Privacy policy

This policy explains how Code Garden (Pty) Ltd (“we”) handles personal information when you use Kerf. We follow the Protection of Personal Information Act, 2013 (POPIA). In short: we collect only what we need to run Kerf, we don’t sell it, and we don’t use advertising cookies. Analytics cookies are set only if you accept them.

Who is responsible

Code Garden (Pty) Ltd is the responsible party for your personal information. Our Information Officer is Sasha Stojanovic, who you can reach at privacy@kerfcutlist.com. We are based in Cape Town, Western Cape, South Africa.

What we collect

If you use Kerf without an account

Your projects and settings are stored in your own browser (local storage), not on our servers. We see only the technical information any website receives with each request, such as your IP address and browser type, which our hosting keeps briefly in logs for security and troubleshooting.

If you create an account

• Account details: your name, email address and a scrambled (hashed) version of your password. We never store the password itself.
• Your projects: the parts, boards, prices and settings you sync, so you can open them on your other devices.
• Your plan: which plan you are on, and its billing dates and status.
• Activity: when you signed up and last signed in, and security logs (for example failed sign-ins) to protect your account.

If you share a project

Share stores a copy of that project (its name, parts, boards, prices and settings) so anyone with the link can see it. The link doesn't show your name or email. It works until you stop sharing or delete your account, and shared pages are kept out of search engines.

If you send feedback

Send feedback in the app emails us your message, the page you sent it from and your browser type, with your name and email address if you are signed in or chose to give it, so we can reply.

If you buy Pro

Payments are taken by Paddle, our reseller and Merchant of Record. Paddle collects your payment details, billing address and tax information directly; we never see or store your card number. Paddle tells us that you have paid, your plan and billing dates, and a customer reference, so we can switch Pro on.

Why we use it

• To provide Kerf: sign you in, sync your projects, make your PDFs and supplier lists, and give you the features of your plan (performing our contract with you).
• To send emails you need: confirming your email address, password resets, security notices, and messages about your plan, such as a payment that failed or a plan about to end.
• To keep Kerf secure and working: preventing abuse, limiting repeated sign-in attempts and fixing problems (our legitimate interest).
• To meet legal duties, such as keeping records of sales.

We don’t send marketing email unless you have asked for it, and you can unsubscribe at any time.

Who processes it for us

We use a small number of service providers (operators) who process information only on our instructions and under agreements that protect it:

Some of these providers process information outside South Africa (for example in the European Union, the United Kingdom or the United States). Where they do, we rely on POPIA’s rules for cross-border transfers: the recipient is bound by law or by an agreement that gives your information protection comparable to POPIA.

We don’t sell or rent personal information, and we only share it otherwise when the law requires us to.

Cookies and browser storage

Kerf doesn’t use advertising cookies. The app keeps a few things in your browser’s local storage so it works: your projects (if you have no account), your settings such as units and theme, and, when you are signed in, your session so you stay signed in. You can clear these at any time in your browser settings; you will be signed out and unsynced projects will be lost.

With your consent we use Google Analytics to count visits and see which pages and features people use, so we know what to improve. It sets cookies (named _ga) that last up to two years and records things like the pages you view, your approximate location, device and browser, and where you came from. Google processes this for us; we don’t use it for advertising. Nothing is loaded from Google and no analytics cookie is set until you choose Accept, and you can change your mind at any time with Cookie settings at the bottom of every page: choosing Decline deletes the cookies. We keep your choice in your browser’s local storage.

How long we keep it

• Account details and projects: while your account is open. You can delete your account yourself in Account settings; we then delete your details and projects within 30 days, apart from backups, which are overwritten within a further 30 days.
• Billing records: as long as tax and company law requires, usually 5 years.
• Feedback and emails you send us: as long as we need them to answer you and improve Kerf, then deleted.
• Server and security logs: up to 90 days.

How we protect it

Information is encrypted in transit (HTTPS) and stored with an established cloud provider. Passwords are hashed, sign-in links expire, and repeated sign-in attempts are limited. Only people who need access to run Kerf have it. If a breach affects your information, we will tell you and the Information Regulator as POPIA requires.

Your rights

Under POPIA you may:

• ask whether we hold information about you, and for a copy of it;
• ask us to correct or delete information that is wrong, out of date or that we no longer need;
• object to how we use your information;
• withdraw consent where we rely on it;
• complain to the Information Regulator (inforegulator.org.za) if you are unhappy with how we handle your information.

To use any of these rights, email privacy@kerfcutlist.com. We will reply within 30 days. You can also download a copy of your account and projects at any time with Export my data in Account settings.

Children

Kerf is not aimed at children. We don’t knowingly collect information from anyone under 18 without a parent’s or guardian’s permission.

Changes

We may update this policy. The date at the top shows when it last changed, and we will email account holders about important changes.