Cozy Todo
← All links

Privacy Policy

Privacy Policy for Cozy Garden

Last updated: 8 September 2026

Public text

Privacy Policy

1. Controller

The controller responsible for the processing of personal data in the Cozy Garden application is:

WELLREAL UG
Hertha-Lindner-Straße 10–12
01067 Dresden
Germany

Email: hello@cozytodo.app

Commercial register: HRB 31026
Register court: Local Court of Dresden
VAT ID: DE285006661
Managing director: Evgeni Lapanik

No data protection officer has currently been appointed. For data protection questions, please contact hello@cozytodo.app.

2. Overview

We process personal data only to the extent necessary to provide, secure and develop Cozy Garden, to perform contractual obligations, or where required by law.

Cozy Garden does not use its own analytics, marketing or advertising trackers. The Cloudflare Turnstile security check used at registration solely prevents automated or abusive account creation and is described in more detail in section 8. We do not sell personal data or use it for personalised advertising.

3. Use without an account

Where available, Cozy Garden can be used without a user account. In that case, we generally store tasks, lists, notes, tags, links and settings locally in your device's browser.

This local data is not transmitted to our servers while you do not use a user account or server-side synchronisation.

You can delete locally stored data through your browser settings. This may cause your content to be irretrievably lost.

4. Registration and user account

When you register, we process:

  • name;
  • email address;
  • password only in hashed form;
  • time of registration and email verification; and
  • technical session and security data.

We process this data to create your user account, enable you to sign in, verify your email address and provide the application. The legal basis is Article 6(1)(b) GDPR.

For security and abuse prevention, particularly during registration and sign-in, we may also process IP address, timestamps and technical log data. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the security and stability of our service.

5. Server-side storage and synchronisation

If you use a verified user account, we store and synchronise the content you create in Cozy Garden. This may include tasks, lists, notes, tags, links, archived data, settings and editing status.

Processing takes place in order to provide the agreed digital service. The legal basis is Article 6(1)(b) GDPR.

Cozy Garden is not intended for the storage of special categories of personal data, such as health data, data concerning religious beliefs or trade union membership. Please do not store such data in your tasks or notes.

6. Hosting and server operations

Our website, application, database and backups are operated on servers of Hetzner Online GmbH in Germany.

Hetzner processes personal data on our behalf and under our instructions under a data processing agreement pursuant to Article 28 GDPR.

Whenever you access our website or application, technically necessary data may be processed in server log files. This includes, in particular, IP address, date and time of access, requested content, volume of data transferred, messages about successful or failed access, browser type, operating system and referrer URL, where your browser transmits it.

We process this data to ensure security, analyse errors and provide Cozy Garden reliably. The legal basis is Article 6(1)(f) GDPR.

7. Emails

Confirmation emails, password-reset links, security-related notifications and necessary messages about your user account are sent by the server-side application through Hostinger Email. We do not send newsletters or promotional emails unless you have separately consented to them.

For delivery, Hostinger processes email address, name, message content, sending time and the technical data required for delivery and abuse prevention on our behalf. The legal bases are Article 6(1)(b) GDPR and, for security-related communication, Article 6(1)(f) GDPR. We enter into a data processing agreement with Hostinger; the applicable Hostinger contracting entity and any sub-processors are identified in the customer account and the Hostinger Data Processing Addendum.

8. Protection against automated registrations: Cloudflare Turnstile

At registration, we load Cloudflare Turnstile to detect and prevent automated or abusive account creation. According to Cloudflare, it processes in particular IP address, TLS fingerprint, user agent, Turnstile site key and the related request origin for this purpose. When the check is verified server-side, we also send the IP address and the verification token issued by Turnstile to Cloudflare.

The provider is Cloudflare, Inc. Cloudflare acts as a processor when protecting our website; according to Cloudflare's own information, it also processes the signals as an independent controller to improve bot detection. The legal basis for our processing is Article 6(1)(f) GDPR; our legitimate interest is to protect registration and the application against abuse. The access to information on your device required for this purpose takes place, where applicable, under section 25(2) no. 2 TDDDG. Registration is not possible without this security check. Further information is available in Cloudflare's privacy policy.

9. Payments with Stripe and Link

When you take out a paid Premium subscription, we redirect you to Checkout provided by Stripe. For payments through Stripe Managed Payments, Sold through Link, LLC ("Link") acts as the merchant of record. Link/Stripe processes the payment, billing and contact data you enter at Checkout, as well as transaction and fraud-prevention data, independently under the terms and privacy notices shown there.

We transmit to Stripe only the data required to identify and complete Checkout, in particular your email address, an internal reference, the selected billing interval, and price and currency information. We do not receive or store complete credit-card or bank-account details. Where necessary for Premium access and accounting, we process Checkout, customer, price and subscription identifiers, payment status, amount, currency and relevant timestamps.

Processing takes place to perform the contract and handle payment under Article 6(1)(b) GDPR, and to fulfil statutory retention obligations under Article 6(1)(c) GDPR.

Stripe and Link may also process data outside the European Economic Area. Where required, such transfers take place based on an adequacy decision, in particular the EU-US Data Privacy Framework, or appropriate safeguards such as the European Commission's standard contractual clauses. Under Managed Payments, Stripe states that Link/Stripe sends payment receipts, invoices and certain subscription notifications directly. Further information is available in Stripe's privacy policy and in the notices displayed at Checkout.

10. Cookies and local storage

We use only technically necessary cookies and local browser storage:

  • session cookies for signing in and securely using a user account;
  • a CSRF-protection cookie to secure requests;
  • local browser storage for guest content and synchronisation settings; and
  • Turnstile signals and, where applicable, cookies required to prevent automated registrations.

These technologies are necessary to provide the service you expressly request. The legal basis for the associated processing of personal data is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR; access to your device takes place, where applicable, under section 25(2) no. 2 TDDDG.

We do not use marketing or analytics cookies. If this changes, we will first obtain any consent required and update this privacy policy.

11. Recipients of personal data

We transfer personal data only where this is necessary to provide our service, where a legal obligation exists, or where you have consented.

Recipients may include, in particular:

  • Hetzner Online GmbH as a hosting provider in Germany;
  • Cloudflare for the Turnstile security check;
  • Stripe and Link for payment processing and order management;
  • Hostinger as the email service for delivery of necessary account messages; and
  • competent authorities, courts or advisers, where we are legally required to do so or where necessary to establish, exercise or defend legal claims.

Processing outside the European Economic Area cannot be ruled out for Cloudflare, Stripe/Link and Hostinger. Where a transfer to a third country takes place, we rely on an adequacy decision, in particular the EU-US Data Privacy Framework, or appropriate safeguards such as the European Commission's standard contractual clauses. Details of the respective processing and safeguards can be found in the providers' privacy notices and data processing agreements.

12. Retention periods and deletion

We retain personal data only for as long as necessary for the relevant purpose.

  • User accounts and stored content are retained until you delete your account.
  • After account deletion, we delete the related active account, session and content data without undue delay.
  • Backups are overwritten or deleted in the regular cycle no later than a further 30 days later.
  • Server security and access logs are generally deleted after 14 days unless they need to be retained longer to investigate a security incident or to establish, exercise or defend legal claims.
  • Raw data from Stripe and historical Paddle webhook events, as well as Checkout responses that are no longer needed, are technically removed or anonymised after 30 days. Only the reduced information necessary for technical traceability and accounting is retained, in particular provider event ID, type and timestamps; complete payloads, contact data and other additional data are not retained.
  • We retain contractual, payment or accounting records subject to a statutory retention obligation for the applicable statutory period and limit their processing during that time to what is necessary.

13. Account deletion and data export

You can request deletion of your user account using the corresponding function in Cozy Garden's settings.

Before deletion, you can export your content. After deletion is complete, your account and content can no longer be accessed. If you have an active Premium subscription, we arrange its cancellation at the end of the paid period before deleting the account; statutory retention obligations and independent processing by Link/Stripe remain unaffected.

14. Minors

Cozy Garden is not specifically directed at children. We do not currently carry out age verification.

Users under the age of 16 should create a user account only with the consent of their parents or legal representatives. If we become aware that an account was created in breach of this requirement, we may delete it.

15. Your rights

Subject to the GDPR, you have the right to:

  • obtain access to your personal data;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict processing;
  • data portability;
  • object to processing based on legitimate interests;
  • withdraw consent with effect for the future; and
  • lodge a complaint with a data protection supervisory authority.

To exercise your rights, please contact hello@cozytodo.app

The supervisory authority responsible for us is:

Saxon Data Protection and Transparency Commissioner
Maternistraße 17
01067 Dresden
Germany
Website: https://www.datenschutz.sachsen.de/

16. Automated decision-making

We do not make automated decisions, including profiling, that produce legal effects concerning you or similarly significantly affect you. The technical, automatic allocation to a Freemium or Premium plan serves solely to provide the service level you selected.

17. Security

We take technical and organisational measures to protect your data against loss, misuse, unauthorised access, disclosure or alteration. These include access restrictions, secure authentication, encryption in transit and regular security measures.

18. Changes to this privacy policy

We may update this privacy policy if Cozy Garden's functions, service providers or legal requirements change. The current version is available in Cozy Garden.

Effective from: 8. September 2026