Back to home

Privacy Policy

Version 1.3 · Last updated: October 18, 2026

1. Who We Are

Query OÜ ("Query OÜ," "EasyRoutine," "we," "our," or "us") operates EasyRoutine, a personal productivity application that lets you build daily routines, define activities, and log completions manually or with your device camera. The Service is available as a mobile application for iOS and Android. We also operate the website easyroutineapp.com.

For the personal data described in this Privacy Policy, Query OÜ is the data controller.

  • Company: Query OÜ.
  • Registered address: Teeveere tee 11, Vääna-Jõesuu küla, 76909 Harku vald, Harju maakond, Estonia.
  • Contact email: info@easyroutineapp.com.

2. Scope

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you install or use the EasyRoutine mobile app, create an account, use the Service, visit our website, or contact us.

EasyRoutine is designed as a personal-use tool. Routines and activities you create are private to your account and are not shared with or visible to other users.

3. Personal Data We Collect

3.1 Account and Contact Data

  • Email address used for registration, one-time sign-in codes, and service communications. If you sign in with Apple or Google, we receive it from that provider (with Apple, this may be a private relay address if you chose to hide your email).
  • Account identifiers such as your internal user ID, account settings, and preferences.
  • If you sign in with Apple or Google, we receive a user identifier and, where the provider has verified it, your email address. We do not receive or store your name or your Apple or Google password. If you sign in with Apple, we also store a token issued by Apple so that we can revoke EasyRoutine's access to your Apple ID when you delete your account.

3.2 App Content

  • Routines: routine names and their order.
  • Activities: activity names, colours, order, pinned and archived state, schedules and reminder settings, and the short text label generated from the activity photo.
  • Completion logs: the date and time an activity was logged, and any comment and flag you add.
  • Activity photos: when you add a photo to an activity, taken with your device camera or chosen from your photo library, the image is uploaded to our servers and stored as a reference image for that activity. A resized copy is sent to Google's Gemma AI model, which returns a short text label that we store with the activity (see Section 5.1). The photo is deleted when you remove it, the activity, its routine, or your account.
  • Camera images used for AI photo scan: you can log a completion manually or with your device camera. When you scan, the captured image is sent to our servers and processed by Google's Gemma AI model together with a text list of your activities that have a photo (up to 150): each activity's name, its routine's name, and its stored label. The model returns the matching activity. The scan image is processed in memory and is not stored on our servers or in our database. Only the resulting completion log is saved. Activity and routine names are chosen by you and may reveal information about you (for example, a medication you track), so please keep this in mind when naming them. See Section 5.1 for the AI providers involved.

3.3 Technical and Log Data

Our infrastructure automatically records technical information when the app communicates with our servers, including:

  • IP address.
  • Device type and operating system version as reported by the app.
  • Timestamp, requested endpoint, HTTP method, and response status.

3.4 Communications Data

  • Emails you send to us for support, privacy, or account matters.
  • Any information you include in support requests or rights-exercise requests.

3.5 Authentication Tokens

We use a secure authentication token stored on your device to maintain your login session. This token is required to access the Service and is not used for advertising or tracking. The mobile application does not use browser cookies.

3.6 Website, Cookies, and Ad Attribution

Our website does not use analytics, advertising, or tracking cookies, tracking pixels, or fingerprinting scripts, and it loads no third-party scripts. It stores your theme choice in your browser's local storage and, if you pick a language in the language menu, remembers that choice in a cookie.

When you reach our website through a Google Ads advertisement or a campaign link, the link carries an ad click identifier (Google's gclid, or wbraid or gbraid on some Apple devices) and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, and utm_content). The website keeps them in your browser's session storage for the visit and passes them on when you tap a download button. Our server then records the click (the click identifiers, campaign parameters, platform, time, your IP address, browser user agent, and referring page) and forwards you to the App Store or Google Play. Clicks without a click identifier or campaign parameters are not recorded.

We send Google Ads only the gclid, the time of the click, and a random reference number for the click, so that Google can count the click as a conversion of its advertisement. Your IP address, user agent, referring page, campaign parameters, and any wbraid or gbraid are not sent to Google. These records, including our record of which gclids were already sent to Google, are not linked to an EasyRoutine account and are deleted 90 days after the click, the period in which Google Ads accepts conversions.

3.7 Advertising in the App

On the free plan, the mobile application shows banner advertising through Google AdMob. The AdMob SDK may read or store a device advertising identifier and collect device and usage information as described in Section 5.1. When the app starts, it asks for your consent where the law requires it (in the EEA, the UK and Switzerland through Google's consent form, and on iOS through Apple's App Tracking Transparency prompt). AdMob is started only after that choice and follows it. You can change your choice at any time in the app under Profile → Privacy choices (where the consent form applies) and, on iOS, in your device's tracking settings. Premium subscribers are not shown ads.

3.8 Subscription and Purchase Data

Premium is purchased through the Apple App Store or Google Play, which process the payment. We receive and store what we need to verify and maintain your subscription: the store's transaction or purchase token identifier, the product, the expiry date and status of the subscription, and the notifications Apple or Google send us about renewals, refunds, and cancellations. We do not receive your payment card details.

4. Why We Use Personal Data and Our Legal Bases

Under GDPR, we must have a lawful basis for processing personal data. The legal bases we rely on are performance of a contract, consent, legitimate interests, and legal obligation.

  • Account creation, login, authentication, and account administration: processed under Article 6(1)(b) GDPR (performance of a contract).
  • Storing and syncing your routines, activities, completion logs, and photos: processed under Article 6(1)(b) GDPR (performance of a contract).
  • AI photo labelling and photo scan: processed under Article 6(1)(b) GDPR (performance of a contract), only when you add an activity photo or start a scan.
  • Verifying and maintaining your Premium subscription: processed under Article 6(1)(b) GDPR (performance of a contract).
  • Sending transactional emails such as one-time sign-in codes and service notices: processed under Article 6(1)(b) GDPR where necessary to provide the Service.
  • Advertising on the free plan: where the law requires consent, the use of your advertising identifier and personalised advertising are based on your consent under Article 6(1)(a) GDPR, which you can withdraw at any time as described in Section 3.7. Where you do not consent, Google may still show non-personalised ads, based on our legitimate interest in funding the free plan (Article 6(1)(f) GDPR).
  • Website ad attribution: processed under Article 6(1)(f) GDPR (our legitimate interest in measuring the effectiveness of our advertising). The data is limited to clicks from ads or campaign links, is not linked to your account, and is deleted after 90 days. You may object at any time.
  • Security monitoring, abuse prevention, and infrastructure logging: processed under Article 6(1)(f) GDPR (our legitimate interest in securing the Service and protecting our users). We have balanced this interest against your rights and freedoms. Log data is limited in scope, retained for only 14 days, and is not used for marketing or profiling.
  • Retention of accounting and compliance records and responses to lawful authority requests: processed under Article 6(1)(c) GDPR (legal obligation).

We do not currently use profiling that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.

5. Sharing of Personal Data

5.1 Service Providers

We share personal data only where necessary to operate the Service or comply with law. Recipients include:

  • Hetzner Online GmbH: server hosting in Helsinki, Finland (EU), and object storage for activity photos in Hetzner's EU data centres.
  • AI image processing (Google's Gemma model): when you add an activity photo, a resized copy of the image is sent to Google's Gemma vision model, which returns a short text label. When you scan, the captured image is sent together with the names, routine names, and labels of your activities that have a photo, and the model returns the matching activity. This data is used only to produce that result. We do not use your images or content to train AI models. Today the request reaches Google's Gemma model through OpenRouter, Inc., a United States based inference routing provider. We may change the routing provider or call Google directly in the future, but the model used for image processing remains Google's Gemma model. Processing by the routing provider and the model provider is governed by their own terms: OpenRouter states that it does not retain prompt or completion content by default, and Google's terms for its paid API services state that prompts and responses are not used to improve or train Google's models.
  • Email delivery provider: sends our one-time sign-in codes on our behalf and processes your email address and the content of those emails.
  • Apple Inc. / Apple Distribution International Ltd.: if you use Sign in with Apple, Apple processes authentication on your behalf; if you buy Premium on iOS, Apple processes the purchase and the payment through the App Store. Apple does so under its own Privacy Policy.
  • Google LLC / Google Ireland Limited (Sign-In and Google Play): if you use Google Sign-In, Google processes authentication on your behalf; if you buy Premium on Android, Google processes the purchase and the payment through Google Play. Google does so under its own Privacy Policy.
  • Google Ireland Limited / Google LLC (AdMob): serves the banner ads shown on the free plan. Depending on your consent choices, Google may use a device advertising identifier, IP address and ad interaction data to deliver, measure and personalise ads, in accordance with Google's Privacy Policy and its EU User Consent Policy.
  • Google Ireland Limited / Google LLC (Google Ads): receives the gclid, click time, and a random reference number of the website download clicks described in Section 3.6, to measure our advertising.
  • Professional advisers such as accountants, lawyers, or insurers where reasonably necessary.
  • Authorities, courts, regulators, or law enforcement where disclosure is required by applicable law.

5.2 No Sale of Personal Data

We do not sell, rent, or trade your personal data for monetary gain. The free plan is supported by Google AdMob banner ads as described in Sections 3.7 and 5.1; your routines, activities, logs and photos are never shared with advertisers.

5.3 Business Transfers

If Query OÜ is involved in a merger, acquisition, financing transaction, or sale of assets, personal data may be transferred as part of that transaction. We will provide notice where required by law.

6. International Data Transfers

Our servers and photo storage are located in the European Union. The following processing takes place outside the EEA, mainly in the United States:

  • AI image processing: the images, activity names, routine names, and labels described in Section 3.2 are processed by OpenRouter and Google's Gemma model in the United States, for the limited purpose of returning a label or activity match.
  • Advertising and ad measurement: Google (AdMob and Google Ads) may process advertising identifiers, IP addresses, ad interaction data, and ad click identifiers in the United States and other countries.
  • Sign-in and purchases: Apple and Google may process authentication and purchase data in countries outside the EEA.

For these transfers we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards at the contact address in Section 12.

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy.

You can delete your account and all associated data at any time from within the app (Profile → Delete Account) or by following the instructions at easyroutineapp.com/delete-account. If you signed in with Apple, we also ask Apple to revoke EasyRoutine's access to your Apple ID. Deleting your account does not cancel a Premium subscription: cancel it in your App Store or Google Play subscription settings.

  • Account and contact data is retained while your account is active. It is deleted immediately when you delete your account in the app, and within 30 days of a verified deletion request by email, unless a longer retention period is required by law.
  • Routines, activities, completion logs and photos are retained while your account is active and deleted immediately when you delete your account in the app (or within 30 days of a verified deletion request by email). When you delete a single routine, activity, or log, it disappears from the app at once and any photo is deleted from storage; the record itself is kept on our servers, marked as deleted so that your other devices can sync the deletion, and is permanently erased 30 days after the deletion (or earlier, if you delete your account before then). Copies in rolling backups expire as described below.
  • Subscription and purchase data: the current state of your subscription (store identifier, product, expiry date, and status) is retained while your account exists and deleted with it. The history of purchase events and store notifications for your account is deleted 400 days after each event, so that we can handle refund and billing disputes, or earlier when you delete your account. Store notifications that we cannot match to an account are deleted after 90 days.
  • Website ad attribution records (Section 3.6), including the record of the gclids sent to Google Ads, are deleted 90 days after the click.
  • Rolling backups are retained for up to 30 days and are used solely for disaster recovery purposes. Backups are not actively processed or queried. Deleted data will not be actively restored from backups except to recover from a system failure; once the relevant backup cycle expires, the data is permanently removed.
  • Server access logs are rotated and retained for 14 days.
  • Support and privacy correspondence is retained as long as reasonably necessary to handle the request and establish, exercise, or defend legal claims.
  • Accounting and billing records are retained for up to 7 years where required by the Estonian Accounting Act or other applicable law.

8. Your Rights Under GDPR

If GDPR applies to you, you have the right to request access to, correction of, deletion of, restriction of, objection to, or portability of your personal data, subject to applicable legal exceptions.

  • Right of access: ask for a copy of the personal data we hold about you.
  • Right to rectification: ask us to correct inaccurate or incomplete data.
  • Right to erasure: ask us to delete your personal data where there is no overriding reason to keep it.
  • Right to restriction: ask us to limit processing in certain circumstances.
  • Right to data portability: ask for certain data in a structured, machine-readable format.
  • Right to object: object to processing based on our legitimate interests.
  • Right to withdraw consent: where we rely on consent, you may withdraw it at any time.
  • Right to lodge a complaint: complain to your local supervisory authority, including the Estonian Data Protection Inspectorate.

To exercise your rights, email info@easyroutineapp.com with the subject line "GDPR Rights Request". We may ask you to verify your identity before responding. We aim to respond within one month, extendable by up to two months for complex requests.

Estonian supervisory authority: Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia. Website: www.aki.ee.

9. Security Measures

We use appropriate technical and organisational measures to protect personal data, including:

  • TLS/HTTPS encryption for all data in transit.
  • Secure authentication architecture with token-based sessions.
  • Access controls designed to limit internal access to authorised personnel.
  • Regular backups and infrastructure monitoring.
  • Hosting within Hetzner's certified EU data centre in Helsinki.

No system is completely secure. We cannot guarantee absolute security, but we will handle personal data breaches in accordance with applicable law, including GDPR Articles 33 and 34.

10. Children's Privacy

EasyRoutine is not directed to children under 16. You must be at least 16 years old to create an account. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to us, please contact us and we will investigate and delete it where appropriate.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or product changes. When we do, we will update the "Last updated" date on this page. If changes are material, we will provide additional notice such as by email or in-app notification where required.

12. Contact

Query OÜ has not appointed a Data Protection Officer. Privacy inquiries, GDPR rights requests, and account deletion requests may be directed to our general contact address below.

For privacy questions, GDPR rights requests, or account deletion requests, contact Query OÜ at:

  • Email: info@easyroutineapp.com.
  • Postal address: Teeveere tee 11, Vääna-Jõesuu küla, 76909 Harku vald, Harju maakond, Estonia.
  • Suggested subject lines: "Privacy Policy Inquiry," "GDPR Rights Request," or "Account Deletion Request."

Summary: We collect account data, routine and activity content, subscription data, and limited technical log data to operate and secure EasyRoutine. Query OÜ is the data controller. Your data is hosted in Helsinki, Finland by Hetzner. Photos you add or scan are processed by Google's Gemma model in the United States together with your activity names, and scan photos are not stored. The free plan shows AdMob ads according to your consent choices, and clicks from our website ads are kept for 90 days to measure them. We do not sell personal data, and you can exercise your GDPR rights by emailing info@easyroutineapp.com.