Privacy policy

Last updated 2026-11-04

This policy explains what personal data dendag (dendag.dk and the app at app.dendag.dk, "we") collects when you use the service, why, who we share it with, how long we keep it and what rights you have.

1. Who is responsible

dendag is run by protopoc (CVR 46675215), Denmark, which is the data controller for the personal data described here. You can reach us at support@dendag.dk about anything in this policy.

2. What we collect

Account details. If you sign in, your email address, which we get from the sign-in code email or from Google, and the ID of your login at Auth0. If you use Google, Auth0 also receives your name and profile picture from Google; we don't use them.
Your name. The name you type when you join a calendar, make or go to an event, or edit your account.
What you add. Calendars (title, description, how many people a day needs), the days you are available or maybe available, events (date, time, place, details), and which events you are going to.
Settings. Your language and date format, so notifications and the phone calendar feed use them, and the date of the last "What's new" note you saw, so your other devices don't show it again.
Notifications. If you turn them on, the address and keys your device's push service gives us, for each device.
Phone calendar feed. If you turn it on, a secret link to your events. The calendar app or service you subscribe with (such as Apple or Google Calendar) fetches your events through it.
Guests. If you add days or say you're going without signing in, a random identifier kept in a cookie. We store only a one-way hash of it with your entries. A calendar's creator can type in a guest's email to send them a link to take their entries back; we keep only a one-way hash of the address mixed with the link, so it can't be read back.
Technical data. When you use the service, our host receives your IP address, browser details and the pages you request.
Usage statistics. Counts of visits and of what is done in the app (such as calendars started or days added), without cookies. Visits are counted by Cloudflare Web Analytics from the page address, browser type and country. Actions are recorded without your email, name or calendar, under an identifier that changes every day, so we can count active users but not follow anyone.

3. Why we use it, and on what legal basis

To provide the service you ask for: signing you in, showing your calendars and events, sending the notifications you turn on and serving your feed. The legal basis is our agreement with you (GDPR art. 6(1)(b)).
To keep the service secure and working: preventing abuse, limiting requests and finding errors. The legal basis is our legitimate interest in a safe and reliable service (art. 6(1)(f)).
To see how the service is used and improve it, from the usage statistics. The legal basis is our legitimate interest in knowing how the service is used (art. 6(1)(f)).
To meet legal obligations, where they apply (art. 6(1)(c)).

You need to give an email address to start calendars or make events; you can add days and go to events as a guest without one. We don't use your data for advertising, profiling or automated decisions, and we never sell it.

4. Who can see what

A calendar is open to anyone who has its link. They can see the calendar, the name of whoever started it, the names of the people in it, the days each person is available and the events, including who made them and who is going. Your email address is never shown to other people. Your feed link and notification settings are only shown to you.

5. Service providers

These providers process data on our behalf, under data processing agreements, and only as needed for their part:

Cloudflare hosts the app, the database (in the EU), the request logs and the usage statistics.
Auth0 (Okta) handles sign-in and keeps a record of your email address and your sign-ins.
Resend sends the sign-in code emails and the links calendar creators send to guests.

These handle data under their own privacy policies:

Google, if you choose to sign in with Google.
Push services (Apple, Google or Mozilla, depending on your device) deliver notifications. Their content is encrypted so only your device can read it.

We may also disclose data if the law requires it. We don't share it with anyone else.

6. Transfers outside the EU/EEA

Some of our providers are based in the United States or use servers there. Where data leaves the EU/EEA, it is protected by the provider's data processing terms, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

7. How long we keep it

Days you are available are deleted 7 days after they have passed.
A calendar nobody has opened or changed for 180 days, with nothing coming up, is deleted with everything in it. Its owner is warned in the app a month ahead.
Calendars, events and days you delete are removed straight away, though they can stay in database backups for up to 30 days.
Sign-in sessions end at most 30 days after you last used the app.
A guest cookie lasts a year. Entries made as a guest move to your account if you sign in.
A link sent to a guest, and the hash of their address, is deleted when it's used or at most a day after it expires (14 days).
Notification addresses and the feed link are kept until you turn them off or the device stops accepting notifications.
Cloudflare's request logs and Auth0's sign-in logs are kept for up to 30 days.
Usage statistics are kept by Cloudflare for a limited time (the action counts for three months). They don't say who you are, so deleting your account doesn't remove them.
If you change your email on the account page, everything moves to the new address, and the old one is removed from our records and your login for it at Auth0 is deleted.
Everything else is kept until you delete your account on the account page. That deletes, at once, the calendars you started with everything in them, your days and "going", your name, settings, devices, feed link, sessions and your login at Auth0. Events you made on other people's calendars stay, without your name.

8. Cookies and local storage

We only use what the service needs. There are no advertising or third-party cookies.

Sign-in cookie, to keep you signed in (up to 30 days from your last visit). We store only a hash of it.
Sign-in check, a short-lived cookie (10 minutes) that protects the sign-in.
Guest cookie, to recognise you as a guest (one year).
Language cookie, to remember your language (one year).
Deleted-account cookie, for five minutes after you delete your account, to show that it worked.
Move cookie, while the app moves from dendag.dk to app.dendag.dk: for one minute, a one-time code that keeps you signed in (or keeps your guest entries) on the new address. It is sent to dendag.dk and its subdomains (including the login page, auth.dendag.dk), and we store only a hash of it.
Local storage on your device keeps your theme, language, date format and name, so they're ready next time, and which notices you've seen.

9. Security

All traffic is encrypted (HTTPS). We store only hashes of sign-in and guest cookies, notifications are end-to-end encrypted, and access to the service's systems is restricted. No system is perfectly secure, but we work to protect your data and will act on any breach as the law requires.

10. Your rights

Under the GDPR you have the right to access your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. In the app you can at any time remove your days, leave calendars, delete your calendars and events, change your name, turn off notifications and the feed, and delete your account. For anything else, such as a copy of your data, write to support@dendag.dk. We answer within a month.

If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency, Datatilsynet.

11. Children

dendag is not meant for children under 13. If you believe a child under 13 has given us personal data, contact us and we will delete it.

12. Changes

If we change this policy, we update it here and change the date at the top. If a change is significant, we will also let you know by email or in the app.