Privacy

Last updated: 2026-07-27

Preliminary version. It describes the actual state of the service on the date shown and is pending legal review before Citoo is offered commercially.

This page describes what data Citoo processes today. It is limited to what the software actually does: there is no analytics, advertising, profiling or data selling.

If you only browse the site

No data is requested and no tracking cookies are set. The server logs requests in order to run and troubleshoot the service; those logs include IP address, timestamp, requested path and user agent, and are not used to identify people or combined with other sources.

Your browser downloads a typeface from fonts.bunny.net, a third-party service. That request comes from your browser, not from Citoo, and like any web request it exposes your IP address to that provider. Citoo receives no data in return.

If you write to us

The site has no forms: contact is by email to hola@citoo.net. Whatever you send stays in that mailbox and is used only to reply to you and to keep a list of people interested in trying Citoo.

You can ask us to delete your address from that list at any time by writing to the same mailbox.

If you have an account

For a business account we store:

name and email address;
the password, always hashed (never in plain text);
if you sign in with Google, the identifier and email Google returns — we do not request access to your calendar or contacts;
the date of your last sign-in and your role within the business.

Cookies

Only two cookies are used, and only once you sign in: the session cookie (needed to keep you signed in, flagged HttpOnly and SameSite=Lax) and the CSRF protection cookie. There are no third-party, analytics or advertising cookies.

Where the data lives

Each business has its own database schema, separate from the others. The infrastructure runs on our own server; the database is not exposed to the internet and is reachable only through a private administration network.

Third parties

Today the only third parties involved are: the typeface provider described above, Google when you choose to sign in with Google, and the provider of the server Citoo runs on. There are no payment processors, bulk email providers or analytics tools connected.

Access, correction and deletion

You can ask us what data we hold about you, correct it or delete it by writing to hola@citoo.net. There is no self-service tool or export feature yet: requests are handled manually.

Changes

When the product adds features that process new data (payments, reminders, calendar synchronisation), this page will be updated before they are switched on.