Privacy Policy

1. Who we are

Tovena is a shared calendar and coordination service for families, households and other groups.

MODES AS is the data controller for personal data processed through Tovena.

2. What this Privacy Policy covers

This Privacy Policy explains how we collect, use, store and share personal data when you create an account or use Tovena.

Tovena is intended to be operated by adults. Adults may create profiles for children, dependants, family members or other contacts for the purpose of coordinating a shared calendar. Children and dependants do not have their own Tovena accounts in the current version of the service.

3. Personal data we process

Account and profile information

When you create and use a Tovena account, we may process:

• your email address;
• your display name;
• your selected avatar;
• your selected member colour;
• your account and authentication information;
• your device language and time zone; and
• basic settings associated with your account.

Passwords are handled through our authentication provider. Tovena does not store your password in plaintext.

Group information

When you participate in a group, we process information such as group membership, your role in the group, group ownership, group settings, and invitation and join information.

Calendar and coordination information

Tovena processes information you and other group members add to the service, including event titles, event descriptions and notes, dates and times, recurring event settings, manually entered location information, event participants, people an event concerns, responsibility assignments, responsibility requests and responses, messages attached to responsibility requests, reminder settings, and in-app notifications.

Tovena currently does not access your device's GPS location. Event locations are entered manually by users.

Information about children, dependants and other people

Adult users can create profiles for dependants, children and saved contacts. These profiles may contain a display name, an optional relationship label, a selected avatar, and a colour used within the calendar.

Tovena does not currently require an email address, date of birth or GPS location for these profiles.

If you add information about another person, you are responsible for ensuring that you have an appropriate basis to provide that information and that you do not add information that is unnecessary for using the shared calendar.

Device information and reminders

If you choose to enable a reminder, Tovena may request permission to send notifications on your device.

Event reminders are currently scheduled as local device notifications. Tovena does not currently use remote marketing push notifications or store push-notification tokens for this purpose.

Information you send to us

If you contact us, for example at contact@modesgroup.com, we may process your email address and any information you include in your message so that we can respond to your request.

4. Information we do not currently collect for advertising or tracking

The current version of Tovena does not use advertising SDKs, behavioural advertising, Google Analytics or similar product analytics, advertising identifiers, GPS tracking, contact-book access, camera access, photo-library access, social login, remote marketing push notifications, or user tracking across third-party apps or websites.

If this changes, we will update this Privacy Policy and, where required, ask for appropriate permission before the new processing begins.

5. Why we process personal data

To provide Tovena

This includes creating and authenticating accounts, maintaining profiles, creating and managing groups, displaying shared calendars, creating and editing events, coordinating participants and responsibilities, providing reminders and notifications, and allowing users to manage or delete their accounts.

For personal data necessary to provide your account and the service you request, our legal basis is generally that processing is necessary to perform our agreement with you.

To provide shared group functionality

Some information concerns other people, including dependants, saved contacts and information entered into shared events.

Where appropriate, we process this information on the basis of our legitimate interest in providing a shared coordination service requested by our users, while limiting the information collected to what is relevant to that functionality.

To protect Tovena and its users

We may process information where necessary to secure accounts and data, prevent misuse, investigate technical or security problems, and maintain the integrity of the service.

Our legal basis is our legitimate interest in operating a secure and reliable service and, where applicable, compliance with legal obligations.

6. How information is shared inside Tovena

Tovena is a shared service.

Members of the same active group may be able to see information relevant to that group, including member names, avatars, colours and roles; dependants and saved contacts; shared events; descriptions and manually entered locations; event participants; responsibility assignments and statuses; and relevant request and coordination history.

Information in one group is not intended to be visible to people who are not active members of that group.

You should therefore only place information in a shared event or group that is appropriate to share with the other members of that group.

7. Service providers

Supabase

We use Supabase for account authentication, database hosting, application data storage, APIs, and authentication emails such as password recovery.

Our Tovena Supabase project uses the West EU (Ireland) region. Supabase may use subprocessors and, where applicable, transfer mechanisms for processing outside the EEA.

Expo

Tovena is built using Expo and React Native technologies. In the current implementation, Expo modules are used for app functionality such as local notifications, linking and other device functionality. We do not currently use Expo to store Tovena's shared calendar database.

8. International processing

Tovena's primary application database is currently hosted in the West EU (Ireland) Supabase region.

Some service providers or their subprocessors may process limited information outside Norway or the EEA. Where GDPR requires safeguards for transfers outside the EEA, the relevant transfer mechanism must be used.

9. How long we keep information

We keep personal data only for as long as needed for the purposes described in this Privacy Policy, subject to the shared nature of Tovena.

If you leave a group

Your active membership is removed. Some historical information may remain where necessary to preserve the group's event and responsibility history. Your previous membership record may therefore remain in the group. Future responsibility assignments associated with the removed membership are cleared where applicable.

If you delete your account

Before deleting your account, you must first transfer ownership of, or delete, any groups that you own.

When account deletion is completed, your authentication account, profile, account preferences, personal reminders and personal notification inbox are deleted; your active memberships are removed; and future responsibilities associated with those memberships are cleared where applicable.

Because Tovena is a shared calendar, shared content does not necessarily disappear when one participant deletes their account.

Shared events and relevant group history may remain for the other group members. Historical membership records that need to remain are de-identified in the app as “Former member” rather than continuing to display your account identity.

Some event or request history may also remain where it is part of the shared group's history but no longer directly linked to your deleted user account.

If an owner deletes a group

The group and its group-scoped content, including its events, people and related group data, are deleted. Deleting a group does not delete the personal accounts of its other members.

10. Account deletion

You can delete your account inside Tovena:

You will be asked to confirm your current password.

If you own a group, you must first transfer ownership to another eligible adult member or delete the group.

If you cannot access your account and wish to request deletion, contact contact@modesgroup.com.

11. Security

We use technical and organisational measures intended to protect personal data. The current service includes measures such as Supabase Auth for authentication, HTTPS connections between the app and backend, database Row Level Security, restricted server-side database functions for sensitive actions, and a client-side publishable Supabase key rather than a service-role key.

No internet-connected service can guarantee absolute security.

12. Your privacy rights

Depending on the circumstances, applicable data-protection law may give you rights including the right to information, access, correction, deletion, restriction, objection, and data portability.

To exercise a privacy right relating to Tovena, contact contact@modesgroup.com. We may need to verify your identity before acting on a request.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe that your personal data has been processed unlawfully.

13. Children

Tovena is designed as an adult-operated shared calendar. Children do not currently create Tovena accounts.

An adult may create a limited dependent profile for a child in order to coordinate family activities. We intentionally limit the information required for such profiles.

Users should not enter sensitive or unnecessary information about children into event titles, descriptions, notes or other free-text fields.

14. Changes to this Privacy Policy

We may update this Privacy Policy as Tovena develops or where legal requirements change. If we make material changes, we will take reasonable steps to inform users through the service or other appropriate means.

The effective date at the top of this page identifies the current version.

15. Contact