How we handle your family's data, in plain language.
Last updated: 1 November 2026 · Effective: 1 November 2026
The short version. We only collect what we need to run the service. We don't sell your data, run ads, or share with third parties for marketing. Children's data is treated with extra care. All servers are in the EU. You can export or delete everything at any time. Questions: privacy@organicely.se.
The data controller is Unbreached AB (org.nr 559411-9624), a Swedish limited company based in Stockholm. We make and operate Organicely. References to "we," "us," and "Organicely" mean Unbreached AB.
| Data | Why | Legal basis |
|---|---|---|
| Email address | To sign you in (passwordless), send the activation link, OTP codes, and important service emails. | Contract |
| Display name and family role | So children see who approves their tasks; shown inside the app. | Contract |
| Household name | Identifies your family unit in the app. | Contract |
| Passkey (WebAuthn) public key | To verify your identity at sign-in. We never see your fingerprint or biometric data, those stay on your device. | Contract |
| Refresh-session metadata (IP, user agent) | To keep your session secure and detect suspicious sign-ins. | Legitimate interest (security) |
| Data | Why | Legal basis |
|---|---|---|
| Child's display name | Identifies the child inside your household. | Contract (consent of parent/guardian) |
| Child's date of birth (optional) | For age-appropriate routines. Encrypted at rest with AES-256-GCM at the application layer; not visible to us in plain form. | Contract |
| Avatar photo (optional) | Personalises the child's view in the app. Stored privately, scoped to your household, only readable by your authenticated account. | Contract |
| Routines, tasks, completions, points, streaks | The core data the product manages. | Contract |
| Mood entries (optional) | Lets parents and therapists spot patterns over time. Entered by the child or parent. | Contract |
| Photos uploaded for task verification | Lets a child prove a task is done (e.g. "bed made"). Visible only to the household. Deleted when the parent reviews and clears them. | Contract |
| Data | Why | Legal basis |
|---|---|---|
| Machine ID (hardware-bound hash) | So the agent can authenticate to our API and we can identify which computer is which. | Contract |
| App usage (which apps were open, for how long) | Powers screen-time reporting and per-app limits the parent configures. | Contract |
| Heartbeat status, last-seen time | So the parent dashboard can show whether a device is online. | Contract |
| Security-event logs (failed integrity checks, tamper attempts) | So parents see when a device may need attention. | Legitimate interest (security) |
Subscriptions are processed by Paddle.com Market Limited ("Paddle"), our merchant of record. Paddle is the data controller for the payment data you provide directly to it (card details, billing address, billing email). We never see your full card number. We receive only the payment status, billing email, and country from Paddle, which we use to apply your subscription to your account. See Paddle's privacy notice for how it handles your data.
Organicely is built for families. The legal basis for processing data about a child is the consent and authority of the parent or guardian (the account holder). We do not knowingly collect data directly from children except through the account that the parent has set up for them.
We apply additional safeguards to children's data:
All Organicely infrastructure is hosted within the European Union, at a Swedish data-centre region. Data does not leave EU borders. Backups are also stored within the EU.
The single exception: payment-related data necessarily passes through Paddle, which operates globally. Paddle is GDPR-compliant and uses appropriate safeguards for any non-EU transfers.
The Organicely web app uses one strictly necessary cookie, an HTTP-only refresh-session cookie, to keep you signed in. It also keeps a few settings in your browser's local storage, such as your chosen language. We do not use cookies for analytics, tracking, or advertising in the web app.
The marketing website (organicely.se) asks before it stores anything for attribution. Your answer is remembered in your browser's local storage (org_consent_v1).
org_vid), and any campaign tags in the link you arrived by (UTM parameters) are kept in local storage for 90 days (org_first_touch_v1). If that link carries campaign tags, our API also keeps them in a cookie (org_ft) for 90 days. Together they tell us which link or campaign led to a sign-up. Nothing is shared with other companies, and we store no IP address for it.A partner referral link (/r/<code>) sets a cookie (org_attr) naming the partner, so the partner can be credited if you sign up.
Fonts on both the website and the web app are served from our own servers, so loading a page does not contact Google or any other font provider.
| Type of data | Retention |
|---|---|
| Account, household, and child profiles | For as long as your account is active. If you delete your whole account in the app (Settings), it is erased straight away. If you remove a child profile or another adult from your family, or ask us by email to close your account, the data is first hidden from the service and kept for 90 days so a mistake can be undone. After 90 days it is permanently erased automatically, together with everything that belongs to it (routines, completions, mood entries, chat messages, calendar entries and devices). An adult removed from a family that keeps using Organicely is anonymised instead: their name, photo and sign-in methods are erased, and a nameless placeholder stays so the family's history still adds up. If you ask us to erase your data under GDPR, we erase it within 30 days of your request. |
| Refresh sessions (web app) | Up to 7 days, then automatically expired and removed. |
| Device refresh tokens (desktop / mobile agents) | Up to 90 days; single-use with replay detection, so a typical chain is much shorter. |
| Photos uploaded for task verification | Stored on EU object storage (AWS S3 in Stockholm) for as long as the task-completion record exists. Deleted when the routine, child, or household is deleted. |
| Audit logs (security and admin actions) | Kept to protect accounts and investigate misuse. Audit entries record actions (for example a sign-in, an approval or a deletion), not the content you create, and they cannot be changed afterwards. They are not erased when an account is deleted. When deleted data is purged after the 90 days, we keep only a count of what was removed. An automatic 24-month limit for audit entries is on our roadmap. |
| Backups | Nightly database backups are kept for 30 days and then deleted, so data erased from the service is gone from the backups within 30 days as well. |
| Billing records held by us | 7 years (Swedish accounting law, Bokföringslagen). |
You have the following rights regarding your personal data. To exercise any of them, contact privacy@organicely.se. We will respond within 30 days.
We share data only with the parties strictly required to deliver the service:
Each of these is bound by a data-processing agreement consistent with GDPR Article 28. We do not share data with advertising networks, data brokers, analytics platforms, or any party not strictly necessary to run the service. The full and current list of sub-processors is in our Data Processing Policy.
Children do not create their own Organicely accounts. The parent or guardian creates the household account and sets up child profiles within it. The legal basis for processing the child's data is the parent's consent and authority. If you are a child and have created an account on your own (which the product design tries to prevent), please ask a parent or guardian to take over the account or contact us at privacy@organicely.se.
We will update this policy if our practices change, the law changes, or the product changes meaningfully. If a change affects your rights or how we handle your data, we will notify you via email and in the app at least 30 days before it takes effect.
For privacy questions, requests under GDPR, or any concern about how we handle your data:
Unbreached AB
Privacy contact: privacy@organicely.se
General support: support@organicely.se
Sweden · org.nr 559411-9624