Privacy policy

In short

• –What's on your screen goes directly between your devices, encrypted. Our servers never receive it.
• –We keep what we need to run your account and connect your devices: your email address, your devices, and the network addresses your devices exchange for a short time. Our sign-in provider also keeps the IP address you signed in from, for as long as the session lasts and in its sign-in log after that.
• –Our analytics are anonymous: no identifier stored on your device, no IP address kept, no recordings of what you do.
• –We don't sell your data, and we don't use it for advertising.

Who is responsible

Klura AB, Stockholm, Sweden, is the controller of your personal data. Contact: privacy@klura.app.

What we collect

• Your account. Your email address, which you sign in with. The account is created when you first ask for a sign-in code. Our sign-in provider, Supabase, keeps a record of each signed-in session so that you stay signed in: the IP address and the app or browser identifier (user agent) it signed in from, until the session ends. It also keeps a sign-in log of each sign-in, refresh and sign-out, with your email address and IP address, until your account is deleted, and its own service logs, which hold your email address and IP address for 1 day.
• Your devices. For each computer you sign in on: its name, as set in its operating system (this often includes your own name); its platform; the public half of a key the app creates on it to prove which device it is, and that key's fingerprint; when it was added, and by which sign-in; and when it was last online.
• Online status. While the app runs, it checks in with our servers about every 10 seconds, so your other devices can see that it is online. We keep only its latest check-in, not a history.
• Session requests. When your Mac offers one of your devices a session, we record which device offered what kind of session (mirror or extend) to which device, when, and the answer. The connection code inside the offer is removed once the offer ends, or 10 minutes after it is accepted, the next time either device checks in.
• Connection details. To connect directly, each device works out its network addresses: its addresses on your local network, its public IP address and port, and any IPv6 addresses. To learn its public address, it asks public address servers run by Google and Cloudflare, which see its IP address when it does. The two devices then exchange their addresses through our connection server, which keeps them under the session's short code while the Mac keeps the code open, for at most 6 hours, and deletes them 5 minutes after that.
• What we don't collect. Today every session is direct: the picture goes straight between your two devices, encrypted, and we never receive your screen or what you do on it. If we add a relay for networks that don't allow a direct connection, it will pass on encrypted data it can't read, and we will update this policy before it is used.
• Logs and crash reports on your computer. The app keeps a log and, after a crash, a crash report in a folder on your computer. The app deletes them once they are 7 days old, the next time Spegla runs. They can contain network addresses and device names. They never leave your computer unless you send them to us yourself, and then we use them only to fix the problem. The app also keeps your sign-in, its device key and any choices you ask it to remember on your computer.
• App analytics. The app sends us anonymous events through PostHog: which of its screens are opened, and errors that occur. It stores no identifier for this on your computer, the events carry no account or device ID, PostHog discards your IP address when an event arrives, and nothing you do is recorded. The app doesn't yet have a setting to turn this off; one is planned for its settings.
• Website analytics. On spegla.app and help.spegla.app we count page views and errors, and on help.spegla.app the answers to "Was this helpful?". This goes through PostHog in the same way: nothing stored on your device, no IP address kept. If your browser sends Do Not Track, neither site starts PostHog. The waitlist pages load no analytics.
• Server logs. Our servers run on Cloudflare, which logs each request (the address requested, the time and the result) and sees your IP address while it delivers the request. Our servers also use your IP address, without storing it, to limit how often a sign-up or check-in can be repeated. Our API logs each request's method, path, result and duration to PostHog, without your IP address, and reports server errors there.
• Emails. We email you the code you sign in with and, if you join the waitlist, its confirmation. Our email provider receives your address and the message.
• Waitlist. Before launch you can join the waitlist on spegla.app. We collect your email address and, only if you choose to answer, which device you would use as a second screen and where you would use it. The sign-up form uses Cloudflare Turnstile to check that a person, not a bot, is signing up; Cloudflare receives your IP address for that check, and Turnstile sets no tracking cookies.

Why we use it

• To provide Spegla (contract, GDPR Art. 6(1)(b)). Your account, your devices, online status, session requests, connection details and sign-in emails are needed to run the service you signed up for.
• Our legitimate interests (GDPR Art. 6(1)(f)). Keeping Spegla secure and free of abuse (server logs, rate limits, Turnstile); anonymous analytics and error reports that show us what to fix and improve; and telling waitlist members about Spegla's launch, because they asked us to. We have weighed these interests against yours, including those of users aged 13 to 17: there is no identifier, no profile, no IP address kept, no recording and no advertising. You can object at any time (see Your rights).
• Legal obligations (GDPR Art. 6(1)(c)). Where the law requires us to keep or hand over data.

Who receives it

These companies process personal data for us, under data processing agreements, only to provide their service:

• Supabase. Our database and sign-in. Stored in the EU (Stockholm).
• Cloudflare. Runs our servers and the connection server, keeps the server logs, runs one of the public address servers and Turnstile, and serves the app's downloads.
• PostHog. Analytics, error reports and the API's request logs. Stored in the EU.
• Resend. Sends our emails, through Amazon Web Services in the EU (Ireland).

Google runs the other public address server; it sees your device's IP address when the device asks for its public address. We share personal data with authorities only when the law requires it.

Where it is stored

Your account and devices are stored in the EU (Supabase, Stockholm), and analytics in the EU (PostHog). Cloudflare handles requests in its data centres around the world, close to where you are. Cloudflare, PostHog, Resend and Google are US companies or have US parent companies; where your data reaches the US, the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Account, devices and session requests: while your account exists. We delete them within one month of your asking us to delete your account.
• Online status: only the latest check-in, for as long as the device is on your account.
• Connection details: at most 6 hours and 5 minutes.
• Server logs: up to 7 days at Cloudflare, 14 days at PostHog, and 1 day in our sign-in provider's service logs.
• Signed-in sessions: the IP address and app or browser identifier, until the session ends.
• Sign-in log: each sign-in, refresh and sign-out, with your email address and IP address, while your account exists.
• Analytics and error reports: 1 year, with no identifier attached.
• Logs and crash reports on your computer: deleted once they are 7 days old, the next time Spegla runs, on your computer only.
• Waitlist: a sign-up you never confirm is deleted within 24 hours after its confirmation link expires. A confirmed sign-up, with any answers, is kept until you leave the waitlist, until your beta invite becomes an account, or until 90 days after launch, whichever comes first. Leaving deletes your address and answers from our list at once.
• Email send logs and backups: our email provider keeps a log of sent messages for up to 30 days, and our database's backups roll over within 7 days.

Children and teens

Spegla is for people aged 13 and over, and a user aged 13 to 17 needs a parent or guardian to agree to our terms. We collect the same, minimal data from everyone: we build no profiles, show no ads and don't track anyone across other sites. If we learn that someone under 13 has an account, we delete it. Parents and guardians can contact us at privacy@klura.app.

Your rights

Under the GDPR you can ask us for a copy of your personal data, ask us to correct it, delete it, restrict how we use it or send it to you in a portable format, and object to our use of it based on our legitimate interests, analytics included. Email privacy@klura.app; we answer within one month. To delete your account, see our data-deletion page. We make no decisions about you by automated means alone.

You can also complain to the Swedish Authority for Privacy Protection (IMY) or to the data protection authority where you live.

Cookies and storage on your device

spegla.app and help.spegla.app store nothing on your device for analytics, and the waitlist pages set no cookies. The Spegla app stores your sign-in, its device key and the choices you ask it to remember on your computer, because it can't work without them.

Security

Sessions are encrypted between your two devices. Each device's private key stays on that device. Only our servers can read and write our database, and our team's access to it is limited. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

Changes to this policy

We post every change here with a new effective date. When a change matters to you, we tell you in the app or by email before it takes effect.