Privacy notice

1. Who is responsible

This notice describes Burrow’s calendar filtering service. “We” means the operator identified below. Daggmask is the project branding; the responsible legal person still needs to be identified before this notice is finalized.

Service

Burrow, a Daggmask project

Responsible operator

Legal name to be confirmed by the operator

Operator location

Sweden

Privacy and service contact

Contact email to be confirmed by the operator

Postal contact

Contact address and applicable disclosure requirements to be confirmed

Application hosting

Self-hosted using Coolify in Nuremberg, Germany. Infrastructure provider and backup locations to be confirmed.

For a directly operated personal service, the operator is responsible for deciding why and how service data is processed. If an organization uses Burrow to process other people’s calendars on its instructions, controller and processor responsibilities must be agreed separately; this notice is not a data processing agreement.

2. Information we collect

No account registration is currently required. We receive the calendar feed URL you submit and fetch calendar data from that provider. A private or tokenized feed URL may itself be a credential.

• Calendar content: calendar names, event titles, descriptions, locations, dates, times, time zones, identifiers, recurrence information and source timestamps. Stored original event components and calendar metadata may also contain organizer or attendee details and other fields supplied by the source, even when those fields are not shown in the dashboard.
• Workspace data: internal identifiers, saved labels and matching rules, event classifications, subscription names and filter choices, encrypted subscription tokens and token hashes.
• Operations and AI data: import and refresh status, timestamps, sanitized errors, analysis request timestamps and AI-generated filter suggestions, including pending suggestions.
• Connection and support data: requests necessarily expose an IP address and HTTP connection information to the hosting infrastructure. What is retained in proxy or server logs, and for how long, must be confirmed. If you contact the operator, your contact details and correspondence will also be processed.

Information can relate to you or to other people named in an imported calendar. Its sources are your submissions, your calendar provider, your use of the service and, for suggested rules, OpenAI. Do not import health information, special-category personal data, government identifiers, payment credentials, children’s data or confidential content that you are not authorized to provide. This instruction does not make incidental sensitive information anonymous or exempt it from privacy law.

3. Purposes and EU legal bases

The following describes the intended purposes and legal bases for an individual-operated service. The operator must confirm these bases and document the relevant assessments before public use.

• Provide the service: fetch, store and display calendars; apply rules; create filtered subscriptions; and refresh source data. For your own information, processing necessary to provide a service you request may rely on performance of a contract (GDPR Article 6(1)(b)). Providing the feed URL and event content is necessary for these features; without them Burrow cannot import or filter your calendar.
• Other people’s ordinary calendar information: where the operator is a controller, a separate lawful basis is needed. Legitimate interests (Article 6(1)(f)) may support an authorized calendar service only after assessing necessity, people’s expectations and their rights. Your agreement alone is not consent on behalf of every person in a calendar.
• Optional AI suggestions: analyze selected event text only when you request that feature. The request is not blanket GDPR consent and does not establish a lawful basis for other people’s information. The operator must assess the additional disclosure to OpenAI; manual rules remain available.
• Security, reliability and support: prevent abuse, diagnose failures and answer requests, based on legitimate interests where appropriate. Complying with applicable legal obligations may rely on Article 6(1)(c).

Where consent is actually required and used, it must be obtained separately and can be withdrawn without affecting earlier lawful processing. Sensitive information requires an additional applicable legal condition, not just an ordinary Article 6 basis. This version is not intended to provide regulated health, education-record or employment-decision processing.

4. Optional AI analysis

“Analyze naming patterns” and analysis of unmatched events use the OpenAI API to suggest filter labels and deterministic matching rules. Importing, loading pages, manually editing rules, reapplying saved rules, refreshing sources and downloading subscriptions do not call AI.

Each analysis sends at most 60 sampled title/description pairs, bounded to 24,000 text characters in total. Titles are capped at 300 characters and descriptions at 500. HTTP(S) links and email-like addresses are replaced before sending. Source feed URLs, separate location fields, event UID fields and subscription credentials are not included in the analysis payload. Names, addresses, locations written inside descriptions and other personal information may remain. This is partial redaction, not anonymization.

OpenAI receives the sample, the analysis instructions and the request metadata. Burrow requests that API response storage be disabled using store: false. This does not guarantee zero retention: OpenAI’s abuse monitoring and other applicable account controls can still apply. Its published API policy says API data is not used for model training by default unless the API customer opts in. The operator must confirm the account settings and contractual arrangements. See OpenAI’s API data controls.

AI suggestions may be wrong or incomplete. When there are no existing filters, the first validated nonempty result is saved and applied automatically. Replacing existing filters requires confirmation. You can review and edit rules manually. Saved rules may subsequently include or exclude events automatically; Burrow does not use them to make decisions about eligibility, employment, education, credit or other legal or similarly significant matters. Do not use the results for those purposes.

5. Who receives information

• Infrastructure providers and the operator: application hosting, database, backup and technical support access as needed to operate the service. The application is hosted in Nuremberg, Germany using Coolify; the underlying provider, backup services and access arrangements remain to be confirmed. Coolify is deployment software, not proof of a particular infrastructure supplier.
• OpenAI: the sample described above, only when AI analysis is requested. The contracting entity, processing regions, subprocessors and applicable data processing terms must be confirmed.
• Your source provider: receives requests from the Burrow server to retrieve your feed, including use of the URL or token you provided.
• People and apps with your links: a dashboard link allows management of its workspace; a subscription link allows reading its filtered events. Your chosen calendar app receives and may retain downloaded data under its own policies.
• Legally required recipients: information may be disclosed where required by law or necessary to establish or defend legal rights, subject to applicable safeguards.

The current application has no advertising, data brokerage or cross-context behavioral advertising features. It does not implement a sale of personal information or use calendar data to train a Burrow model. Before finalizing this notice, the operator must also confirm that infrastructure providers and API account settings do not introduce inconsistent uses.

6. Hosting and international transfers

The confirmed application server location is Nuremberg, Germany. This does not establish that every backup, support access or AI request stays in the EU/EEA. OpenAI analysis may involve processing outside the EEA, including the United States, depending on the operator’s account and provider arrangements.

The operator must identify actual processing countries and, where required, establish a valid transfer mechanism before transferring personal data. Depending on the recipient and circumstances, this may involve an applicable adequacy decision or standard contractual clauses with an assessment and supplementary measures. This draft does not assert that any particular recipient is covered by the EU–US Data Privacy Framework or that EU-only AI processing is configured. Details and the method for requesting a copy of safeguards must be added once verified.

7. Retention and deletion

The current application has no automatic workspace expiry or general calendar deletion interface. Imported events, rules, subscriptions and analysis suggestions remain in the database until the operator removes them. Events removed from the source are marked inactive on refresh; that does not erase their stored content. Revoking a subscription disables that link but does not delete its workspace.

Retention schedule pending: the operator must set and implement specific periods or justified criteria for active and abandoned calendars, inactive event versions, pending AI suggestions, support messages, operational logs and backups. A deadline for deletion from live systems and backup expiry must also be confirmed. This draft deliberately does not promise an unimplemented automatic deletion period.

Once a working privacy contact is published, you can request deletion through it. Verification is needed to avoid deleting another person’s data. Valid requests must be handled under applicable deadlines and exceptions, including propagation to relevant processors. Any legal hold must be limited to necessary information. Removing data from Burrow cannot remotely erase copies already downloaded by other people or calendar applications. Stop or remove external subscriptions separately.

8. Cookies and tracking

The current app includes a first-party sidebar_state cookie containing the sidebar’s open/closed preference, with a seven-day lifetime. It is written when that preference changes. You can remove or block it in your browser; layout preferences may reset. It does not contain calendar content or a subscription token.

The application code does not include analytics pixels, advertising cookies or cross-site tracking. Fonts are served from the application. Hosting-level cookies and logging still need verification. No optional tracking should be added without updating this notice and obtaining any consent required by local law.

Burrow’s application code performs no sale, advertising sharing or targeted advertising to opt out of. It does not currently implement separate responses to Do Not Track or Global Privacy Control signals. Before deployment, the operator must verify provider behavior and implement any legally required signal handling; a lack of a preference control must not be treated as permission to track.

9. Security and private links

Source feed URLs and stored subscription tokens are encrypted in the application database. Subscription tokens also have hashed lookup values. This is not end-to-end encryption: the server can decrypt links to fetch calendars and display subscription URLs, and stored event content is not covered by that field encryption.

No account sign-in protects the dashboard. Anyone who obtains its URL can view and manage the workspace, including requesting analysis and managing subscriptions. Keep dashboard and subscription URLs private, avoid putting them in public posts or shared screenshots, and regenerate or revoke a subscription URL if exposed. A lost dashboard URL has no self-service recovery or rotation feature in this version.

The operator must maintain HTTPS, restricted administrative access, updates, suitable backup security and logs that protect secret paths. No service can guarantee absolute security. The operator must assess incidents and notify regulators and affected people when applicable law requires it.

10. EU/EEA privacy rights

Subject to legal conditions, you may request access and a copy, correction, erasure, restriction and portability of your personal data. You may object to processing based on legitimate interests and withdraw consent where processing relies on it. Burrow does not carry out solely automated decisions producing legal or similarly significant effects; you can challenge incorrect AI suggestions through the service contact.

Requests normally require a response within one month under GDPR; a permitted extension of up to two further months must be explained within the initial period. Requests are normally free, subject to lawful exceptions. Verification should be proportionate. Do not send your full feed URL or subscription credentials in an initial request; a workspace identifier and explanation are usually a better starting point. A person mentioned in someone else’s calendar can also make a request without having a dashboard link.

You may complain to Integritetsskyddsmyndigheten (IMY) in Sweden or another competent EEA supervisory authority, including where you live or work. You do not have to contact Burrow first. See the European Data Protection Board’s rights guidance.

11. US privacy rights

US state privacy laws differ in their scope, exemptions and applicability thresholds. This notice does not claim that every state law applies to this small service. Where applicable, rights can include knowing what personal information is processed, access, correction, deletion, a portable copy, and opting out of sale, targeted advertising or certain significant profiling. California law also provides rights concerning certain uses of sensitive information and authorized agents. Exercising applicable rights must not result in unlawful discrimination.

The information categories, sources, purposes, recipient categories and retention practices are described above. Calendar content can include identifiers, internet activity, sensitive information and rule-derived inferences depending on what you import. The application does not use these for advertising or significant profiling and has no data-sale feature.

Use the published privacy contact to request rights or, where allowed, authorize an agent. We may verify identity and the agent’s authority proportionately. If applicable law provides an appeal, reply to a denied request with “Privacy appeal”; the operator must provide a reasoned response and the appropriate regulator complaint route. California and many state laws generally use a 45-day response period with permitted extensions; the actual applicable deadline controls. See California’s CCPA guidance.

12. Children and sensitive use

Burrow is intended for adults aged 18 and over and is not directed to children. Do not submit children’s personal information. If you believe such information was imported, notify the operator so it can be assessed and removed as appropriate. An age statement alone does not replace obligations triggered by actual knowledge of children’s data.

Burrow is not offered as a medical records service or as a service for processing protected health information, biometric identifiers or other regulated sensitive records. Calendar text can nevertheless reveal health or other sensitive matters. If that occurs, the operator must assess applicable duties, including state consumer health privacy laws; this notice is not a substitute for any separate notice, consent or safeguards those laws require.

13. Changes and contact

The draft date appears at the top. Before this notice becomes effective, the operator must complete the missing details and make a working contact channel available. Material changes to purposes, recipients or practices should be communicated before they take effect, with new consent where required. A revised notice cannot retroactively authorize incompatible uses.

For the service rules, see the Terms of service.