Privacy policy

Who is responsible

Trayflux is published by Sitewright, a division of Flame Robotics GmbH, Zug, Switzerland. The company is the controller of the personal data described in this policy.

Flame Robotics GmbH
Hofstrasse 64a
6300 Zug
Switzerland

You can contact us about privacy through the contact form. We haven't appointed a data protection officer or a representative in the European Union.

What we collect, and why

Your account

We store the email address you sign in with, your display name if you set one, and the date you created the account. Trayflux has no passwords, so we use your email address to send you a sign-in link and code. If you change your address, we hold the old and new addresses together for the 10 minutes you have to confirm the change, and we send a notice to the old one.

Your lists

We store the lists and items you create: names, text, notes, quantities, categories, due dates, repeat settings, whether and when an item was done, and who added it. Storing them is how Trayflux shows your lists on each of your devices, and to the people and assistants you share them with.

The history of your lists

Trayflux keeps a history of the changes made to your lists and items. Each entry records what changed, with the values before and after, or the whole list or item when one is created or deleted. So the history holds earlier versions of text and notes, and what a list or item held when it was deleted. Thirty days after a list or item is deleted, every entry for it loses that content, earlier versions included, and names it only as a deleted list or item. Each entry also says when the change was made, by our server's clock and by the clock and time zone of the device that made it, and who made it: you, someone using one of your share links under the name they gave, or one of your connections or API tokens. For a connection we keep its name, which the assistant may have chosen for itself. You can read your history in the app, and so can your connected assistants and API tokens. A share link never gives access to it.

Signing in

When you ask to sign in, we store your email address with a hash of the link and code we sent you and a hash of your IP address. A hash is a fixed-length value computed from the original, which lets us recognise the same value again without storing it. The link works for 15 minutes, and we delete the record within an hour of its expiry. While you're signed in we keep a session record: when the session started, when it was last used, and your browser's user agent, which identifies the browser and operating system.

Rate limits

To prevent abuse, we count requests against your email address, your account or a hash of your IP address. We delete these counts after one to two days.

Connections, tokens and share links

For each assistant you connect, each API token created for your account and each share link you create, we record what it's for, when it was created and when it ended. For connections and tokens we also record when they were last used. We store access tokens only as hashes. For a share link we keep that record but not the link itself: Trayflux verifies a link by its signature whenever someone uses it.

Editing a shared list without an account

You can read a shared list without giving us anything. Before you make your first change, Trayflux asks for a name. We store that name and the items you add under it, and we set a cookie so that the same browser is recognised next time. If that browser doesn't use Trayflux for 400 days, we remove the name, and what you added stays without it.

Server logs

Our web servers log each request to the Trayflux app: the time, your IP address, the URL requested and the headers your browser sends with it, such as its user agent and the page you came from. We use the logs to diagnose faults and investigate misuse. When you open a sign-in link, its single-use token is removed before the URL is logged. The secret part of a share link is never logged.

The log for this website keeps less: the time, the page requested without anything after a question mark, and your IP address with its last part removed (for example, 203.0.113.0 instead of 203.0.113.77). It keeps no user agent and no page you came from.

Contact form messages

When you use the contact form, your email address, the reason you selected and your message reach us as an email. The Trayflux database doesn't store the message. It stores only a request count against a hash of your IP address, for one to two days, to limit abuse of the form. The email stays in our mailbox while we deal with your request, and afterwards for as long as we need a record of it.

Visits to this website

We count visits to this website ourselves, using a small script that the website serves itself. We don't count visits to the app. For each page you view we store the date, the page's path, the hostname of the website that referred you, your country, your device type, your browser, your operating system and a visitor hash. We calculate the hash from your IP address, your browser's user agent and a random value that changes every day and is never stored, so the hash can't be traced back to you or linked to a visit on another day. We use your IP address to look up your country, and the visit record contains neither your IP address nor your user agent. To limit abuse we also keep a request count against a hash of your IP address for one to two days. If your browser sends a Do Not Track or Global Privacy Control signal, we don't record the visit.

What we don't do

Trayflux shows no advertising, sets no tracking cookies and uses no third-party analytics. We don't sell personal data or share it for anyone else's marketing. We don't profile you or make automated decisions about you. We may access the contents of an account when we need to, for example to fix a fault, to respond to a request from you or to meet a legal obligation.

Our legal grounds

Swiss data protection law applies to Trayflux. Where the European Union's General Data Protection Regulation also applies to you, we rely on the following legal bases.

• Our contract with you (article 6(1)(b)): your account, your lists, signing you in, your connections and share links, and the emails these involve.
• Our legitimate interests (article 6(1)(f)): keeping the service secure and available through rate limits, server logs and backups, answering the messages people send us, and counting visits to this website.
• A legal obligation (article 6(1)(c)), in the rare case that a law requires us to keep or disclose something.

We don't rely on consent for any of this, so there's no consent for you to withdraw. An email address is required to have an account, and a name is required to edit a shared list without one. You don't have to provide anything else.

Who else handles your data

The following companies handle personal data for us, each only for the purpose described.

Hetzner Online GmbH

Hetzner Online GmbH hosts the server that holds the Trayflux database and its logs, and keeps seven daily backups of that server.

What it handles: Everything Trayflux stores: accounts, lists, sessions, connections and logs.

Where: Germany. See its privacy notice.

SMTP2GO (Sand Dune Mail Limited)

SMTP2GO (Sand Dune Mail Limited) sends all Trayflux email: sign-in emails, notices of a changed address and contact form messages.

What it handles: The recipient's email address and the content of the email. For a contact form message, the sender's email address and the message.

Where: The European Union, with the company in New Zealand. See its privacy notice.

Cloudflare, Inc.

Cloudflare, Inc. provides the domain name service (DNS) for our domain, runs the bot check on the contact page (Turnstile) and forwards contact form emails to our mailbox.

What it handles: On the contact page only: your IP address, details of your browser and the other signals Turnstile uses to distinguish people from bots. Cloudflare also relays contact form emails.

Where: The United States and other countries where Cloudflare operates. See its privacy notice.

Google (Gmail)

Google (Gmail) provides the mailbox where we receive and answer contact form messages.

What it handles: Your email address, your message and our reply, when you write to us.

Where: The United States and other countries where Google operates. See its privacy notice.

GitHub, Inc.

GitHub, Inc. hosts the source code, builds each release and stores the deployment settings.

What it handles: While Trayflux is invite-only, the email addresses we have invited. No lists or account data.

Where: The United States. See its privacy notice.

The people and assistants you choose

A connected assistant, and anyone who has one of your share links, receives whatever that access covers. The sections on connected assistants and share links set out what that is. The company that provides an assistant handles what the assistant reads under its own terms and privacy notice, which this policy doesn't cover.

Authorities

We disclose personal data to a court or public authority only when the law requires it.

Where your data is

The Trayflux database and server logs are held on a server in Germany. Every night an encrypted backup of the database is copied to storage we operate in Switzerland. Not all data stays in Germany, though: the companies listed above handle data in the locations shown for each.

Switzerland and the European Union each recognise the other's data protection law as adequate, and both recognise New Zealand's. Cloudflare, Google and GitHub are based in the United States, and each one's privacy notice, linked above, describes the safeguards it applies to data transferred there. If you'd like more detail, ask us through the contact form.

How long we keep it

• Your account and your lists: until you delete your account.
• Lists and items you delete: they disappear from the app straight away, and we keep what they held for 30 days. After that we remove their names, text, notes and every other detail, and keep only a record that they were deleted, which is how a device that has been away for a while learns of the deletion. We keep that record until you delete your account. Backups made before the content was removed still hold it until newer ones replace them.
• The history of your lists: until you delete your account, except that the entries for a list or item you deleted lose its content after 30 days, as described above. We don't remove other entries automatically.
• Sign-in links and codes: a link works for 15 minutes and a code for 10 minutes. We delete the record within an hour of the link expiring.
• Sessions: 30 days after you last used Trayflux in that browser, or until you sign out.
• Rate-limit counts: one to two days.
• Visits to this website: 400 days.
• Connections, tokens and share links that have ended: we delete the record 30 days after it ended, whether you ended it or a token reached its expiry date. It grants no access in that time. The history of your lists still says what each one did, under the name it had.
• Shared lists you've added: until you remove them or delete your account.
• Records of changes: to avoid applying the same change twice, we keep a record of each change a device or an assistant sends. A record can include a copy of the item. After 30 days we remove that copy and keep only the change's ID and a hash of it, until you delete your account.
• Guest names: 400 days after a guest last used Trayflux in that browser, we remove their name, from the history of your lists too. Items a guest added stay, with no name, until the list's owner deletes them or deletes their account. The guest cookie lasts 400 days from when it was last used.
• Server logs: seven days. The seven daily backups of the whole server can hold them for up to seven days more.
• Backups: the 30 most recent nightly copies, seven daily backups of the whole server, the 14 most recent copies made just before a new release, and up to 14 copies we make manually.
• Emails: our email provider keeps a record of each email it sends for a period that it sets. Emails you receive stay in your own mailbox.

Deleting your account

You can delete your account in Settings. Deletion is immediate and can't be undone. It removes your account, your lists and items (including those you had already deleted), the history of your lists, your sessions, tokens, connections and share links, the shared lists you've added, and the records of changes described above.

Some data remains for a time, or isn't ours to remove. Items you added to someone else's shared list stay on that list, no longer attributed to you, and so do the entries for your changes in that list's history, without your name. Rate-limit counts are deleted within two days. Copies on your other devices stay there, even after those devices reconnect, until you clear Trayflux's site data on them. Anything a connected assistant or a link holder has already read stays with them. Backups made before the deletion still contain your data until newer ones replace them, which takes about 30 days for the nightly backups and a week for the server backups. The copies made before a release and the copies we make manually have no fixed expiry. A copy made before a release is removed once 14 later releases have been made, and a manual copy once we have made 14 more. Log entries are deleted after seven days, and the server backups that hold them a week after that.

Cookies and browser storage

The app sets only the cookies it needs to work, and none of them tracks you across other sites. This website, as distinct from the app, sets no cookies at all.

__Host-tf_session

Keeps you signed in on this browser.

Set by: The app. Lasts: 30 days, renewed while you keep using Trayflux.

__Host-tf_pending

Ties the six-digit sign-in code to the browser that asked for it, so the code is useless to anyone else.

Set by: The app. Lasts: 10 minutes.

__Host-tf_guest

Remembers the name you gave when you edited a shared list without an account.

Set by: The app. Lasts: 400 days from when you last used it.

__Host-tf_oauth_return

Returns you to the page for connecting an assistant if you had to sign in first.

Set by: The app. Lasts: 15 minutes.

__Host-tf_add

Remembers the shared list you chose to add to your Lists while you sign in, so it is added when you do.

Set by: The app. Lasts: 15 minutes.

trayflux_environment

Identifies our test environment. It contains the word "test" and nothing about you, and the live app doesn't set it.

Set by: Our test environment only. Lasts: 400 days.

Your lists on your device

So that your lists work offline, the app stores a copy of them in your browser's storage on each device you sign in on, along with your email address, your name and settings such as the theme. Signing out or deleting your account clears your lists from the device you do it on.

When you open Activity, the app also keeps the pages of history it has shown you on that device. It deletes them when you sign out, delete your account or sign in to a different account, when a name in your history changes or is removed, when we remove the content of a list or item you deleted, and when Activity is no longer available.

The bot check on the contact page

The contact form uses Cloudflare Turnstile to check that a person is sending it. To do that, Turnstile's script reads your IP address and details of your browser. Cloudflare uses this information to run the check for us and, for its own purposes, to improve its bot detection. When we last checked, on 8 October 2026, Turnstile set no cookies and stored one entry in your browser's storage under Cloudflare's own domain. No other page of this website or of the app loads anything from a third party.

Connected assistants

Trayflux works without an AI assistant. If you connect one, such as Claude or ChatGPT, Trayflux asks you to approve the connection once. From then on, the assistant can read, create, change and delete all of your lists and items. It can also read the shared lists you've added to your Lists, and change their items where the link allows, under your name. It can also see your email address, your name, the names of people who have added to your lists, and the history of your lists, including lists and items you've deleted in the last 30 days. A connection covers your whole account: you cannot limit one to a single list.

A connected assistant can't sign in as you, create tokens, manage your share links, or change or delete your account. Settings lists your connections, and disconnecting one ends its access immediately. Disconnecting doesn't delete anything the assistant has already read. That information is held by the assistant's provider, under the provider's terms.

Share links

A share link is separate from an assistant's access and covers one list only. Anyone who has the link can use it, including through an assistant they've connected, so pass it on as carefully as you would a key. A view link shows the list's name, its items, when each item was done and the names of the people who added them, but not your email address or the list's history. An edit link also lets its holder add, change, tick off and delete items on that list.

You can turn a link off or replace it at any time, and it stops working from the next request. Anything someone has already seen or copied stays with them.

When a link is pasted into a messaging app, that app's servers may fetch it and show the list's name while the link works.

If you're signed in, you can add a list someone shared with you to your Lists. Your account then records which link you added it through, but not the link itself, so the list appears on your other devices. You can do only what the link allows, and it stops working when the owner turns the link off or replaces it. Removing it from your Lists deletes that record. An assistant you've connected can use it in the same way, and its changes show under your name.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, ask us to restrict how we use it, and ask for it in a commonly used electronic format. You can also object to processing that we base on our legitimate interests.

You can do some of this yourself. In Settings you can change your name and email address and delete your account, and each list's menu exports that list as text. For anything else, including a copy of all your data at once, use the contact form. We respond within 30 days and don't charge. We may ask you to confirm the request from your account's email address, so that we don't disclose your data to someone else.

If you think we've mishandled your data, please contact us first. You also have the right to complain to the Swiss Federal Data Protection and Information Commissioner or, if you live in the European Union, to your local data protection authority.

Security

All connections to Trayflux are encrypted. We store sign-in links, codes, session cookies and tokens only as hashes, and we encrypt the nightly backup before it leaves the server. Each of those hashes is computed from a long random value, so the original can't be recovered from it. An IP address is different: there are few enough possible addresses that a hash could be matched back to one, so we treat a hashed IP address as personal data.

No system is completely secure. If a breach is likely to put you at high risk, we'll notify you and the relevant data protection authorities, as the law requires.

Age

Trayflux is for people aged 16 and over. Younger people may use it only with the agreement of a parent or guardian.

Changes to this policy

We may change this policy, and we update the date at the top whenever we do.