Privacy
Privacy policy
Effective date: 4 November 2026
Activity Category Insights is provided by Steen Krontoft in Denmark. Privacy questions and data-rights requests can be sent to privacy@categoryinsights.dk.
Connecting Google is optional. Activity Category Insights reads the Google account data described below only after the user gives permission. Google data and derived insights are processed and stored locally on the user's computer; they are not uploaded to an Activity Category Insights server.
Website analytics
CategoryInsights.dk uses Umami Cloud to measure page views and selected conversion events, including Windows and macOS download clicks and license-checkout initiation. The configured tracker does not add analytics cookies. Conversion events contain only the approved event name; this website does not provide Umami with a custom Distinct ID or custom event properties and does not intentionally include email addresses, account identifiers, license keys, form contents, or application data in analytics events.
To calculate visitor and session statistics without cookies, Umami generates a privacy-preserving session identifier from the website ID, the visitor's IP address, the browser User-Agent, and a rotating salt. The IP address is processed when this identifier is calculated but is not stored as a field in the analytics session record. Umami also receives limited technical and usage information needed for analytics, such as the visited page, referrer, browser language, screen size, and event name.
The Umami Cloud account uses the EU data region for analytics storage. This does not mean that all processing occurs exclusively within the EU: content delivery, security, support, and operational logging may involve processing in other locations. Umami Software, Inc. processes the information as an analytics service provider under its applicable privacy and data-processing terms. Standard hosting logs may separately record technical information such as IP address, browser type, requested page, and timestamp for security and operational purposes.
Purchases
Purchases are processed by Paddle as Merchant of Record. Paddle receives the information required to process payment, calculate applicable taxes, prevent fraud, provide invoices, and manage subscriptions or refunds. Paddle’s own privacy policy applies to its processing.
License information
The registered email address, purchase reference, license plan, and hashed Computer ID are used to issue and support a license. License verification is performed locally by the application; no continuous online activation connection is required.
Application data
The desktop application processes the calendar and mail sources selected by the user. Local Outlook data is read through local automation. Microsoft Graph, Google, IMAP, and CalDAV connections communicate directly with their respective services. Credentials and authorization tokens must never be submitted through this website.
Google API user data
Google account connection is optional and is initiated by the user through Google's OAuth consent flow. Activity Category Insights requests only read-only Google permissions and does not request permission to send, modify, move, or delete Gmail messages or to create, change, or delete Google Calendar events.
Google data accessed
- Google identity: the selected account's basic profile and email address, used to identify and display the connected account.
- Gmail: message and thread identifiers, dates, subject, sender and recipient headers, Gmail labels, Inbox/Sent state, starred and importance state, estimated message size, MIME structure, and attachment names, counts, identifiers, and size metadata. The application does not request or retain message-body content or attachment file contents.
- Google Calendar: calendar names and read-only event information including title, start and end time, all-day status, location, organizer, attendee count, visibility, availability, status, and conferencing indicators.
The requested scopes are openid, email, profile, https://www.googleapis.com/auth/gmail.readonly, and https://www.googleapis.com/auth/calendar.readonly. Gmail read-only access is required because the application performs user-selected date-range and folder searches and reads labels, headers, message size, and MIME/attachment metadata. The narrower gmail.metadata scope does not permit the Gmail search query used to retrieve only the selected period and does not support the full message format needed for storage and attachment insights.
How Google data is used
Google data is used solely to provide visible user-facing features in Activity Category Insights: categorizing activity from Gmail labels and calendar names; calculating mail and meeting activity; showing received and sent mail, workload, trends, relationships, response patterns, storage estimates, and data-quality diagnostics; supporting local timesheets; and creating exports that the user explicitly requests. Basic identity data is used only to distinguish connected accounts.
Storage, retention, and deletion
OAuth tokens and synchronized Google datasets are stored only on the user's computer. Tokens, protected settings, and synchronization caches are encrypted with the operating system's protected-storage service. Local files are restricted to the operating-system user. Data is transmitted to Google APIs over HTTPS. The user controls local cache retention, can clear one or all account caches, can clear the Google sign-in session in Settings, and can revoke access at any time from the Google Account permissions page. User-created snapshots and exports remain locally until the user deletes them.
Sharing and disclosure
Activity Category Insights does not sell Google user data, use it for advertising, provide it to data brokers, use it for credit or lending decisions, or transfer it to unrelated third parties. Google user data is not shared with the developer or uploaded to an Activity Category Insights server. Data leaves the local application only when the user deliberately exports a report, saves a local file, or chooses to provide material for support. Support packages exclude message and calendar content and can anonymize identifying information.
Security and limited use
The Google authorization flow uses Authorization Code with PKCE, a random state value, the user's default browser, and a temporary loopback callback. Access and refresh tokens are encrypted at rest using operating-system protected storage. Activity Category Insights' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Service providers
Simply.com hosts this website and may process standard server-log information. Umami Software, Inc. provides aggregate website analytics. Paddle processes purchase and billing information as Merchant of Record. Microsoft, Google, and user-selected mail or calendar providers process connected-source data according to the account connections the user configures in the application.
Other retention
Purchase and license records are retained for the periods needed to provide the license, support customers, prevent fraud, and meet accounting or legal obligations. Website server logs are retained according to the hosting configuration and operational requirements.
Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, or portability of personal data and object to certain processing. Contact the privacy address above to make a request.
Changes
This policy may be updated when the application, connected services, or legal requirements change. The effective date above identifies the current version.