Privacy policy

Controller

Cem Koch, Schillerstr. 23B, 13158 Berlin, Germany. Email: kontakt@nentropy.io. The full provider details are in the legal notice.

There is no data protection officer, because the legal conditions requiring one are not met. The German version of this page is the legally binding one.

If you only look at the website

Every request writes one line to the web server log: your IP address, the date and time, the address requested, the status code, the referring page and your browser's identifier.

These logs exist to run and secure the service, for instance to spot attacks and faults. The legal basis is the legitimate interest in a working and secure service (Art. 6(1)(f) GDPR). The logs are deleted automatically after 14 days.

Without an account nothing else happens. There are no tracking pixels, no ad networks and no analytics, and no fonts, scripts or images are loaded from other people's servers.

Cookies

Nentropy sets only the cookies it needs to work:

• Session cookie: keeps you logged in during a visit and protects forms against forged submissions. It expires when you close the browser.
• "Stay signed in" cookie: only if you tick that box when logging in. It lasts one week.

Both are technically necessary, so no consent banner asks about them (section 25(2) TDDDG). There are no tracking or advertising cookies.

If you create an account

Signing up takes an email address and a password. Stored are:

• your email address,
• your password, only as an irreversible hash,
• the language of the interface,
• whether you confirmed your address, and when the account was created,
• whether you want the daily reminder email,
• a source label if you arrived through a tagged link, for example from an ad. It only records which channel the sign-up came from and is not an advertising identifier.

The legal basis is performance of the contract of use (Art. 6(1)(b) GDPR).

Your content

Inside the account Nentropy stores what you enter: tasks with a title and notes, start and due dates, repeats, lists, tags and whether something is done. Added to that is what the AI derives: a priority, a reason, first steps, an effort estimate and a work-or-private classification.

The paragraph about your situation ("My context") is voluntary. It is the reason the order fits you, and you can change or empty it at any time.

The legal basis is again performance of the contract (Art. 6(1)(b) GDPR). Please do not write anything into tasks or into the context that you would not hand to a service provider, in particular no health data or other special categories under Art. 9 GDPR.

Analysis by an AI model

To analyse tasks and put them in order, Nentropy sends data to OpenAI, Ireland Ltd. and OpenAI, L.L.C., 1455 3rd Street, San Francisco, USA.

What is sent is only:

• the title of the task and its notes,
• start date, due date, creation date and an existing effort estimate,
• the paragraph about your situation, if you wrote one,
• for the ranking, a random identifier per task so the answer can be matched back.

What is not sent: your email address, your password, your IP address and your name. OpenAI does not learn who is behind the tasks, but it does see what is in them.

This transfers data to the USA. According to OpenAI, content sent through the programming interface is not used to train the models and is kept for at most 30 days to detect misuse.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR): rating the tasks is the function Nentropy exists for. If you do not want that, do not use the service; using it without the AI analysis is currently not possible.

The rating is a suggestion, not an automated decision with legal effect within the meaning of Art. 22 GDPR. You still decide what you do.

Emails

Nentropy sends you email: to confirm your address, to reset your password, when someone invites you to a shared list and, unless you turn it off, one reminder every morning about what is due. You can unsubscribe from the reminder in your profile at any time.

Sending runs through the hosting provider's mail server, which processes the recipient address and the content of the message.

Shared lists

When you share a list you enter the email address of the person you invite. It is stored to send the invitation and manage the membership. Everyone in a shared list sees its tasks with everything attached to them, and the email addresses of the other members. So share only what the others may see.

Recipients

Apart from the service providers named here, nobody gets to see your data. In use are:

• Hosting: a rented server in France, operated by Host Europe GmbH, part of the GoDaddy group. The database, the logs and the backups live there.
• Email delivery: the outgoing mail server of the same provider.
• AI analysis: OpenAI, as described above.

Nothing is passed on for advertising, and no data is sold.

How long data is kept

• Server logs: 14 days.
• Accounts with an unconfirmed email address: deleted automatically after seven days, provided they hold no content.
• Account and content: until you ask for deletion.
• Database backups: kept on the same server and deleted once they are no longer needed. A deletion can reach a running backup with a short delay.

Your rights

You have the right to information about your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21).

A self-service way to delete the account is being built. Until then an informal email to kontakt@nentropy.io is enough; the account and all its content will then be deleted.

Any data protection authority takes complaints; for Berlin it is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Changes

If the processing changes, this page changes. The date at the top says when it was last touched. Older versions can be followed in the public source code.