Privacy policy

Last updated 24 October 2026

Kith is a free web app for tracking job applications. This policy explains which personal data we process when you use it, why, and what rights you have. We keep it short and only collect what the app needs to work.

Who is responsible

The controller under the GDPR is Katja Sostar, Lilienthalgasse 45, 8020 Graz, Austria. Email: kat.sostar@gmail.com.

What we process

• Account data: your email address. If you sign in with Google, also your name, profile picture and Google account ID as shared by Google.
• Your content: the applications, notes, dates, contacts, tags and documents (PDFs) you add. Only you can access them.
• Technical data: IP address, browser type and request times, processed by our hosting providers to deliver the app and keep it secure. These logs are kept only for a short period.
• Sign-in emails: when you request a sign-in link, we send it to your email address.

We do not use analytics, advertising or tracking tools. We never sell your data, share it for advertising, or use your applications or documents to train AI models.

Why, and on what legal basis

• To provide the app and your account: performance of our agreement with you (Art. 6(1)(b) GDPR).
• To keep the service secure and prevent abuse: our legitimate interest in a safe, working service (Art. 6(1)(f) GDPR).

Cookies and browser storage

We only use cookies that are needed for signing in and keeping you signed in. Your display preferences, such as light or dark mode and the last view you used, are stored in your own browser and are not sent to us. Because we use no optional cookies, there is no cookie banner.

Where your data is stored and who processes it

Your account, applications and documents are stored in the European Union. We use these service providers, bound by data processing agreements:

• Supabase: database, sign-in and file storage, hosted in the EU.
• Vercel: hosting and delivery of the web app; the app’s servers run in the EU.
• Google: only if you choose “Continue with Google”, to confirm your identity.

Supabase and Vercel are US companies. Where personal data could be accessed from outside the EU, this is covered by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

How long we keep it

We keep your data for as long as you have an account. If you ask us to delete your account, we delete your applications, documents and account data within 30 days. Each account can store up to 50 documents (250 MB).

Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, and to receive it in a portable format. You can export your applications yourself from the account menu at any time. For anything else, email kat.sostar@gmail.com.

You can also lodge a complaint with a data protection authority, in Austria the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Changes

If we change how we process your data, we will update this page and, for significant changes, tell you in the app or by email. See also our terms and imprint.