Privacy Policy

1. Who is responsible

Kitdeck.io is operated by Schwinn Media, a sole proprietor based at Altstetterstrasse 183, 8048 Zurich, Switzerland ("Kitdeck", "we", "us", or "our"). Schwinn Media is the controller responsible for the processing described in this policy.

Privacy questions and requests can be sent to hi@kitdeck.io.

2. Data we process

Account and authentication data

We process your email address to create and identify your account and to send passwordless login links, one-time codes, and service notifications. For security and rate limiting, login requests also include the requesting IP address, timestamps, expiry information, and hashed authentication values. Session and OAuth state tokens are stored as hashes.

Connected social-platform data

When you choose to connect YouTube, Instagram, or TikTok, we receive OAuth credentials and data made available through that platform's official APIs. Depending on the platform and permissions available, this can include:

• account names, usernames, biographies, profile images, links, and follower counts;
• posts or videos, captions, thumbnails, publication dates, and public URLs;
• views, likes, comments, shares, saves, reach, engagement, and related performance statistics;
• audience information such as countries, age bands, and gender categories; and
• access and refresh tokens needed to refresh the data you requested.

OAuth credentials and cached social data are encrypted at rest. If you add a previous collaboration, its media-kit entry retains a snapshot of the selected post's title, URL, thumbnail, publication date, views, and likes. Kitdeck requests read-only analytics permissions and does not publish to your connected accounts.

Media-kit content and sharing data

We process the profile text, previous collaboration descriptions and tags, portfolio selections, rates, deliverables, recipient company name, and proposal text you add to a media kit. When you create a shared link, we store the selected sections and a fixed copy of proposal and rate information. We also record the first and most recent external access time, an access count, and notification-delivery status. We do not store a recipient's IP address in the shared-kit access record.

Communications and feedback

If you contact us or submit an idea, we process the message, any reply email you provide, the request IP address, and delivery metadata needed to respond, prevent abuse, and operate email forwarding.

Website analytics

With your consent, we use Google Analytics to understand aggregate website usage and improve Kitdeck. Google Analytics may process device, browser, approximate location, interaction, and cookie identifiers. We enable IP anonymisation. Your consent choice is stored in your browser's local storage.

3. Why we process data

4. How we share data

We do not sell personal data. We disclose it only as needed to operate the service, at your direction, or where legally required. Relevant recipients include:

• Hetzner: hosting and storage in Nuremberg, Germany;
• Resend: authentication, notification, feedback, and forwarded email delivery;
• Google: YouTube API access and, with consent, Google Analytics;
• Meta: Instagram API access;
• TikTok: TikTok API access;
• people receiving a shared link: the creator and analytics information you selected for that link.

These providers process data under their own terms and privacy notices where they act as independent controllers. We may also disclose information to advisers, authorities, or another operator involved in a reorganisation, but only where permitted by law and subject to appropriate safeguards.

5. International transfers

Our primary hosting is in Germany. Some providers, including social platforms and email or analytics providers, may process data in the United States or other countries. Where GDPR transfer rules apply, we rely on an adequacy decision, an approved data-transfer framework, standard contractual clauses, or another lawful safeguard as appropriate.

6. Retention and deletion

Kitdeck keeps account information, creator content, and previously imported encrypted social profiles, content, statistics, and analytics history while your account remains open because they are needed to provide the service. Each history is tied to the specific provider account, so different provider accounts have separate retained histories. This long-term history lets Kitdeck show development over time; the dashboard currently uses the latest 90 snapshots for its growth charts.

• Disconnecting a social platform stops Kitdeck's data access and refreshes and deletes the locally stored OAuth credentials and active refresh status. Previously imported encrypted profile, content, statistics, and analytics history remain while your Kitdeck account exists, but are hidden until you reconnect the same provider account. Connecting a different provider account creates and shows a separate history. Previous collaboration entries are creator-selected media-kit content and remain visible until you remove them or delete your account.
• Revoked shared links stop working immediately. Their configuration and access history remain in your account until the account is deleted so you can retain a record of shared decks.
• Deleting your account deletes the account and associated sessions, active social connections, active and retained social data and analytics history, profile, previous collaborations, preferences, rate cards, and shared kits from active storage, subject to the backup and legal exceptions below.
• Login links and codes expire after 10 minutes. Expired challenge records are removed after a short security and rate-limiting period. Sessions expire after 30 days.
• Feedback rate-limit records are removed after approximately 24 hours. The delivered message can remain in the relevant email mailbox until it is no longer needed.

Residual copies may remain temporarily in protected backups until those backups are overwritten. We may retain limited information for longer where required to establish legal claims, comply with law, or investigate abuse. Data that has been irreversibly anonymised is no longer personal data and may be retained indefinitely.

7. Cookies and privacy settings

Kitdeck uses essential HttpOnly cookies for the login challenge and authenticated session. These cookies are necessary to provide the service and cannot be disabled through our analytics settings.

Google Analytics loads only after you select "Accept." You can change your choice at any time with the "Privacy settings" link in the footer. Rejecting or withdrawing consent stops future analytics collection from this browser and removes Google Analytics cookies that Kitdeck can access. You can also remove cookies and local storage through your browser settings.

8. Shared links and your choices

A Kitdeck shared link is a bearer link: anyone who receives or forwards it can view the sections you selected without signing in. Review the recipient name, proposal, rates, and selected analytics before sharing. You can revoke a link from the Share Center at any time; revocation blocks future access immediately.

9. Your rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or a copy of your personal data, and to object to certain processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

You can disconnect individual platforms, revoke shared links, or delete your account directly in the dashboard. For other requests, email hi@kitdeck.io. We may need to verify your identity. You may also complain to the Swiss Federal Data Protection and Information Commissioner or, where GDPR applies, your local supervisory authority.

10. Security

We use measures designed to protect personal data, including encrypted OAuth and analytics data at rest, hashed session and authentication tokens, restricted public responses, secure cookie settings in production, and cache and search-indexing protections for shared kits. No internet service can guarantee absolute security.

11. Age requirement

Kitdeck is intended for people aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us so we can investigate and delete it.

12. Changes and contact

We may update this policy when the service or applicable law changes. Material changes will be communicated by an appropriate notice or email.