Kaizen, such as tasks, habits, and focus sessions.
• Other people in a Focus Room see your username, profile picture, status, timer, and focus tag. They see your current task only if you have Premium and turn on task sharing. Anyone signed in to Kaizen can see who hosts a public room and the pictures of a few of its members.
• The app sends usage statistics so we can see which features work, and error reports so we can fix bugs. Usage statistics are not linked to your account unless you choose to link them. Error reports can include your user ID and text such as a task title, because that is often what we need to find a bug.
• The list of apps you block stays on your device. Kaizen does not send it to us or to any service we use.
• We do not sell your data, and we do not use it for advertising.
• Wherever you live, you can see, correct, get a copy of, or delete your data, and object to how we use it. See Your rights.

What we collect and why

Your account

When you create an account, we collect your email address, a username, and, if you sign up with email, a password (stored only in hashed form). If you sign in with Google, Apple, or Discord, we receive your email address, the name on that account, and your account ID there, and the name becomes your starting username. Google and Discord also send a link to your picture there. Our sign-in system stores it with your sign-in details, but we do not use or show it. Apple shares your name only the first time you sign in, and only if you allow it, so your username can start empty. Apple may also give us a private relay email address instead of your own. You can change your username, add a profile picture, and change your email address or password at any time. Profile pictures are stored so that anyone with the link can view them.

When you sign in, our sign-in system records the time, your IP address, and your browser or device type with your session, to keep your account secure. It also keeps a security log of sign-ins and account changes, such as a new password or a deleted account, with the time, your IP address, your user ID, and your email address.

Everyone gets their own referral code. If you enter someone's code in the app, we record who referred you. That person earns points when you enter it and again the first time you start Premium, including a free trial. They see a note with the date each time, but not your name or email address.

We use this to create your account, sign you in, keep it secure, and show your username and picture to other people where described below. Our use of information received from Google APIs follows the Google API Services User Data Policy (opens in a new tab).

We also email you when your account needs it: to confirm your address, reset your password, or tell you that your password or email address changed. We may also email you about important changes to the service, such as a price change, or to this policy. These emails are sent through Google Workspace. They are part of the service, so they have no unsubscribe link, and we never use them for marketing.

What you have to give us. To create an account we need an email address and either a username and password, or a sign-in with Google, Apple, or Discord. Without them we cannot create your account. Everything else, such as a profile picture, due dates, notifications, app blocking, task sharing, the newsletter, or turning on "Help Improve Kaizen", is up to you. No law requires you to give us any of this.

Legal basis: performance of our contract with you (GDPR Article 6(1)(b)), and our legitimate interest in keeping accounts secure (Article 6(1)(f)).

What you create in Kaizen

To provide the service and keep it in sync across your devices, we store what you create and set up in Kaizen:

• tasks, with their titles, descriptions, subtasks, priorities, estimates, due dates, reminders, the time you spent on them, and whether and when you completed or archived them
• habits, with their names, icons, cues (such as "after my first coffee"), schedules, targets, and reminder times, and your check-ins and skips, with the time and time zone of each
• focus sessions and breaks: when they ran, their planned and actual length, pauses, whether they finished, whether you used the timer or the stopwatch, their focus tag, and the tasks, habits, and Focus Room time they counted toward
• rooms you create, with their name, code, visibility, and size
• your settings: your time zone (from your device), the app's language, your week start, whether the streak reminder is on and at what time, and your "Help Improve Kaizen" choice

We use your time zone to send reminders at the right local time and to know which day it is for you. Timer settings, such as presets and lengths, and any custom background image you pick stay on your device and are not uploaded.

We do not ask for sensitive data, such as details about your health, religion, or ethnicity, and we do not need it. Please keep such details out of anything other people can see, such as your username, room names, or a task you share.

Legal basis: contract (Article 6(1)(b)).

Running and improving Kaizen

We also look at account data in aggregate to understand how Kaizen is doing and what to improve. For example, we count how many people sign up, keep using Kaizen, and subscribe, and we look at time zones to see roughly which countries they are in. To answer your questions, fix a problem, or deal with misuse, we can also look up a single account, including its email address, username, plan, settings, and what it created.

Legal basis: our legitimate interest in running, supporting, and improving Kaizen (Article 6(1)(f)).

Focus Rooms

When you join a Focus Room, other members can see your username, profile picture, status (such as focusing or on a break), your timer, your focus tag, whether you are the host, and how long you have been in the room. If you have Premium and turn on task sharing, they also see the title of your active task. Any signed-in Kaizen user can see the list of public rooms: each room's name, its host's username and picture, the pictures or initials of up to three members, how many people are in it, and how many of them are focusing right now. Any signed-in user with a private room's code sees the same before joining. There is no video, audio, or chat.

Choose a username and picture you are happy for other people to see, and think before you share a task title in a public room. We cannot control what other members do with what they see, for example taking a screenshot.

Legal basis: contract (Article 6(1)(b)).

Subscriptions and payments

Premium is sold through the App Store, Google Play, or, on the web and in the Windows app, through RevenueCat's checkout, with card payments processed by Stripe through our own Stripe account. Apple, Google, and Stripe handle your payment details: we never receive your full card number or security code. RevenueCat manages subscriptions for us so that every device knows your plan. It receives your user ID on every device you sign in on. In the iPhone and Android apps it also receives your email address and username, and on the web it receives your email address when you check out. It also receives your purchase history from Apple, Google, or Stripe, and basic details about your device and app, such as the platform, app version, and store country. We keep a copy of your plan in our own database too, so our servers know what you can use: the product, the store, whether it is a trial, and when it renews or ends.

Legal basis: contract (Article 6(1)(b)), our legal obligation to keep financial records under Article 52 of the Dutch General Tax Act (Algemene wet inzake rijksbelastingen) for purchases paid through our own Stripe account (Article 6(1)(c)), and our legitimate interest in handling refunds and disputes and keeping complete purchase records (Article 6(1)(f)).

Notifications

If you allow notifications on an iPhone or Android device, we store a push token for that device (an address that lets Apple or Google deliver notifications to it) and its platform. Together with the time zone and language in your settings, this lets us send streak, task, and habit reminders at the right time. The daily streak reminder is on by default and only fires when your streak is at risk; you can turn it off under Settings, then Notifications. You can also remove a task's or habit's reminder, or turn notifications off in your device settings at any time. Reminders are delivered through Expo's push service and then Apple or Google, and their text can include the title of the task or the name of the habit.

Legal basis: contract (Article 6(1)(b)).

App blocking

On iPhone and Android, Kaizen can block apps you choose while you focus, or until you turn Block now off.

• Android. To show you a list to pick from, the app reads which apps on your phone you can open. While blocking is on, it uses the usage access permission to see which app is open, and the permission to display over other apps to show the block screen.
• iPhone. Kaizen uses Apple's Screen Time. You pick apps and websites in Apple's own picker, and Apple gives Kaizen only a sealed token, not the names of what you picked.

The list of apps you block, and which apps you open, stay on your device, and in your phone's own backup if you have backups turned on. Kaizen does not send them to us or to any service we use. For app blocking, our usage statistics record things like how many apps are on the list, which blocking level you use, and whether you granted the permissions, but not which apps they are.

Legal basis: contract (Article 6(1)(b)), because it is a feature you choose to use.

Usage statistics

The app sends usage statistics to PostHog, a product analytics service, on iPhone, Android, the web, and Windows. We use them to understand which features are used and where people get stuck. For example, we look at how many focus sessions are started and finished, how people move through the app, and how often people see the Premium screen and start a subscription. That tells us what to fix and what to build next.

• What is sent. Events, such as a focus session starting or a task being created, with details such as the session length, the timer mode, the focus tag you picked (one of the eight presets), whether a task was attached, and which background or music you chose. The app also sends which screens you open, and technical details: app version, platform, operating system and version, device type, language and region setting, time zone, whether you use Kaizen Free or Premium, and roughly how long ago your account was created. The app is designed to leave out the text you write, such as task titles or habit, room, or user names, and the list of apps you block. It removes your device name, model, manufacturer, and screen size before sending.
• Not linked to your account unless you choose. By default, statistics carry a random identifier that the app creates each time it starts and forgets when it closes (on the web, each time the page loads). We do not attach your user ID, email address, or name, and PostHog does not create a profile for these statistics. They are also sent before you sign in. Because they could in theory be connected to you, they are still personal data, and we treat them that way.
• Linked if you choose. Your statistics are linked to your account's user ID if you tick the "Help improve Kaizen" box when you register, choose "Include my account" when the app asks, or turn on "Help Improve Kaizen" under Settings, then Privacy. PostHog then also keeps a profile for your account with that ID, your app version, device type, and operating system and version. You can switch linking off at any time under Settings, then Privacy, and from then on new statistics are no longer linked. What was linked before, including that profile, stays until you delete your account. If you want it deleted sooner, email us and we will ask PostHog to delete it.
• IP address and location. PostHog receives your IP address when the app connects, as any server does. The app tells PostHog not to look up your location from it, and PostHog discards it instead of storing it. Your time zone and language setting can still show roughly which country you are in.
• Where and how long. PostHog stores the statistics in the EU (Frankfurt, Germany). On our current plan we can use them for one year. After that they drop out of everything we can see or query, and we do not use them again. PostHog does not promise to erase them at that point, so they can stay in its storage for longer.

Legal basis: our legitimate interest in understanding how Kaizen is used, so we can fix problems and improve it (Article 6(1)(f)), for statistics that are not linked to your account. We weighed that interest against your privacy and designed these statistics to carry no account ID, no stored IP address, no location looked up from your IP address, and none of the text you write. Your consent (Article 6(1)(a)) is the basis for linking statistics to your account. See Your right to object.

Error reports

When something goes wrong in the app, it sends an error report to Sentry so we can find and fix the problem. The app also sends a sample of performance measurements, and the iPhone and Android apps tell Sentry when a session starts and ends, so we can see how often the app crashes.

• What a report contains. Technical details about your device and the app, such as the device model, operating system, and app version. It also contains a trail of what happened just before the error, which can include:
  • your user ID and username
  • the titles of tasks and subtasks you worked on, and the names of rooms you used
  • the addresses of network requests the app made, to our servers and to services such as RevenueCat
  • which parts of the screen you tapped, and on the web, the labels of buttons you clicked
  
  On the web, a report can also include the address of the page you were on and your browser version. The app asks Sentry not to store your IP address, though Sentry may still record the approximate location it works out from it.
• Not anonymous. Because reports can contain your user ID and things you typed, we treat them as linked to you, whether or not you turn on "Help Improve Kaizen". We use them only to fix problems.
• If you link your account. When "Help Improve Kaizen" is on, we also attach your account, including your email address, to every report, so we can contact you about a problem.
• On your device. On iPhone and Android, Sentry stores a random installation identifier on your device, sends it with each report so reports from the same installation can be grouped, and keeps unsent reports there until they can be sent.
• Where and how long. Sentry stores error reports in the EU (Frankfurt, Germany) and, on our current plan, keeps them for 30 days.

Legal basis: our legitimate interest in keeping Kaizen stable and secure (Article 6(1)(f)), and your consent (Article 6(1)(a)) for attaching your account and email address to every report.

App updates and connection checks

The iPhone and Android apps check Expo's update service for small fixes between store releases. Each check sends a random installation identifier, the platform, the app version, which release track the app is on, which update is installed, and, if the app failed to start the last time, a short technical error message. Expo also receives your IP address.

To know whether you are online, the iPhone and Android apps also contact a Google server (clients3.google.com) about every 10 seconds while they are open. Google receives your IP address, but no account information.

Legal basis: our legitimate interest in delivering fixes quickly and in knowing when the app can sync (Article 6(1)(f)).

Support, feedback, community, and the newsletter

• Email. When you email us, we use your email address and what you write to help you. Our mailboxes are hosted by Google Workspace.
• Feedback form. The feedback form on our website is a Notion form, so what you type is stored by Notion.
• Discord, X, and Instagram. If you join our Discord server or contact us on X or Instagram, those platforms handle your data under their own privacy policies. We see what you post or send us there and use it only to reply and run the community.
• Newsletter. If you subscribe, Kit (ConvertKit) stores your email address, your first name if you enter it, and when you signed up, and sends the emails. You confirm your subscription by email, and every email has an unsubscribe link. Kit can record whether you open the emails and which links you click.

Legal basis: our legitimate interest in answering you, running the community, and improving Kaizen (Article 6(1)(f)) for support, feedback, and community, and your consent (Article 6(1)(a)) for the newsletter.

Our website and web app

Our website and web app are hosted by Cloudflare, which processes your IP address and technical request data to deliver the pages and protect them from attacks. The website sets no cookies of its own and runs no analytics of its own. Our newsletter and feedback pages load forms from Kit and Notion as soon as you open them. Kit then stores a random identifier in your browser and records your visit, including the page address and the page you came from, and Notion may set its own cookies. The web app keeps your sign-in session, your settings, a copy of your tasks, habits, and focus history so it works offline, and downloaded music, backgrounds, and any custom background image in your browser's storage. The web and Windows apps load some icons from Iconify's public icon service (api.iconify.design), which receives your IP address. The Cookie Policy has the details.

Legal basis: our legitimate interest in running a secure website and offering the newsletter and feedback forms (Article 6(1)(f)), and contract (Article 6(1)(b)) for the web app.

Keeping Kaizen safe and meeting legal duties

We check room names, and usernames you change in your profile, against a list of offensive words, and hide offensive words in task titles shared in a room. We can remove content or suspend accounts that break our Terms. Our backend provider logs requests to our servers, including your IP address and user ID, for security and troubleshooting. We also use your data where needed to deal with misuse, to establish or defend legal claims, to comply with the law, and, in rare cases, to protect someone's safety.

Legal basis: our legitimate interest in keeping Kaizen safe and protecting our rights (Article 6(1)(f)), our legal obligations (Article 6(1)(c)) where the law requires it, and protecting someone's vital interests (Article 6(1)(d)).

Who processes your data

We use these service providers to run Kaizen. They process your data on our behalf, under data processing agreements that allow them to use it only to provide their service to us and that require them to protect it. Some of them also use limited data for their own purposes, such as securing or measuring their own services, and are responsible for that part themselves.

Apple, Google, and Microsoft run the app stores, Apple and Google deliver push notifications (Google through Firebase Cloud Messaging on Android), and Google, Apple, and Discord provide sign-in if you use them. Stripe processes card payments for our web checkout through our own Stripe account and decides for itself how to prevent fraud and meet its legal duties. Google also runs the connection check the phone apps use, and Iconify, based in Estonia, runs the public icon service the web and Windows apps use. Discord, X, and Instagram run our community channels. For these parts, each of them acts under its own privacy policy.

We also share data when the law requires it, for example with a court or a regulator, and when we need it to defend a legal claim or to protect someone's safety. If Kaizen is ever sold or transferred, your data would move to the new owner, based on our legitimate interest in being able to sell or transfer the business (Article 6(1)(f)). We would require them to keep protecting it as this policy describes.

International transfers

Our main account database, usage statistics, and error reports are stored in Germany. The companies that run them are based outside the European Economic Area (Supabase in Singapore and the United States, PostHog and Sentry in the United States), and their staff can access the data from there, for example for support or security. Some requests to our servers, such as subscription updates from RevenueCat, can be handled for a moment in the Supabase data center closest to where they come from, which can be outside the EU. RevenueCat keeps your subscription details, user ID, email address, and username in the United States. Expo handles your push tokens, the text of your reminders, and app update checks there too. Kit, Notion, and Stripe are based in the United States, and Cloudflare and Google can process data in the United States and other countries, for example to deliver pages quickly or for security.

When personal data leaves the European Economic Area, one of two safeguards applies. For companies certified under the EU-US Data Privacy Framework, it is the European Commission's decision that the framework protects data well enough. For the others, it is the Standard Contractual Clauses: contract terms written by the European Commission that the provider has agreed to in its data processing agreement. For people in the United Kingdom and Switzerland, the UK and Swiss versions of these safeguards apply. You can check a US company's certification at dataprivacyframework.gov (opens in a new tab), read the Standard Contractual Clauses on EUR-Lex (opens in a new tab), or email us for the safeguards that apply to a particular provider.

If you live outside the European Economic Area, using Kaizen means your data is transferred to and stored in the European Union, and some of it is processed in the United States and the other countries named above.

How long we keep data

Deleted data can remain in our database backups for up to 7 days. If we need data for a legal claim or dispute, such as a chargeback, we keep only that data, and only until the matter is closed.

Deleting your account

In the app, or on the web at my-kaizen.app, open Settings from your profile, go to Account, and choose to delete your account. You can also email [email protected] from the address on your account and ask us to delete it. Deleting your account does not cancel your subscription, wherever you bought it, so cancel it first: in the App Store or Google Play, or, if you subscribed on the web or in the Windows app, under Settings, then Account, then Manage Subscription.

• Right away. You are signed out on the device you use, your other devices lose access within an hour, and you can no longer sign in. Your sign-in details are erased, except the security log described above. We remove your profile picture, remove the email address and username our apps gave RevenueCat, and ask PostHog to delete the statistics linked to your account and your PostHog profile. If you bought Premium on the web, RevenueCat keeps the email address you checked out with, together with your purchase records, so it can send your receipts.
• The next 30 days. Everything else in your account is kept for 30 days and then permanently deleted. To restore your account in that time, email [email protected] with the account's email address. Your profile picture and linked statistics cannot be brought back. Until the 30 days are over, reminders can still reach other devices where you were signed in. To stop them, turn off Kaizen's notifications in that device's settings, or remove the app there.
• What stays. Rooms you created can stay available to their other members, and after the 30 days they no longer have any link to you. Purchase records, your RevenueCat record, and the security log stay as described in the table above. Error reports expire within 30 days. Statistics that were never linked to your account cannot be found, so we cannot delete them; they drop out of our reports after one year, as described under Usage statistics.

Your rights

Because Kaizen is run from the Netherlands, the GDPR applies to everything we do with your data, wherever you live. You have the right to:

• access the personal data we hold about you and get a copy
• have it corrected
• have it deleted
• restrict how we use it
• receive it in a portable format
• object to our use of it (see below)
• withdraw your consent at any time, without affecting what we did before

If the law where you live gives you other rights, you can use those too, in the same way.

You can change your username, picture, email address, password, and settings in the app, turn "Help Improve Kaizen" on or off under Settings, then Privacy, and delete your account under Settings, then Account. For anything else, including a copy of your data, email [email protected]. We answer within one month. If a request is complex, or we receive many at once, we may need up to two more months; if so, we will tell you within the first month and explain why. If we are not sure a request comes from you, we may ask you to confirm your identity, for example by writing from the email address on your account.

Your right to object

You can object at any time to any use of your data that relies on our legitimate interests. That includes keeping your account secure, looking at account data, usage statistics, error reports, app update and connection checks, support, feedback, and our community, our website, handling refunds, disputes, and purchase records, keeping Kaizen safe, and a sale of the business. Email [email protected]. You do not have to explain why, but it helps us if you do. We will stop, unless we have compelling reasons that outweigh your interests, such as protecting Kaizen from attacks or handling a legal claim. If so, we will tell you what they are.

The app has no setting to turn off usage statistics or error reports. If you object to them, email us anyway, and we will reply within one month to tell you what we can do. Statistics that are not linked to your account carry no account ID, so we cannot tell which ones came from you, and we cannot find, show, or delete them (GDPR Article 11). On the web, a browser or extension that blocks tracking requests can stop both from being sent.

Complaints

If you want to complain to us, email [email protected] with "Privacy complaint" in the subject. We will confirm we received it within 30 days and tell you what we did about it.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (opens in a new tab), or to the data protection authority in the country where you live. In the United Kingdom that is the ICO (opens in a new tab), and in Switzerland the Federal Data Protection and Information Commissioner (opens in a new tab).

If you live elsewhere

United States. In the past 12 months we have collected:

• identifiers, such as your name, email address, user ID, username, IP address, and device identifiers
• visual information: your profile picture, if you add one
• commercial information: your purchase history
• internet or other electronic network activity: usage statistics and error reports
• the content you create in Kaizen

Your account login is sensitive personal information under California law, and we use it only to sign you in. We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you. You can use the rights in this policy wherever you live, and we will not treat you differently for using them. We do not track you across other websites or apps, and we do not let advertising networks do so through Kaizen, so we do not respond to Do Not Track signals. Some companies whose content loads on our website or in our web app may collect information about your activity over time and across other websites under their own policies: Kit and Notion on our newsletter and feedback pages, Stripe's payment form when you buy Premium on the web, and Iconify's icon service in the web app. See the Cookie Policy.

Everywhere else. You can use all the rights in this policy, plus any extra rights your local law gives you, by emailing [email protected], and you can complain to the privacy regulator where you live.

Children

Kaizen is for people aged 13 and over. If you are under 18, you need a parent's or guardian's permission to use it. We do not knowingly collect data from anyone under 13. If you believe a child under 13 has given us personal data, email [email protected]. We will look into it and, if the account belongs to someone under 13, delete it and its data.

Security

Your data is encrypted in transit, and our providers encrypt it at rest on their servers. Access to the services that store it is limited to us and, where needed for support or security, the providers' own staff. No system is perfectly secure, so we cannot promise that your data will never be accessed without permission, but we work to prevent it. If a breach is likely to put your rights at high risk, we will tell you without undue delay, as the law requires.

Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Changes to this policy

When our practices change, we update this page and the date at the top. If a change matters to you, such as collecting a new kind of data or using your data for a new purpose, we will also tell you in the app or by email. If you think something in this policy is unclear, wrong, or missing, email [email protected] and we will look into it and update the policy where needed.

Contact

MK Development, owned by Max Kruiswegt, Westerparkstraat 2U, 2042 AW Zandvoort, the Netherlands. KvK 89767810. Email [email protected]. For help with the app, including restoring a deleted account, you can also email [email protected]. Both addresses reach us.