Your information in AutoDay.

Who is responsible for your information?

AutoDay is operated by SkatteFix AB, Swedish company registration number 559584-8796. SkatteFix AB is the controller for the processing described here.

Contact us if you have questions about what we store or want to exercise your rights.

Use the calendar without an account

Without an account, your calendar stays on your device. Activities, imported calendar files and planning suggestions are processed locally and are not synced to AutoDay’s server.

When you visit the website or the app contacts our services, we may still receive technical information, such as your IP address and browser. We need this to deliver and protect the service.

Creating an account is your choice. When you sign in, the account’s calendar and settings sync to our server so you can use them on several devices.

Information we process

• Account and sign-in. Your email address, optional name, account ID, protected password hash, and information about sessions, sign-in and email verification. We do not store your password in readable form.
• Your synced calendar. Activities, dates, times, titles, notes, calendar categories, imported entries, reminders and settings. Saved plans and your choices in Keep what matters may also be included.
• Shared commitments. The information you choose to share, participants’ account IDs, invitations and who has taken responsibility. Only the relevant participants receive access through this feature.
• Safer sharing. The accepted rules version and time, blocked account connections and any sharing restrictions. A report includes the relevant shared title, relevant account identifiers, reason, your optional description and moderation decisions. Reporting does not retrieve your private calendar or invitation code.
• Devices and reminders. Device ID, platform, optional device name, notification permissions, push address or token, and scheduling and delivery status. The server’s reminder outbox may contain a title and message.
• Plus and payments. Trial period, access and expiry. For purchases, we also process the order number, email address, amount, payment reference and necessary payment records. Payment providers handle card details; AutoDay does not store them.
• Support and security. What you send to support and technical logs needed for troubleshooting, security and preventing abuse.

Only enter information you want in your calendar. Avoid unnecessary sensitive information about yourself or others. You do not need to send passwords or a private calendar file with an initial support question.

Why we use this information

We process account, sync, reminder, sharing, Plus and service support information to provide the help and features you choose. The legal basis is performing our service contract or taking steps at your request before entering into a contract.

Technical security logs and abuse prevention rely on our legitimate interest in a working, secure service. We process accounting records to meet legal obligations. Support information is used to answer your question and handle your case.

Reporting, blocking and moderation in Shared responsibility help prevent abuse and handle violations, based on our legitimate interest in safe sharing. Only authorised people at SkatteFix AB can access the report queue. The Shared responsibility rules explain what can be reported and what action may be taken.

You choose whether to allow notifications and can change that choice in the app or device settings. AutoDay has no advertising tracking. We do not use your calendar for ads or sell your personal data.

Who may receive information?

Authorised people at SkatteFix AB may need access for support, operations and security. We also use providers for hosting, account emails and reminders. They receive the information needed for their work.

• Hosting. AutoDay’s server is hosted by Hostinger in Lithuania, within the EU. Accounts, synced calendars and other server information are stored there.
• Account emails. Our email provider processes the recipient address, message content and delivery information when we send verification or password reset emails, for example.
• Android push. Google Firebase Cloud Messaging is a fallback when the phone has not confirmed local scheduling. Google processes installation identifiers, push tokens and technical information, among other data. AutoDay’s native push contains neutral reminder text and delivery identifiers. The activity title and note are not sent in that push.
• Web Push. Your browser’s push provider, such as Google, Mozilla, Apple or Microsoft, relays an encrypted payload. It also receives technical information needed for delivery.
• Payment. For bank purchases, the bank processes the payment and we reconcile its reference. If you have a Stripe subscription, Stripe processes payment and subscription information according to its role and obligations. When Google Play purchases are offered, Google handles payment. AutoDay then uses an account link and protected proof of purchase to check subscription status and expiry.
• Klarna in web checkout. When Klarna is offered in Stripe’s checkout, your name, email, address and order information may be provided to Klarna through Stripe. Klarna uses it to assess available payment options and process payment. See Klarna’s privacy policy.

When you share a commitment, participants see its shared content. We may also need to disclose information where required by law or a valid order from an authority.

Some providers may process information outside the EU/EEA. Such transfers require a permitted basis, such as an applicable adequacy decision or EU standard contractual clauses. Contact support@autoday.se for details about recipients and safeguards for a particular type of processing.

How information is protected

Traffic between the app and AutoDay’s production server is protected with HTTPS. Sign-in uses session protection and access to server data is restricted. The Android app’s sign-in token is kept in the device’s secure storage.

Synced information is not encrypted so that only you can read it. AutoDay’s server can read synced calendar data. The local calendar in the browser or Android database also has no separate AutoDay encryption beyond the protection supplied by your device. Protect your phone and computer with a screen lock.

Local backups you export may contain readable calendar data. You choose where to save them and whom to share them with.

How long is information kept?

• Active account and calendar. Kept while you use the account, until the information or account is deleted. A deleted entry may remain as a deletion marker so the change can reach other devices.
• Sign-in. A remembered session normally lasts up to 30 days and may renew with use. Without Remember me, the server session lasts one day. Reset links last for the short period stated in the flow.
• Reminders and sync. Completed delivery records are pruned after 30 days. Technical keys preventing duplicate sync and plan approvals are pruned after 90 days. Pending deliveries may remain until processed.
• Support and security. Kept as long as needed for the case, security purpose or a legal claim.
• Shared content reports. Reports and moderation history become unavailable for review 90 days after the report was created, even if the case remains open. They are then deleted in the next daily cleanup, normally within one day. A decision does not extend this period. Account deletion removes rule acceptances, blocks and active sharing restrictions. Account links and optional report free text are minimised; a limited copy of reported shared content may remain until cleanup.
• Payment records. Necessary accounting information is kept through the seventh year after the calendar year in which the financial year ended, including after account deletion. An unpaid order’s reference and contact information may remain for 90 days after account deletion to resolve a late bank payment.
• Deletion reference. A separate technical reference with account identifier, time and status is kept as long as older backups may need to be restored. It prevents reactivating a deleted account from a backup and does not contain the calendar or password.
• Backups. Regular rotating database backups are pruned after 14 days. Separate deployment backups may remain longer for deployment verification and recovery. Backups are separate and are not removed at the same time as the active account. Completed account deletions must be handled before data from a restored backup is put back into use.

Your choices and rights

You can edit calendar information, export a backup and remove local profiles in the app. Removing a local copy does not delete a server account.

Use Delete your AutoDay account to request account deletion. It explains what is removed and which records we may need to keep.

Contact support@autoday.se to request access, correction, deletion, restriction or data portability where applicable. You can also object to processing based on legitimate interests. We may need to verify that the request comes from the right person.

We respond without undue delay, normally within one month. Complex requests may require up to two additional months; we will tell you within the first month and explain why. You can complain to the Swedish Authority for Privacy Protection, IMY.

Local storage and policy updates

The app uses local storage for the calendar, profile, language and appearance. On the web, necessary session cookies also support sign-in. AutoDay does not use advertising or analytics cookies.

Cookies and local storage lists names, purposes and retention periods for cookies, settings, calendar databases and offline caches. The web information notice does not mean you consent to analytics or marketing. You can reopen it through Cookies & storage.

We update this page if personal data processing changes. For significant changes, we also inform you within the service where needed. The date at the top shows when the policy text last changed.

Where information comes from

Calendar content, contact details, support questions and settings come from you. Technical information comes from your device and use of the service. Other participants may share commitments with you. Payment and push providers may supply status information needed for your purchase or reminder.

You initiate calendar file imports. Importing a file does not cause AutoDay to automatically retrieve information from SkatteFix or another calendar service.

What information do you need to provide?

You can use the local calendar without an account. An account and sync require an email address and sign-in details. Purchases require information needed to handle payment and deliver Plus. Without it, we cannot provide that particular feature.

You choose your calendar content, whether to share commitments and whether to enable notifications. Denying notification permission does not prevent calendar use. Do not provide more information about yourself or others than you need for planning.

Planning suggestions and automated decisions

AutoDay can calculate suggestions from times, priorities and your choices. You review suggestions before they change your calendar. We do not use the information for automated decisions that have legal or similarly significant effects on you.

If particular processing relies on consent, you may withdraw it for the future. This does not affect the lawfulness of earlier processing. Device notification permission and acknowledging the cookie information are separate from the legal basis for accounts, sync and payments.

Contact support@autoday.se for more about recipients, a copy of applicable transfer safeguards or to exercise your rights. Do not send passwords in your request.