Privacy Policy
This policy explains how the Cleyo website and signed-in Cleyo apps handle your data, why we use it, who helps us process it, and how you can exercise your rights.
Who is responsible
Volodymyr Piskun, operating Cleyo in the Czech Republic, is responsible for the personal data described here. For privacy questions or requests, email privacy@cleyo.app. The owner personally handles these requests.
What we collect
- Waitlist data: the email address you choose to submit and, for quiz signups, your latest result profile. Campaign UTM values present in the link you used may be stored with the signup.
- Optional research consent: if you choose to help with product research, your preferred contact format (a founder call, a written questionnaire, or either) and the time you opted in. The landing does not collect your pain-point answers.
- Campaign data: the ad cell, the UTM parameters in the link you used, the host of the referring site (never its path), and whether an ad click identifier was present. The value of a click identifier is never stored.
- Anonymous website measurement context: coarse country, device class, operating system and browser family, page load time and its network and processing parts, connection type where your browser reports it, the version of the quiz page you were served, quiz landing scroll depth and in-app-browser status, plus a daily-rotating salted hash used only to count unique visitors per day. Necessary security and service diagnostics have separate purposes.
- Access and invite data: for a Cleyo account, whether it has access or is on the waitlist, the invite link the account owns and which invite it came in through, and the address and delivery state of the waitlist emails sent to it. Workspace reset preserves your login and prior access or waitlist status; it is not complete account erasure. For account-deletion requests, contact privacy@cleyo.app.
- Abuse-protection data: a one-way hash of your IP address for rate limiting. Raw IP addresses are not written to our waitlist database.
- Anonymous website events: page views, page engagement, concept-preview and quiz steps, the profile category your quiz answers resulted in, which numbered option you chose for each question and how many times you changed that choice (never any text, and never an answer you wrote yourself), when you go back a question or to the start, time spent on a step, how soon you first scrolled or tapped the landing page, how far down the landing page and your result you scrolled, which result sections came into view and which result parts you opened and how, shares (including whether the share sheet completed, was dismissed or failed) and clicks, and signup attempts. For each page load, the browser creates a random identifier held only in page memory. Cleyo stores it with received analytics events and sends it to PostHog as the event identifier; it is not saved in browser storage. Our separate daily visitor counting is described below. Turning measurement off does not prevent signup or your quiz result.
- Page speed, section time and errors: when you leave or hide the quiz page we record how fast it appeared (first and largest content shown, layout shifts, the slowest response to a tap, when the top of the page was ready, and which kind of element was largest), how many seconds each part of the landing page was on screen, how far down you scrolled, the last part you saw, whether and when the start buttons came into view, your screen height in broad bands, and how often you tapped a card, the deck or a question that responds but does not start the quiz. If the page itself fails, we record the kind of error, a short message with web addresses, email addresses, digits and quotation marks removed, and the name and position of the page file that failed. These are tied only to the random page-load identifier above, never to a name, an email address or your device, and the failures are also kept in our own error report so we can fix them.
Concept preview: this website preview uses three fixed sample tasks and does not accept free-form task text. Your sample selection is not stored, added to analytics, or sent to our servers. This statement applies to the preview, not to task or chat text you choose to enter in the Cleyo web app.
Signed-in work, Chat and saved context
Cleyo receives the Capture or task text you submit, task fields and Notes, checklist or shopping-list items, Streams, routines and your edits. It retains relevant interpretation, correction, action and synchronization history so your work can be saved, synchronized and restored.
Cleyo receives Chat messages and can send selected messages, task planning information and active saved details to its configured AI service. Chat task changes are proposals that require Apply. Deleting a conversation does not delete task changes or saved details already accepted from it; Forget this detail is separate.
Capture processing can send submitted text, Stream information, correction associations, bounded corrected examples and date/time-zone context to the configured AI service. Automatic synchronization repair can also send conflicting local and server task fields and apply a validated resolution while retaining recovery evidence. Completion conflicts use a deterministic path. Text can identify people even when a separate account email is not included.
Account, session, device and synchronization records support account operation and copies of your workspace. Activity and accepted corrections can support personal learning and suggestions. Saved context, correction memory and activity have separate controls and lifecycles; deleting one conversation or task does not establish erasure of every retained record or device copy.
Routine diagnostics use bounded operational metadata. Support or bug reports you deliberately submit can contain the description and attachments you choose to include. Account and application records, device copies and provider records have separate retention and access boundaries.
Signed-in app measurement. To understand whether people can start using Cleyo and continue getting value from it, we measure app visits, onboarding steps and completion, notification permission states, browser installation events and Home Screen use. We also count task creation, completion and editing, routines, Streams and submitted bug reports from application records. This measurement is linked to your Cleyo account; it is not anonymous website measurement. It does not copy task text, voice recordings, notification content or bug-report descriptions into the launch analytics records, and it does not join anonymous quiz visits to your account. Selected administrators can see aggregate results and account-level journey status in Cleyo's private dashboard. The new launch signals and daily summaries stay in Cleyo's database and are not forwarded to PostHog or diagnostic analytics providers. Detailed launch signals are retained for 14 days and account-linked daily summaries for 90 days; scheduled cleanup and outages can delay physical deletion. Existing account and workspace records have their own retention. We use this limited measurement for our legitimate interest in improving the application's usability and reliability (Art. 6(1)(f) GDPR). You can request access or object by contacting privacy@cleyo.app; the website's Privacy choices control applies to website measurement, separately.
Images you add to task descriptions are uploaded to Cleyo with their filename, type and size. Access follows the task: members of a shared task can read its images while they retain access. Removing an image from a description keeps its stored bytes available for Undo and delayed edits; the bytes are removed when the task is permanently deleted. Workspace reset removes images belonging to your private tasks. Images in shared work retained by another account remain, with your uploader attribution removed. Downloaded images can also be retained on each device for offline access, separately from the server copy. Signing out or a confirmed access refusal invalidates the corresponding device cache; device storage failures can delay physical cleanup. Older desktop-only attachments and backup copies have separate storage and deletion boundaries. The workspace download does not include image files.
On a browser where you have used your account, Cleyo stores an account attachment, saved workspace data and pending captures or task changes so you can work offline. These are account-scoped copies in local storage and IndexedDB on that device. The attachment contains account metadata, not your sign-in credential. Changes are sent only after the server confirms the same account; offline saving is separate from server acceptance and AI processing. Signing out hides the local workspace and stops pending sends, but retains unsent work for that account to recover after signing in again. Signing out offline cannot itself revoke the server session. Clearing the browser’s site data removes local copies, including work that has not reached the server. The service worker caches application files, not account API responses or credentials.
Voice Capture in the web and iPhone apps
The first time you use voice Capture in the web or native iPhone app, Cleyo asks you to agree before recording. The setting is stored on your account and cached on your device. You can withdraw it in Settings. Withdrawal stops new uploads on that device and attempts to remove pending recordings; local storage failures can prevent cleanup or preservation of the change. Other devices enforce the changed preference after synchronization, and the account-wide upload restriction takes effect when the server receives it.
Before Send, a recording stays on your device. Send uploads it to Cleyo’s API. In the web app, a pending recording can enter an account-scoped browser retry queue where available. In the native iPhone app, audio stays in protected app storage and a clip ID bound to your account and device is queued for retry. After the server confirms custody, Cleyo attempts to remove the local copy; deletion can fail. There is no general automatic age expiry for a pending retry copy.
The server stores accepted audio and sends it to Cleyo's configured AI service for transcription. Cleyo uses the transcript, date/time zone, Stream information and a bounded selection of open task titles to create and sort tasks. There is no required transcript review before tasks are created. Cancelling a client upload is not proof that the server received nothing. When the server receives voice Off, it cancels unfinished voice Capture work for your account, invalidates processing leases and removes the canceled work’s audio, transcript and plan from the active task database. Late results cannot create tasks from that canceled work, and turning voice back on does not revive it. Tasks committed before withdrawal remain. Offline changes await the server, local cleanup can fail, and cancellation does not prove that a request or other copy already received by a provider was recalled.
Audio is scheduled for deletion 24 hours after successful task processing or a no-spoken-words result, or seven days after terminal processing failure. Retry clears the previous failed-audio deadline; a new deadline is set when the new cycle reaches a terminal result. No fixed maximum applies while processing remains unfinished. Transcription alone does not start the successful-processing expiry. Periodic cleanup and outages can delay physical deletion. Transcripts, processing records and tasks can remain after the audio expires; these schedules do not determine provider or backup copies.
Field dictation is separate: dictating into a Chat or task field sends audio through Cleyo's authenticated transcription API to the configured AI service. The text returns to the field for review and editing. This Cleyo API path does not persist its audio or transcript in the task database; that does not establish the upstream service's handling. Native macOS dictation uses its on-device path. Routine voice diagnostics exclude audio and transcript content.
Why we use website and waitlist data and our legal bases
- To place you on the waitlist, answer your requests, and send Cleyo early-access or launch updates: your consent.
- To contact you for an optional founder interview or written product-research questionnaire, using the format you selected: your separate research consent.
- To measure anonymously how the website and quiz are used, including which campaigns bring visitors: our legitimate interest in understanding and improving the website and our campaigns (Art. 6(1)(f) GDPR). You can object at any time with Privacy choices then Turn off measurement. Objecting does not affect your quiz result, signup or separate research choice.
- To tell Meta that your quiz signup came from its ad, only when you tick that box: your consent (Art. 6(1)(a) GDPR), see A Meta conversion signal.
- To protect the form from abuse, keep the service reliable, and diagnose failures: our legitimate interest in security and service operation.
Joining the waitlist is voluntary. If you do not provide an email address, you cannot join it. Product research is separately optional: declining it does not affect your place on the waitlist. You may withdraw consent for the waitlist or for product research at any time.
Analytics and browser storage
Cleyo measures use of the homepage and quiz anonymously: page views, quiz steps, the resulting profile category, timing, shares and clicks, and signup attempts, together with campaign parameters (UTM values and whether an ad click identifier was present, never its value), the referrer host, coarse country, device class and in-app-browser status. Events are stored by Cleyo in Cloudflare D1 and sent to PostHog (EU Cloud) without your IP address, person profiles or cookies. Measurement identifiers are not saved on your device. Browser events use a random per-page identifier that is not saved in browser storage. Cleyo stores it with received analytics events and sends it to PostHog as the event identifier. Cleyo's separate daily visitor hash can group requests with the same IP address and browser user agent within a day. We do not send your email address, task text or quiz answer text in these events. The quiz also records sessions, as described next.
Quiz session recordings. On the quiz at cleyo.app/quiz, after the page has loaded, we record how the page looked and what you did on it (taps, scrolling, the screens you saw and how long you stayed) so that we can see where the quiz is unclear and fix it. The recording uses PostHog session replay (EU Cloud). Everything you type, including your email address, is masked in the browser before anything is sent. The email address shown after signup is also masked. Console messages and network requests are not recorded. The recording code is part of Cleyo's own quiz files, and recordings travel through Cleyo's server to PostHog without cookies and without your IP address. It uses the same random per-page identifier as the events above, held only in page memory; the recording does not save an identifier in your browser storage. No recording starts when you have turned measurement off, when your browser sends the Global Privacy Control signal, or on test and automated visits, and turning measurement off stops a recording in progress. The PostHog project is currently configured for a 30-day recording retention period. The legal basis is the same legitimate interest in improving the quiz (Art. 6(1)(f) GDPR), and you can object in the same way.
You can turn measurement off at any time through Privacy choices on the homepage or quiz, then Turn off measurement, and turn it back on the same way. Your choice is saved as a single value in your browser storage, which is strictly necessary to honour it; it is not a tracking identifier. Turning measurement off stops new measurement requests and attempts to abort pending ones. If the browser cannot save the choice, the current page still follows it and you are told it may not persist. An event already received cannot be recalled, and the choice applies per browser.
To count how many different people visit in a day without storing anything on your device, our server computes, in memory, a one-way hash of your IP address and browser user agent combined with the site name cleyo.app and a random salt that changes every day. The hash is stored with analytics events and is never sent to PostHog; the raw IP address and full user-agent string are not stored in those rows. Scheduled cleanup attempts to delete salts from earlier days; failures can delay deletion. The existing daily hash also chooses quiz experiment versions, without storing an experiment identifier on your device. The same IP address and browser user agent within a day normally receive the same versions; a new day or changed network or browser details can change them. If the hash cannot be computed, a version is chosen at random for that request. This happens when the page is requested, before the browser can read your saved Privacy choices; this assignment is not disabled by Privacy choices or Global Privacy Control. We also store the coarse operating system and browser family (for example iOS or Instagram in-app browser), how long the page took to load, how far down the quiz landing page you scrolled, and the campaign parameters utm_term and utm_id when an ad link carries them (values that look like an email address are discarded). We also count the quiz pages our server delivers: one row for each page request, with a random identifier that is generated on the server and never sent to your browser, the campaign parameters in the address (never a cookie), coarse country, device class, operating system and browser family, and whether your browser fetched the page in advance. Because this count is made when the page is requested, before any script runs, the Privacy choices setting does not apply to it, but it is skipped when your browser sends the Global Privacy Control signal; it contains nothing that identifies you and follows the same scheduled 400-day deletion period described below. So that link previews, ad-review crawlers and other automated traffic do not count as visitors, we label each event as human, crawler, hosting network, automation or test. The label is worked out in memory from the user agent, the network operator and whether your browser reports that it is driven by automation or the address carries a test marker, and only the label is stored. For the quiz landing page we also record whether the page was visible when it loaded.
Cleyo schedules anonymous measurement events for deletion after 400 days; cleanup failures can delay deletion.
After a successful waitlist signup, the landing page stores a random signup token and a completion marker in local storage so the server-side completion can be recorded, the optional research prompt can be restored, and the confirmation state can be shown. The landing page and quiz do not store your email address, research preference, pain-point answers, or task text in browser storage. Measurement itself writes nothing to your browser storage. Earlier versions of the quiz could store a random visitor identifier, a tab-session identifier and campaign attribution; current versions remove those old values when a page loads. Confirmed waitlist deletion attempts to clear the declared landing and quiz values in the browser where you confirm. Storage failures or other attribution/handoff copies can remain; it cannot clear another browser or device. Web voice recordings waiting to be sent are kept in browser storage on your device as described above.
Cloudflare page analytics has separately appeared in served HTML. The Privacy choices setting controls Cleyo's own measurement events; it does not establish the current edge-managed analytics setting or stop a separately inserted Cloudflare beacon.
Email opens and link clicks
Resend's open and click tracking settings are enabled for the cleyo.app sending domain. These domain settings apply to sign-in, verification and password-reset emails, waitlist confirmations, access invitations and other email sent from that domain.
When tracking is active, an image in an HTML email can record an open when loaded. Mail software can load that image without you reading the email, or block or cache images so an open is not recorded. Tracked links can pass through Resend before opening their destination and record a click associated with the message. These signals can be associated with the email sent to your address; they do not establish that a human read the email.
The Privacy choices control on this website does not turn off email tracking. Unsubscribing from optional mail changes that delivery preference; it is separate from any request to delete engagement records Resend has already received. These records have separate retention. Cleyo's website-event and waitlist deletion schedules do not establish deletion of Resend's email records or backups.
Who receives the data
- Configured AI services: process submitted Capture/Chat text, relevant context, conflicting task fields and audio sent through web or native iPhone voice Capture or field dictation. Cleyo's server holds workspace and accepted Capture records in PostgreSQL; the transient field-dictation API path does not persist its audio or transcript in that task database.
- Google and Apple: process authentication when you choose their sign-in methods.
- Sentry and Logfire: receive application and operational diagnostics when configured. Deliberately submitted support reports can contain the content you choose to provide.
- Cloudflare: website hosting, request delivery, D1 database storage, security, page analytics where enabled at the edge, and operational logs.
- PostHog: anonymous website analytics, using its EU Cloud region in Frankfurt, Germany. Events and quiz session recordings are sent without your IP address and without person profiles.
- Resend: sends the email confirming that you joined the waitlist (when you signed up from a quiz result, it includes that result and a link to it) and the early-access invitation when your access opens, to the address you signed up with. It also sends a purpose-specific email confirmation link when you request waitlist deletion. The link expires after 10 minutes. We store only its hash and expiry, bound to your signup, and deletion requires an explicit confirmation. When configured, Resend also delivers support reports and any attached screenshot to Cleyo, with the supplied report and technical/account details.
- Meta Platforms Ireland: only when you tick “Tell Meta this signup came from its ad.” under a quiz email form, one “Lead” event with a hash of your email address and the ad click identifier (see below).
- Telegram: internal signup notifications. Notifications contain only a masked email address plus campaign context; the full email address is not sent to Telegram.
Cloudflare operates a global network and Telegram may process data outside the EEA. Cleyo's local retention schedules do not establish every recipient's handling or copies. Provider-specific account terms and transfer arrangements depend on the actual service being used. Cleyo’s configured gateway and model names do not establish each upstream service or account’s training, retention or transfer terms; those service-specific assurances have not been confirmed for every route. For available information about applicable safeguards, contact privacy@cleyo.app.
A Meta conversion signal, only when you tick the box
Cleyo runs no Meta Pixel and sets no cookie for Meta. When you sign up from the quiz after arriving from a Meta (Facebook or Instagram) ad, the email form shows an optional box, unticked by default: “Tell Meta this signup came from its ad.” Only if you tick it and your signup is saved as new, Cleyo’s server sends Meta one “Lead” event. It contains a SHA-256 hash of your email address (a scrambled code, not the address itself), the ad click identifier from the link you arrived on, the time and a random event number. This lets Meta count the ad as having led to a signup, show it to similar people, and stop showing it to you. Nothing from the quiz (your answers or result), no IP address and no browser details are sent. Test signups never send it.
The legal basis is your consent (Art. 6(1)(a) GDPR). Ticking is optional: signing up without it works exactly the same. With your signup we keep when you ticked the box and which wording you saw. An event already sent to Meta cannot be recalled; you can write to privacy@cleyo.app about it. Meta Platforms Ireland handles the event under Meta’s own data policy. Apart from this one event, the value of an ad click identifier is not stored or passed to analytics providers: measurement records only whether one was present.
How long we keep data
Our intended retention period for waitlist records, including any optional research preference and consent timestamp, is 12 months after signup. Scheduled deletion is temporarily paused, so records may remain beyond that period while the pause is in place. You can request deletion at any time using the confirmation form below. Rate-limit records are short-lived and routinely purged. Cloudflare operational logs and processor backups have separate retention under the applicable provider’s policy; Cleyo’s local schedules do not establish those copies.
Your rights and controls
Depending on the applicable law, you may request access, correction, erasure, restriction, objection or a portable copy. Email privacy@cleyo.app. We may verify proportionately where needed to protect your information. For EU rights requests, we respond within one month; where justified by complexity or number, we explain an extension of up to two further months within the initial month. Applicable conditions and lawful exceptions can affect the response.
The Settings workspace download contains current work and selected history, including retained Chat and saved details. It omits separate original Capture records, attachment files, correction/memory and activity records and other technical/provider information. Original text or a voice transcript may remain in exported task content. It is a partial workspace export, not a complete personal-data response. Contact us for the latter.
Self-service account deletion is not currently available. Workspace reset removes account-owned workspace records, revokes sessions and retires the principal while preserving profile/login. It does not establish full account, recipient, device or backup erasure.
You may complain to the Czech Office for Personal Data Protection (ÚOOÚ) at uoou.gov.cz/en, or the competent EU supervisory authority where you live or work.
Automated decisions and children
We do not use website data to make legal or similarly significant automated decisions about you. This pre-launch waitlist is not directed to children under 16.
Delete your waitlist data
Enter the email address you used to join and request a confirmation link. Opening the email link does not delete anything: you must then select “Confirm deletion”. Responses do not reveal whether an address is on the waitlist. Confirmed deletion removes the authoritative waitlist record; analytics processor cleanup is best effort, and provider logs or backups may remain under their retention policies.
Changes and contact
We will update the date at the top when this policy changes materially. Questions about this policy or Cleyo’s data handling: privacy@cleyo.app.