Privacy Policy

NX Solutions UG (haftungsbeschränkt)
Schadowstr. 49
40212 Düsseldorf
Germany

E-mail: niklas@nx-solutions.de

For privacy questions, contact us at niklas@nx-solutions.de. We have not appointed a data protection officer as we are not required to.

The website, the app and the database run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. We have a data processing agreement with Hetzner under Art. 28 GDPR.

With every request, our servers store technically necessary information in log files: IP address, date and time, requested address, status code, amount of data transferred, and browser and operating system (user agent).

We need this data to run the services securely and reliably and to detect attacks (legitimate interest, Art. 6(1)(f) GDPR). Logs are deleted after 14 days unless they are needed longer to investigate a specific security incident.

We only use strictly necessary cookies and browser storage:

• a session cookie that keeps you signed in,
• short-lived cookies that secure signing in or connecting Google, Jira, GitHub, Todoist or Slack (protection against forged requests),
• an entry in your browser's local storage that remembers that you closed the introduction in the app,
• an entry in local storage and a cookie that remember your chosen color theme (light, dark, system) and language.

This storage is strictly necessary to provide the service you asked for (§ 25(2) no. 2 TDDDG), so no consent is required. We do not use analytics, tracking or advertising cookies.

While Weekmind is not yet open to everyone, you can join a waitlist at https://weekmind.app. For this we process your e-mail address, the language of the page, the time you signed up and confirmed, and the version of the consent text. We do not store an IP address for this.

We use double opt-in: after you sign up we send you an e-mail with a confirmation link. You only join the waitlist once you click it. If you don't confirm, we delete the entry after seven days.

We use the address only to send you the confirmation and to let you know when you can use Weekmind. You will not receive newsletters or advertising through it.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, for example with the link in every e-mail from us or by e-mail to niklas@nx-solutions.de; we then delete your entry right away. If you don't withdraw, we delete it 24 months after your confirmation at the latest, unless you have been invited by then; if you were invited, the data moves into your account or is deleted.

We use an e-mail service provider as processor under Art. 28 GDPR to send the e-mails.

You sign in with your Google account. Google gives us your name, e-mail address, profile picture and an identifier of your Google account. For each session we also store the IP address, user agent, and creation and expiry time so you can keep your sessions secure.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Sign-in is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google's privacy policy also applies: https://policies.google.com/privacy

In the sidebar, Weekmind shows your profile picture from Gravatar if you have set one for your e-mail address there. Our server fetches the picture from Gravatar: Gravatar receives the checksum (SHA-256 hash) of your e-mail address and the IP address of our server, not yours. Your browser never contacts Gravatar; the picture comes from us. We cache it for up to 24 hours (and the fact that there is none for one hour) so Gravatar is not asked on every page view. We don't store the picture permanently. Without a Gravatar you see your initials.

The legal basis is our legitimate interest in a personalised interface (Art. 6(1)(f) GDPR). The provider is Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA; its privacy policy applies: https://automattic.com/privacy/. You can object at any time (see contact), and you can delete the picture at Gravatar.

When you connect a Google Calendar, Weekmind asks for two permissions: reading your list of calendars, and reading and writing events.

• Reading: from the calendars you select, we store events with title, start and end, description, location, attendees, status and availability. We need them to know your fixed time and plan around it.
• Writing: Weekmind creates, updates and deletes planned blocks for tasks, routines and focus time in your calendar. If you turn it on for a calendar, Weekmind also adds neutral "busy" events without any details to your other calendars. Weekmind never moves or deletes events you created yourself.

We store the access tokens (OAuth tokens) encrypted. When you disconnect a calendar or delete your account, we remove the events we created, revoke access at Google and delete the stored calendar data.

Weekmind's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy. We only use calendar data to provide the planning features, never for advertising, never sell it and never use it to train general AI models. People only read it with your explicit consent, when needed for security, or when required by law.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

We store the tasks, routines and settings you create (for example title, duration, deadline, priority, working hours), the computed plans with their reasons, open proposals, and a change log so that changes can be traced and undone. The planning itself is computed by an optimisation solver on our own servers.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Automatic planning is not an automated decision with legal effect within the meaning of Art. 22 GDPR; you can move or pin every block.

These connections are optional. You sign in with the provider and grant access there; we never see a password. We store the access tokens encrypted and only for your account.

• Jira (Atlassian): we read open issues assigned to you with key, title, link, estimate, due date and status, and may register a webhook so changes arrive faster.
• GitHub: we read open issues assigned to you and pull requests waiting for your review, with title, link and status, in the repositories where you installed the app.
• Todoist: we read your open tasks with title, description, link, project, due date, deadline, duration and priority. In shared projects we only take tasks assigned to you or to nobody. We only read; we change nothing in Todoist.
• Google Tasks: we read your open tasks from all lists with title, notes, link and due date. This is a separate, read-only authorisation, apart from your calendar. We change nothing in Google Tasks.
• Slack: when you save a message to Weekmind with the shortcut or /task, we receive the message text, a link to it and your Slack user ID. We do not read any other messages.

When you disconnect, we delete the tokens and revoke access where the provider supports it (for Google Tasks you remove the authorisation in your Google account under “Security”; if you delete your account with us, we revoke it ourselves); tasks already imported stay until you delete them. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). The providers are Atlassian Pty Ltd (Australia), GitHub, Inc. (USA), Doist (Todoist), Google and Slack Technologies (USA or Ireland); their own privacy policies apply to their processing.

When you use the AI assistant or let it suggest duration and deadline, we send the data this requires to a language model: your message and the conversation so far, your name and time zone, and, depending on the question, tasks, routines, your plan and events from your calendar (such as titles, times, descriptions, locations and attendees) and, if you connected Jira, GitHub, Todoist or Google Tasks, issues, pull requests and tasks (such as titles, descriptions, notes and comments). The assistant only fetches these when your question needs them, and only your own. The model does not compute the plan; it understands your requests and writes the answers. We store conversations so you can continue them and undo changes.

• Default provider: without your own settings, Weekmind uses Ollama Cloud, operated by [Ollama, Inc., address]. Data is transferred to the USA on the basis of [EU-US Data Privacy Framework or standard contractual clauses, to be confirmed]. We have [a data processing agreement] with the provider and do not use your data for training.
• Your own provider (BYOK): if you add your own provider (e.g. Anthropic, Google Gemini or an OpenAI-compatible address) and key in the settings, the data goes to the provider you chose. We store your key encrypted and use it only for your requests. The provider's processing, including any transfer to third countries, is governed by the terms you agreed with them.
• Your own MCP servers: if you connect an MCP server in the settings, the assistant can call its tools. Search terms and parameters from your chat then go to whoever runs that server, and its answers are passed on to your AI provider. The token or header value for the server is stored encrypted. The server operator's processing is governed by their terms.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). These features are optional; the app plans without them.

With the REST API and the MCP server you can connect your own scripts and AI agents (for example Claude or Cursor). We store API keys only as a hash, and agent grants with name, permissions and timestamps. What an agent does with the data it retrieves is up to its provider. The legal basis is Art. 6(1)(b) GDPR.

Your data is only received by:

• Hetzner Online GmbH as processor for hosting,
• our e-mail service provider, if you join the waitlist (see above),
• the language model provider when you use the AI features (see above),
• Automattic (Gravatar) for your profile picture (see above),
• Google, Atlassian, GitHub, Doist (Todoist) and Slack, to the extent you connect them yourself and data has to be exchanged with them,
• authorities, where we are legally required to disclose it.

We never share data for advertising.

We store your data in Germany ourselves. Data only leaves the EU and EEA when you use services based elsewhere: Gravatar (Automattic), Google, GitHub, Slack, Atlassian and Doist (Todoist), and the language model provider. Such transfers rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, where the provider is certified) or on standard contractual clauses under Art. 46 GDPR.

We keep your data as long as you have an account. Calendar and integration data is deleted as soon as you disconnect the connection. When you delete your account in the settings, we end all sessions and block API tokens and agent access right away. We then automatically remove the calendar events we created, revoke access at Google and GitHub, remove our Jira webhooks and delete all your data, usually within a few minutes. If a provider can't be reached we keep retrying; after three days at the latest we delete your data on our side even if some events could not be removed at the provider. Sessions end when they expire or when you sign out; session data is deleted with your account. Data we must keep for legal reasons (such as invoices, once paid plans exist) is restricted until the retention period ends.

All connections are encrypted with TLS. Access tokens for calendars, integrations and your own AI providers are stored encrypted, API keys only as a hash. Access to the servers is restricted to a few people.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time with effect for the future. Many of these rights can be exercised directly in the app, for example by disconnecting connections or deleting your account; otherwise an e-mail to niklas@nx-solutions.de is enough.

Right to object: where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

You can also lodge a complaint with a data protection authority, for example where you live or where we are based. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.

We update this policy when we introduce new features or the law changes. The current version is always available here; we inform you about material changes in the app.