Privacy Policy
Kurogolem · Last updated 17 October 2026
Kurogolem is a staff scheduling and cost-estimating app for small businesses. It is operated by Wuthering Studios ("we", "us"). This policy explains what the app stores, why, and how to get rid of it.
The short version
- We store what you type in: your email, your company details, your staff, and your rosters.
- We do not use analytics, advertising, or tracking SDKs. There are none in the app.
- We never sell personal data, and we never share it for advertising.
- You can delete your account and everything in it from inside the app, at any time.
Two different roles
This matters for understanding who is responsible for what.
- For your own account — your email address and settings — we decide how that data is used, so we are the controller.
- For the staff records you enter — names, roles, pay rates, remarks, shifts and attendance — you decide what to collect and why. You are the controller and we act as your processor: we hold and process that information on your instructions, and we do not use it for our own purposes.
Because of that, informing your staff is your responsibility, not ours. Your employees have not signed up to Kurogolem and may not know it exists. Telling them what you record about them, and having a lawful reason to record it, is part of being their employer.
What we collect
| Data | Why |
|---|---|
| Email address | To send your sign-in code and identify your account. |
| Your name, or your company's legal name | Asked for when you register, to identify who holds the account. |
| Password | To let you sign in without an emailed code. Stored only as a one-way hash by our authentication provider; nobody can read it back. |
| Language preference | To show the app in your language across your devices. |
| Company details — name, currency, timezone, country, week start | To calculate costs and lay out the roster correctly. |
| Staff records — name, roles, pay rates and pay adjustments, remarks, employment dates | To build rosters and estimate staffing cost. Entered by you. |
| Rosters and attendance | The core function of the app. |
| Technical logs — IP address, timestamps, error traces | Generated by our infrastructure providers to keep the service running and secure. We do not use them to build a profile of you. |
What we do not collect
No location data, no contacts, no photos, no device identifiers for advertising, no biometrics, no payment card details. The app contains no analytics SDK and no advertising SDK.
Where your data is stored
Data is held in the United States (Oregon) region of our database provider. We use a small number of service providers ("sub-processors"), each with access only to what their function requires:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and API hosting |
| Resend | Delivery of sign-in code emails |
| Amazon Web Services | Hosting for this website |
| ImprovMX | Forwarding of email you send to our wutheringstudios.com addresses |
How long we keep it
For as long as your account exists. When you delete your account, your data is deleted immediately and permanently — see below. Backups held by our infrastructure providers are overwritten on their normal rotation, typically within 7 days.
Deleting your account
In the app, open Settings → Delete account. This permanently removes your account, every company you own, and all staff records, rosters and attendance data. It happens straight away and cannot be undone — there is no recovery window and no archived copy.
If you cannot access the app, email privacy@wutheringstudios.com from your registered address and we will delete the account for you.
Your rights
You can ask us to give you a copy of your data, correct it, or delete it. Deletion and a monthly timesheet export are available in the app; for a full copy of your data, or anything else, email us. We will respond within 30 days.
If you are a member of staff whose details appear in Kurogolem, please contact your employer first — they control that record and can change or remove it. We can only act on their instructions.
California residents: we do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding 12 months.
Security
Data is encrypted in transit. Access is enforced at the database level — every table is protected by row-level security rules so that one account cannot read another's data, independently of any check in the app itself.
No system is perfect. If you believe you have found a security problem, please email privacy@wutheringstudios.com and we will respond quickly.
Children
Kurogolem is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes to this policy
If we change anything significant we will update the date at the top and notify you in the app before the change takes effect.
Contact
Wuthering Studios
privacy@wutheringstudios.com