Privacy

Last updated 28 September 2026.

Balermo is a to-do list. This page explains what personal data Balermo processes as data controller when you use it. Questions: kontakt@balermo.com.

What we store, and why

• Your account: email address and name. If you sign in with Google we also receive your Google ID and profile picture. We only ask Google for basic sign-in scopes (openid, email, profile), never your Gmail, Drive or Calendar.
• Your lists: the projects, tasks and notes you write.
• Sign-in links: when you ask for one, we store your email and a one-way hash of the link. It works once and expires after 15 minutes.
• Server logs: our host logs IP address, time and the page requested, to run and secure the service. Kept briefly.

The legal basis is performing our agreement with you (GDPR art. 6(1)(b)), and for server logs our legitimate interest in secure operation (art. 6(1)(f)).

Cookies

One strictly necessary cookie, sid, keeps you signed in. It holds a random session ID and nothing about you. No analytics, no advertising, no tracking scripts, so there is no consent banner.

Who receives data

We never sell data or use it for profiling. We use these processors:

• Simply.com A/S (Denmark): hosting and database. All data lives here.
• Resend: delivers sign-in emails, sent from its EU region.
• Google Ireland Limited: only if you choose to sign in with Google.

How long we keep it

Your account and lists are kept for as long as your account exists. Sign-in links expire after 15 minutes. Server logs are kept briefly by the host.

Your rights

You have the right to access, correct, delete and export your data, and to object to processing. Email kontakt@balermo.com and we will handle it. You can also complain to the Danish Data Protection Agency, datatilsynet.dk.