Agenda

Privacy Policy.

What Agenda collects, why, and how it's handled.

Last updated: 2026-07-14

This policy is available in English, Arabic, and Swedish. If there is any discrepancy between the translations, the English version prevails.

Data controller: Ylen Solutions AB ("we", "us"), Org.nr 559569-4380, Malmö, Sweden — the company established in the EU that decides how and why Agenda ("the app") processes your data. This policy explains what data the app collects, why, the legal basis for each, and your rights.

Data we collect

Data	Why	Stored
Email address	Account identity, login, invite/friend matching	Supabase (encrypted at rest)
Name, avatar	Display in shared events, contacts, chat	Supabase
Calendar events (title, time, location, notes, attendees)	Core app function	Supabase, scoped to your account
Voice recordings (temporary)	Transcribed to text for event creation, then discarded	Not stored by us — sent to a third-party AI provider for transcription (see Third parties)
Camera / photo library images (temporary)	Scanned for event details (e.g. a flyer or invite) or a contact's QR code	Not retained after processing
Chat / event messages	Coordination between people sharing an event	Supabase, visible only to participants
Push notification token	Reminders and event/DM notifications	Supabase, tied to your device
Contacts you explicitly add as friends	Social / sharing features	Supabase
Product analytics — which screens you open, which features you use, which AI tool was chosen (opt-in, off by default)	To understand how the app is used so we can improve it	Supabase; linked to your account; no event titles, message text, names or other personal content
Crash & error diagnostics — anonymous crash/error counts + a short technical location (on by default, can be turned off)	To keep the app stable and secure	Supabase; linked to your account; no titles, message text or names

We do not collect location, browsing history, or advertising identifiers. We do not sell any user data, and we never share analytics or diagnostics data with any third party — it stays on our own infrastructure.

Analytics & diagnostics

We collect a small amount of usage information to run and improve the app. It is pseudonymous: it is linked to your account (so we can honour deletion), but it never contains your event titles, message text, contact names, email, or any other personal content — only short, pre-defined values such as a screen name or a feature name. It is self-hosted and never shared with or sold to any third party. There are two separate, independently controllable categories:

Product analytics — opt-in (OFF by default). Which screens you open, which features you use, and which AI tool the assistant selected. Legal basis: your consent (Article 6(1)(a) GDPR) — nothing is collected unless you turn it on. Control it with the toggle shown on the sign-up screen and in Settings → Privacy → Product analytics; you can withdraw consent at any time, just as easily as you gave it.
Crash & error diagnostics — on by default. Anonymous crash and error counts to detect when something is breaking. Legal basis: our legitimate interest in the security and proper functioning of the service (Article 6(1)(f) GDPR; Recital 49). You have the right to object — turn it off in Settings → Privacy → Crash & error reports at any time.

Third parties & international transfers

Supabase — database and authentication hosting; stores your account and app data.
Railway — backend / API hosting.
AI providers — to turn what you type or say into calendar events, the relevant message text (and, for voice input, your audio recording) is sent to a third-party AI service for processing. Depending on configuration and availability, this may be one of: Groq, Cerebras, Google (Gemini), OpenRouter (which may in turn route the request to further downstream model providers), or NVIDIA. We send only the content needed for the feature — never your login credentials or unrelated data. Each provider processes the content under its own privacy terms; some may retain or use submitted content as described in their policies (for example, certain free API tiers). Because of this, avoid dictating or typing information you would not want processed by a third party. You may optionally add your own AI provider key in Settings, in which case your chosen provider is used for your requests.

Some of these providers are located outside the European Economic Area (EEA) (for example, in the United States). Where your data is transferred outside the EEA, it is processed under the safeguards each provider offers (such as Standard Contractual Clauses or an applicable adequacy decision) as described in their own policies. Analytics and diagnostics data is not sent to any of these providers — it stays on our EU-region infrastructure.

Your rights and controls

You can edit or delete any event, message, or contact from within the app.
You can delete your account and all associated data — including analytics and diagnostics — see Deleting your account.
You can turn product analytics and crash diagnostics on or off independently at any time (see above).
Camera / microphone / photo permissions are requested only when you use the related feature and can be revoked in your device settings at any time.

As a data subject under the GDPR you have the right to access, rectify, erase, and restrict the processing of your personal data, to object to processing based on legitimate interests, to data portability, and to withdraw consent at any time. To exercise any of these, contact privacy@ylensolutions.com.

Data retention

Account data is retained while your account is active. On account deletion, your data is removed within 30 days, except where retention is required by law. Analytics and diagnostics data is additionally subject to automatic time limits: product analytics is kept for up to 12 months and crash/error diagnostics for up to 6 months, after which it is deleted automatically. All of it is deleted immediately when you delete your account.

Complaints

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with your supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY, Integritetsskyddsmyndigheten) — imy.se. You may also contact the supervisory authority in your own EU/EEA country of residence.

Children

Agenda is not directed at children under 13. We do not knowingly collect data from children under 13.

Contact

Questions about this policy, or to exercise your rights: privacy@ylensolutions.com · Ylen Solutions AB, Org.nr 559569-4380, Malmö, Sweden.

Changes

We may update this policy; the "Last updated" date above reflects the latest revision.