Privacy policy

Last updated 26 October 2026

Who is responsible

GanttCharter is run by Magnus Larsson, a private individual in Sweden, who is the controller for the personal data described here. Questions about your data: privacy@ganttcharter.app.

Using GanttCharter without an account

• Your projects stay on your device. The web app saves them in your browser's storage and the desktop app in a database on your computer. .gantt files are saved wherever you choose.
• Share links contain the whole schedule after the # in the link. Browsers never send that part to a server, so we do not see shared schedules.
• No cookies, analytics or ads. We do not use tracking of any kind, and fonts are served from our own site.
• Hosting. The website is served by our hosting provider, Vercel. Like any web server, it processes your IP address to deliver the pages and may keep it briefly in logs for security and troubleshooting.
• Desktop app updates. The desktop app checks for new versions on GitHub, which sees your IP address when it does. No other information is sent.

With an account (optional)

An account is only needed to sync projects between devices. When you have one, we store:

• Your email address – to identify your account and send sign-in codes. We never use it for anything else.
• Your projects – their content and when they were last changed, so they can be synced to your other devices.
• Sign-ins – each signed-in device has a session, stored as a one-way hash together with whether it is the web or desktop app and when it was created and last used. Sign-in codes are stored as hashes and expire after 10 minutes.
• Abuse protection – to limit repeated sign-in attempts we count requests per email address and IP address, stored only as one-way hashes and deleted within a day.

We process this data to provide the sync you asked for (performance of a contract, GDPR Article 6(1)(b)) and to keep the service secure (legitimate interest, Article 6(1)(f)).

Where the data is stored

• The database runs at Scaleway in Paris, France.
• The sync service runs on Vercel in its Paris region.
• Sign-in emails are sent with Scaleway Transactional Email in the EU.

These providers process the data on our behalf and only to run the service. We do not sell or share your data with anyone else.

Cookies

When you sign in to the web app, it sets one cookie, gc_session, which keeps you signed in for up to 90 days. It is strictly necessary for the account to work, cannot be read by scripts, and is not used for tracking. Without an account, no cookies are set. The desktop app keeps its sign-in in the app's own storage instead.

How long we keep it

• Your projects and email address are kept as long as you have the account.
• When you delete a project, its content and name are removed at once. Only its random id is kept, so your other devices know to delete it too.
• Sessions end after 90 days without use, or when you sign out.
• When you delete your account, your email address, projects and sessions are deleted at once. Copies may remain in our database provider's backups for a short period before they are overwritten.

Your rights

You can see, export and delete your data yourself: every project can be exported from the app, and Account and sync → Delete account removes everything in the cloud. You also have the right to access, correct or erase your data, to object to processing, and to data portability – write to privacy@ganttcharter.app. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY).

Changes

If this policy changes, we update this page and the date at the top.