Privacy policy

1. Who is responsible

Christian Bisgaard, Skanderborg, Denmark, is the data controller for the information that our server and we ourselves receive about you ("we"). Until KURS has a CVR number (the Danish business registration number), that is Christian as a private individual. The CVR number will be registered at the beginning of December 2026 – after that, the business's name, address and CVR number will be shown on the KURS website under Contact.
You can always write to us at kontakt@getkurs.com.
Once payment opens, Paddle (Paddle.com Market Limited) sells the subscriptions to KURS and is itself the data controller for the purchase and the payment. Paddle processes your information under its own privacy policy (paddle.com/legal/privacy).
We have no access to what you store in KURS on your own computer. It is yours.

2. What stays on your computer

KURS stores your profiles, items, sales, orders, expenses, vouchers and settings in the KURS data folder on your own computer (on a Mac in ~/Library/Application Support/KURS and on Windows in %APPDATA%\KURS).
We do not receive it. Only what you switch on or send yourself leaves the computer: your subscription (section 3), anonymous usage figures and shared learning (only if you say yes – sections 5 and 5a), messages to Christian and support messages (only when you send them – sections 6 and 6a), automatic error reports (only if you say yes – section 6b), AI in KURS (only if you say yes – section 11a) and the shared folder (section 9). The mail autopilot (section 10) fetches your emails from your email provider to the computer – nothing passes through us. In addition, KURS fetches updates from GitHub or our server (section 7) and shared knowledge (section 5a) – those requests contain only the technical information that any connection has.
If you store information about other people – for example buyers' usernames or a seller's name and address on a purchase voucher – you are the one responsible for it. Only store what you need. You normally have to keep the vouchers for your accounts for 5 years.
You can always export your data or delete it. If you delete a profile, KURS puts it aside in a folder that you can empty yourself.

3. The licence server

If you have a subscription (you can buy one once payment opens), KURS talks to our licence server. It stores:

Your licence: licence ID, licence key, plan, whether you pay monthly or yearly, status, when the period ends, whether you are a Founder, and which codes belong to it – your own invitation code and the code you bought with, if any.
From Paddle: your email address and Paddle's IDs for you, your subscription and your payments. We use the email address to find your licence when you write to us. A shortened version (e.g. "c…@gmail.com") is shown in KURS so that you can see who the licence belongs to. We never receive your card details.
Your computers: a random installation ID for each KURS installation (one per data folder), the platform (Mac, Windows or Linux) and when it last checked the plan. No more than 2 computers at a time. No computer names and no usernames.

When KURS checks your plan – normally once a day – it sends the installation ID, the KURS version and the platform. The response is a signed licence certificate, which KURS stores on your computer so that the plan also works without an internet connection.

If you have not bought anything, the licence server stores nothing about you or your computer – apart from what you send yourself (sections 5 and 6). If you start a purchase without completing it, only the installation ID, the plan and Paddle's ID for the payment are stored, so that the purchase can find your computer if you pay later.

The legal basis is our contract with you. We keep the licence for as long as you have it and for 12 months after it has ended – so that we can answer questions about payments and refunds. Information that we must keep under the Danish Bookkeeping Act (bogføringsloven) is kept for 5 years after the end of the financial year.

4. Payment with Paddle – once payment opens

Until payment opens, you cannot buy anything in KURS, and no one receives your payment details.
Once it is open, you pay with Paddle in your browser. Paddle receives the information the payment requires – for example your email address, your country, your postcode and your payment details – and sends you the receipt.
We receive from Paddle: your email address, the plan, the amounts, the dates and the status of the payments. We use them for your licence, to help you and for our accounts.
Paddle has its headquarters in the United Kingdom and is itself responsible for its processing of what you give Paddle – see Paddle's privacy policy.

5. Anonymous usage figures – only if you say yes

"Help make KURS better – send anonymous usage figures" (Settings › Data) is switched off until you switch it on yourself.
KURS then sends, once a day: the version, the platform, your plan and some counts – for example how many items you have created, how many sales you have recorded, how often KURS was able to recognise an email or a text, and on how many days you have used KURS. Never items, amounts, names, text or files.
The server only stores the combined figures per day for all users – without an installation ID. The figures cannot be traced back to you.
The legal basis is your consent. You can switch it off again at any time. The Founder price and everything else in KURS work the same way, whatever you choose.

5a. Shared learning – only if you say yes

The price suggestions in KURS get better when they are based on more sales than your own. That is why KURS asks once: "Shared learning – do you want to join?" Nothing is selected in advance, and you can always change your answer in Settings › Data › Shared learning.

What is shared: once a week, combined figures from your sales – per brand, category and condition: number of sales, sale prices and days to sale (as sums), and per category the speed of sales, season and price drops, as well as how many sales take place per weekday and time of day. From KURS 6.0, also per brand group, category, condition and season: how many sales fell within each price band (e.g. 140–200 DKK), and how many items were sold – or had not yet been sold – within a certain number of days. These are still only counts: never the price of an individual item, never a date, and a band or a sum with fewer than 3 sales is merged with its neighbour or left out. Only sales that are between 30 days and 24 months old, and only once you have at least 5 of them. Never an individual sale: a sum always contains at least 3 sales. Only known brands and the fixed KURS categories – never anything you have written yourself.
What is never shared: names, usernames, buyers, messages, texts, photos, likes, order numbers, the dates of your sales, your active listings (they only count towards the numbers above), purchase prices and profit.
Who you are: the contribution has a random ID and a deletion key that only your KURS knows. If you have a key from us, the whole key is sent with it – including your name and email address, which are in the key – encrypted, to our server or to the shared folder, so that each licence only counts once and no one can cheat their way to other people's figures. If you have a subscription, KURS sends your installation ID instead, so that the server can find the licence. The key is only used for that check: we do not store it, only a fingerprint of it – and never your installation ID or your IP address.
The purpose: shared knowledge – figures that make every user's price suggestions better. Shared knowledge only shows figures based on at least 3 sellers with a licence and at least 5 sales, where no single seller accounts for more than 60% of the sales, and where everything is rounded (e.g. prices to the nearest 5 or 10 DKK). That way, no one can read off what one person has sold.
Where: if your KURS has a connection to our server, the figures go there encrypted (Cloudflare in Europe – section 8). Otherwise they are placed, encrypted, in the shared folder you have chosen (e.g. in Google Drive), so that only the person who created the folder can open them.
How long: on our server, your figures are kept for no more than 8 days – each week, the latest ones take their place. In the shared folder, your file is replaced every week, and a file that is more than 8 days old is not used. If you say no, your contribution is deleted immediately if the server or the folder can be reached – otherwise the next time KURS can reach it.
The legal basis is your consent (Article 6(1)(a) of the General Data Protection Regulation (GDPR) and section 3 of the Danish Executive Order on Cookies (cookiebekendtgørelsen)). You can withdraw it at any time – it is as easy as giving it.
Only from the age of 18: if you are under 18, KURS does not ask, and it cannot be switched on. You still get shared knowledge in your price suggestions.
Everyone gets shared knowledge – whatever you answer. Nothing in KURS depends on your answer. If your KURS has a connection to our server, it fetches shared knowledge from there when it starts and once a day; the request contains only the technical information that any connection has (IP address, KURS version and platform) and is not used to track you.
We never sell your figures and never share them with others – only shared knowledge, with the combined, rounded figures, goes to the users of KURS.

6. Support messages

You can write to Christian inside KURS – under Help › Write to Christian (section 6a). If you press "Send to KURS" under "Report a problem", the report also becomes a thread there: your message and the diagnostics you see before you send – version, operating system, plan, number of items, orders and accounts, and the latest errors, without names, amounts, addresses, email addresses, phone numbers, links or keys.
We only use it to help you and to fix errors.
If you write to us by email – including when KURS opens an email to us for you because your version of KURS cannot send by itself – the email is held by our email provider. We delete it when the matter has been closed, unless we have to keep it under the Danish Bookkeeping Act.

6a. Write to Christian

What is sent: what you write and what is shown under "Sent along" in the dialog – the page you wrote from, the KURS version, the platform (Mac, Windows or Linux) and the language. If you have a key from us, the key's ID is sent along (e.g. K-7F3A2C) so that Christian can see who you are. Your installation ID is also sent, so that we can find your licence. If you tick "Attach diagnostics", the diagnostics are included (section 6) – exactly what you can see with "Show".
Who reads it: only Christian. He reads and replies in KURS Admin on his own computer and looks up your name in his own list of the keys he has made – our server never stores names. When you write, Christian receives a short notification that there is a new message – only with the thread number, never with the content.
Where it is stored: on our server at Cloudflare (section 8). The thread has a secret key that only your KURS knows – the server only stores a fingerprint of it, so no one else can read the thread. On your computer, KURS stores the thread number, the key, a short preview and what you have seen – in a file that only your user account can read. KURS fetches the reply when it starts and every half hour.
How long: a thread is closed when nothing has happened in it for 30 days (or when Christian closes it), and it is deleted, with all its messages and the diagnostics, 60 days after it was closed. If you write again in an open thread, the 30 days start again.
The legal basis is that you ask for help yourself: we use the message to reply to you and to fix errors in KURS (Article 6(1)(b) and (f) GDPR).
Do not write more about other people than you need to – buyers' names or addresses, for example, are rarely needed to get help.

6b. Automatic error reports – only if you say yes

"Send error reports automatically" (Settings › Help and error reports) is switched off until you switch it on yourself – for example when KURS asks you once, after you have sent a message. If you are under 18, KURS does not ask, and it cannot be switched on.
What is sent when something goes wrong in KURS: the type of error, a short message about the error, where in the KURS code it happened (files, functions and lines), the KURS version, the operating system and a random fingerprint for your installation, so that Christian can see whether an error affects one user or many. Before a report is sent, KURS removes names, amounts, email addresses, addresses, phone numbers, links, keys and paths containing your username from the message – and KURS never sends your items, sales, texts or photos. As with any connection, Sentry sees the IP address the report comes from; KURS does not include it in the report.
Who: Sentry (Functional Software, Inc.) receives the reports on our behalf and stores them in Sentry's data centre in the EU (Frankfurt, Germany). Sentry is an American company. If Sentry processes any of it from the USA, for example in connection with support, this takes place under the EU-US Data Privacy Framework, under which Sentry is certified – and otherwise under the EU's standard contractual clauses.
How long: no more than 90 days at Sentry. KURS sends no more than 20 reports an hour, and the same error no more than once an hour.
The legal basis is your consent (Article 6(1)(a) GDPR). You can switch it off again at any time – then no more reports are sent.

7. Updates and the website

KURS checks for new versions when it starts and once a day – with GitHub (GitHub, Inc.), where the KURS releases are published, or with our server. The request contains only the technical information that any connection has – IP address, KURS version and platform – and is not used to track you. The update is downloaded from the same place, and KURS checks the signature before it is installed.
The website has no cookies, no tracking and no advertising. If you buy a subscription once payment has opened, the payment page opens Paddle's checkout window, and Paddle may use cookies that are necessary for the payment.
The server limits how many requests can come from the same IP address within a short time, to stop misuse. The IP address is not stored together with your licence.

8. Where the information is stored, and who helps us

Cloudflare (Cloudflare, Inc.) runs our server, database and website. The database with licences, computers, messages to Christian and shared learning is stored in Cloudflare's data centres in Europe. Cloudflare may process technical information such as IP addresses in its network outside the EU when it delivers and protects the server – this takes place under the EU's standard contractual clauses and the EU-US Data Privacy Framework. What you send to AI in KURS passes through the server without being stored (section 11a).
Anthropic (Anthropic, PBC) provides the AI for AI in KURS – only when you have said yes (section 11a).
Sentry (Functional Software, Inc.) receives the automatic error reports – only when you have switched them on (section 6b).
GitHub (GitHub, Inc.) hosts the KURS releases. When KURS downloads an update – or you download KURS from there – GitHub sees the technical information that any connection has (e.g. the IP address) and processes it under its own privacy policy. We receive nothing about you from GitHub.
Paddle sells KURS and receives the payment once payment has opened (section 4).
Our email provider, when you write to us by email.
We never sell your information and do not share it with others unless the law requires it.

9. What you can switch on yourself

Some features use the network or share something – but only if you switch them on yourself:

The shared folder (shared knowledge and updates): if you choose a shared folder, e.g. in Google Drive, KURS fetches shared knowledge and new versions from it – this shares nothing. Only if you have said yes to shared learning (section 5a) and your KURS has no connection to our server does KURS place your contribution in the folder as an encrypted file that only the person who created the shared folder (KURS Admin, run by us) can open. If you have a key from us, the whole key – with your name and email address, which are in the key – is in the same encrypted file, so that each key only counts once. It is only used for that check and is not stored. If you say no, or stop using the folder, your file is deleted from it.
Calendars: if you fetch a calendar via an address, or connect Google Calendar or the Outlook calendar, KURS only stores when you are busy – never titles, locations or attendees.
KURS Lomme: the phone only talks to KURS on your own network.
Encrypted backup: the file is encrypted with your own password before it is placed in the folder you choose. We never know the password.
The mail autopilot: KURS only reads emails from Vinted and the carriers – see section 10.

10. The mail autopilot

The mail autopilot is switched off until you connect your email yourself in Settings › Connections. KURS then keeps itself up to date with your purchases, sales and parcels from Vinted.

What KURS reads: only emails from Vinted and the carriers (DAO, PostNord, GLS, Bring and Instabox). KURS asks your email provider for exactly those and opens no other emails. The first time, KURS looks 30 days back – after that, every 15 minutes while KURS is open.
Read-only: KURS marks nothing as read and never deletes, moves or sends anything in your email.
What KURS stores: only what the email says about the transaction – title, amount, username, carrier, deadline and pick-up point – and a fingerprint (e.g. the email's ID), so that the same email does not count twice. The whole email is never stored. From a receipt, KURS stores at most the lines the voucher uses – see section 11.
What KURS does not store: emails that KURS cannot use (e.g. newsletters) – and all other emails, which KURS does not read at all.
The sender is checked: KURS only does something on its own (records a sale, marks an order, records a like or adds a parcel to Today) when your email provider has confirmed that the email is from Vinted or the carrier. KURS can see this with Gmail and iCloud. Other emails – and everything via "Other email" – wait in the Inbox with a note until you have checked them.
The password (an app password that you create with your email provider) is stored in Keychain on your Mac and, on Windows, encrypted with your Windows user account. If neither can be used, KURS only stores it in a file on your computer if you choose that yourself – the file can only be read by your user account, and this is shown in Settings. It is never stored in the KURS database, in a backup, in an export, in the shared folder or in a log, and it is only sent to your email provider.
The connection goes encrypted directly from your computer to your email provider. Nothing passes through us.
Connect with Google or Microsoft. If you connect Gmail, Google Calendar, Outlook/Hotmail or the Outlook calendar by signing in, you give KURS permission to read – never to send, delete or change anything. KURS only fetches emails from Vinted and the carriers, and only start and end times from the calendar, directly from Google or Microsoft to your computer. Nothing passes through us, and nothing is stored outside your computer. The access you have given KURS is stored in Keychain on your Mac or encrypted with your Windows user account. If you disconnect, KURS deletes the access – with Google, KURS also revokes it; with Microsoft, you remove KURS yourself under your account's permissions (account.live.com/consent/Manage or myapplications.microsoft.com).
Google's rules for user data: KURS' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can read the policy at developers.google.com/terms/api-services-user-data-policy.
How to stop: Settings › Connections › your email › Disconnect. KURS then deletes the password or the access and stops reading your email. What KURS has already found stays in the Inbox, where you can edit or delete it. You can also delete the app password with your email provider – then it no longer works.
When the plan expires, the mail autopilot pauses: KURS reads no new emails, but the connection and what has been found remain until you disconnect.

11. Receipts and "Private" in the Inbox

This applies to everything you give KURS: emails from the mail autopilot, texts you paste in and files you drag in.

The receipt as a voucher (Inbox › "Save the receipt as a voucher" – switched on by default): from a purchase, KURS only stores the lines the voucher uses – the item's title, the amounts, the order number, the date and the seller's username. Never your name, your address, postcode and town, your phone number or your email address. If you switch it off, KURS stores none of the lines.
How long: the lines are kept with the purchase while it waits in the Inbox – for no more than 14 days. Then they are deleted, and "To inventory" still works, just without the receipt as a voucher. If you choose "To inventory" with the voucher, the lines become a PDF on the item (a voucher, which you normally have to keep for 5 years), and the text in the Inbox is deleted once you can no longer undo (after 7 days).
Private – not in the accounts: KURS then deletes everything about the purchase except its type (a purchase) and two fingerprints, so that you are not asked about the same purchase again: the fingerprint of the email or text, and a fingerprint of the transaction itself. The latter is made with a random key that only exists in your profile – so that no one can work out what you bought.
Backups: KURS' own copies of the database on your computer (one a day; the 20 most recent are kept) and your encrypted backups are copies from the time they were taken. A copy from before you chose "Private" (or before a receipt was deleted) may therefore still contain the purchase and the receipt's lines until it has been replaced by a newer one.

11a. AI in KURS – only if you say yes

KURS can use AI – Claude from Anthropic – to write a suggestion for your listing, to shorten a selected text or make it more specific, to check a text against the item's facts and to understand your question in the search (Ask KURS). The first time, KURS shows "AI in KURS", and nothing is selected in advance. Without AI, everything in KURS works with KURS' own text engine and fixed patterns.

What is sent – only what the task requires: the item's facts (brand, model, category, size, condition, fit, colour, material, measurements, what you have written under "The best thing about the item" and "Flaws", smoke-free home and style number), the listing text you are working on and your question – for Ask KURS, also the names of your brands and the KURS categories. Never buyers, messages, notes, purchase prices, emails or account names. You always see what is sent ("What's sent") before the first request of each kind – and it is one click away after that.
Your plan and your quota: KURS sends your installation ID and – if you have a key from us – the whole key, so that the server can check your plan. The key contains your name and email address; the server only uses it for the check and does not store it – only the key's ID, against which the quota is counted. To stop misuse, the server also counts new trial installations per IP address – as a fingerprint that is deleted after 48 hours.
The route: KURS sends it encrypted to our server at Cloudflare (section 8), which forwards it to Anthropic and sends the answer back to you. Our server does not store the content – only figures: how many times and how much you have used AI in the month (for your quota) and the combined figures per day for everyone. Your monthly figures are deleted no later than three months afterwards, and the combined daily figures (which cannot be traced back to you) after 13 months.
Anthropic (Anthropic, PBC) processes it on our behalf as a data processor under Anthropic's commercial terms. Under those terms, Anthropic may not train its models on the content. Under Anthropic's rules for the API, Anthropic deletes what is sent and what is answered no later than 30 days afterwards – unless something has to be kept for longer to enforce Anthropic's usage policy or by law.
Transfer to the USA: Anthropic stores the information in the USA and may route the request through data centres in other countries. This takes place under the EU's standard contractual clauses in Anthropic's data processing agreement.
A suggestion: the AI's answer is only a suggestion – you decide yourself whether to use it. KURS only saves the text when you choose to use it.
The legal basis is your consent (Article 6(1)(a) GDPR). You can switch AI off again under Settings › AI – then nothing more is sent.
Only from the age of 18: if you are under 18, KURS does not offer AI, and it cannot be switched on.

12. Keys and invitations from us

When you buy a key directly from us, or we make an invitation for you: your name, your email address (for an invitation, only if you have given it to us), the plan and the period – and, for a purchase, the amount and how you paid. We use this to make your key, to help you and to keep our accounts. The legal basis is our contract with you and the Danish Bookkeeping Act. We keep the accounts for 5 years after the end of the financial year – the rest for as long as you have a key.
If you pay with MobilePay or by bank transfer, we see what the payment shows (e.g. your name and phone number). MobilePay and the bank process the payment under their own rules.
Your name and email address are in the key itself, so that KURS can show who the key belongs to. The key is stored on your computer and in our own list of the keys we have made. If you say yes to shared learning, the whole key goes with your contribution – encrypted, to our server or to the shared folder – so that each key only counts once (sections 5a and 9). It is only used for that check and is not stored there.

13. Your rights

You have the right to know what information we hold about you, and to have it corrected, deleted or handed over to you. You can also object to our use of it and withdraw a consent. Write to us at kontakt@getkurs.com – we reply within one month. If you are not satisfied with how we process your information, you can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

14. Changes

If we change the privacy policy significantly, KURS shows you the new version before anything new is sent from your computer, and you will need to read it again.