THE SMALL PRINT
Privacy, in plain words
This policy covers SITUKIT: the app at app.situkit.com, the desktop app, and this site with its waitlist. It says what we hold, why we hold it, who else touches it and what you can do about it.
Last updated 31 October 2026
What we hold
Your account, what you put into SITUKIT, and the accounts you choose to connect, such as a Google calendar or your contacts. On the waitlist, only your email address.
What we do with it
Run SITUKIT for you, and nothing else. We do not sell it or use it for advertising. AI features see only what you let them, and data from Google is used only to show it back to you.
What you can do
Export everything, disconnect any account, switch AI off or delete your account, all from inside the app. For anything else, write to hello@situkit.com.
THE DETAIL
What happens to your information
Twelve clauses cover everything SITUKIT holds. After them comes the detail on data from Google and other connected accounts, and on AI.
Who we are
SITUKIT is run by SITUKIT Ltd, a company registered in England and Wales and based in Bristol. We decide how the information in this policy is used, which makes us its controller under UK GDPR. Clause 12 says how to reach us.
What we collect
Your account: name, email address, a profile photo if you add one, language, time zone, plan, and how you sign in (Apple, Google, Microsoft, a passkey or an emailed link). For each signed-in session, the IP address and browser it came from. Everything you put in: objectives, projects, tasks, habits, notes, schedule, people, principles, visions, uploaded files, feedback and AI settings. The accounts you connect, described below. On the waitlist: your email address, when you joined and the page's language.
Why we use it
To provide SITUKIT to you under our terms; to keep it secure, prevent abuse and fix what breaks, which is our legitimate interest; and to send the emails it needs, such as sign-in links and the reminders you turn on. The waitlist's one email rests on your consent. We do not sell your information, use it for advertising or build profiles to market to you.
Where it lives
In databases run for us by Neon on Amazon Web Services in the United States, with uploaded files in Vercel's storage. Those hosts encrypt everything in transit and at rest. On top of that, SITUKIT encrypts your notes about people and the credentials of the accounts you connect, with a key kept outside the database. If you are in the UK or the EU, your information is transferred to the United States under the safeguards our processors provide for such transfers, such as standard contractual clauses.
Who else handles it
Only the companies that help run SITUKIT, as our processors: Vercel (hosting, file storage and visit counts), Neon (databases), Resend (email), Anthropic and OpenAI (only when you use an AI feature; see below), Stripe (payments, if you buy a plan) and Unsplash (the words you type when you search for an image). Apple, Google and Microsoft take part when you sign in with them or connect them. We do not sell, rent or swap your information, and we share it otherwise only when the law requires it.
Cookies and analytics
SITUKIT sets the cookies it needs to keep you signed in, and NEXT_LOCALE, which remembers your language. Visits are counted with Vercel Web Analytics and Speed Insights: which page, the country, the kind of device and browser, and how fast it loaded. They set no cookie and never see your account. No advertising cookies, no fingerprinting and no tracking pixels in our emails.
How long we keep it
For as long as your account is open. Delete it from Account and it is removed seven days later, unless you change your mind first; database backups roll off within seven days after that. Disconnecting an account stops its reads at once, and the section on connected accounts below says what is removed and when. Waitlist addresses are kept until we let you in or you leave. Our host keeps short-lived operational logs to run and secure the service.
Your rights
You can ask what we hold about you, get a copy (Account › Your data exports it), correct it, have it deleted, or object to or restrict how we use it. Write to the address in clause 12 and we answer within a month, usually the same week. If you are unhappy with our answer, you can complain to the ICO, the UK regulator, or to the data protection authority where you live.
Automated decisions
None with legal or similarly significant effects. AI features suggest; they never decide anything about you. They are optional, and the section on AI below says what they can see and how to switch them off.
Children
SITUKIT is not for children under 13, and we do not knowingly hold information about anyone under 13. If you think a child's account or address has ended up with us, tell us and we delete it.
Keeping it safe
Only the people who run SITUKIT can reach production systems, behind strong sign-in. Credentials and notes about people are encrypted by us as well as by our hosts. If a breach puts your information at risk, we tell the ICO within 72 hours where the law requires it, and we tell you in plain words: what leaked, when, and what we are doing about it.
Changes, and who to talk to
If this policy changes in a way that matters, we say so in the app or by email before it takes effect, and the date at the top moves. hello@situkit.com reaches a person, not a queue: questions about this page, requests under clause 08, and anything that reads as unclear all go there.
Data from Google and other connected accounts
If you sign in with Google, SITUKIT asks for your name, email address and profile picture to identify your account, and asks to read your Google Calendar and Google Contacts. Google's consent screen lists each permission, and SITUKIT works without either of the last two. You can also connect a Google calendar later, from Account › External calendars.
With calendar access, SITUKIT reads the list of your calendars and the events on the calendars you choose: each event's identifier, title, start and end, time zone, type and status, and its attendees' email addresses and responses. We use them to show your events in Schedule and to keep the time you plan from clashing with them.
With contacts access, SITUKIT reads your contacts' names, email addresses, phone numbers and identifiers, so you can review them in Relationships and choose who to add. Nobody joins your directory until you say so.
SITUKIT only reads. It cannot create, change or delete anything in your Google Calendar or Google Contacts, and it does not read Gmail. We use Google data only to provide and improve the features described here. We do not sell it, use it for advertising, or use it to train AI models, ours or anyone else's. People at SITUKIT do not read it unless you ask us to about a specific item, it is needed for security such as investigating abuse, the law requires it, or it has been aggregated and anonymised to run the service.
Google data is shared only with the processors in clause 05 that store and run SITUKIT, and it reaches an AI model only in the ways the next section describes, which you control.
Imported records are stored on our servers, and the tokens that let SITUKIT keep them up to date are encrypted. You can disconnect in Relationships › Connected accounts or Account › External calendars, or revoke access at any time at myaccount.google.com/connections. Disconnecting asks Google to withdraw SITUKIT's access, stops reading, deletes the connection's stored token, removes that connection's events from Schedule straight away, and deletes its other imported records after 24 hours. People you chose to add to your directory are yours and stay until you delete them. Deleting your account revokes access and removes all of it.
SITUKIT's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
The same rules apply to the other accounts you can connect: Microsoft (Outlook calendar and contacts, and if you connect mail, who you wrote to and heard from and when, with subject lines only if you turn that on), Apple iCloud calendars and contacts, calendar links, and the WhatsApp exports and phone logs you upload.
AI features
AI in SITUKIT is optional. It is off on Free and Plus. On Pro, including the trial, AI features start on, and Account › AI lets you switch each feature, and each area of the app it may read, on or off. Relationships stays closed to AI until you open it. Every AI request is listed in Account › AI activity.
When you use a built-in AI feature, SITUKIT sends what that feature needs to the model you picked, from Anthropic (Claude) or OpenAI, which process it to give you an answer. Under their terms for business customers, they do not train their models on it. From your schedule they receive only when your time is booked, never event titles, and they never receive your contacts. If you add your own Anthropic or OpenAI key, those requests go to your own account with that provider, under your terms with them.
You can also connect an AI app you already use, such as Claude or ChatGPT, with a key you create in Account › AI connections. It reads only the areas you open for that key: with Schedule open it receives your events' titles and times, including events imported from Google; with Relationships open, your contacts' names. That app's own terms govern what it does with them. Pause or revoke the key at any time and its access stops at once.
SITUKIT never sends data from Google to an AI model for training, and sends it only to provide a feature you use or to an app you connected yourself.
Wondering what using SITUKIT commits you to?Read the terms