Privacy Policy

TL;DR: We're a privacy-first app with no accounts, no tracking, and no ads. What you create lives on your device and, by default, also syncs to your own private iCloud — encrypted by Apple, and not something even we can read. When you use AI features, what you're working on — your text (typed or dictated), plus things like your routines, calendar events, and a thought you ask it about — passes through our secure server to Claude and back; we don't store conversations by default. One optional switch, "AI Thoughts Support" (off unless you turn it on), also sends the thoughts on your board to Claude, one at a time, so it can mark what looks urgent or near its date. Here's the full picture.

Overview

Ziggy Zag LLC ("Ziggy Zag", "we", "our", or "us") develops and operates the "i hate the routine" mobile application for iOS and watchOS (the "App"). This Privacy Policy explains how we collect, use, and protect information when you use the App.

We built this app with a simple belief: your data is yours. Privacy isn't a feature we bolt on — it's how the whole thing works. Almost everything you create lives on your device, and by default it also syncs to your own private iCloud so you can back it up and move to a new phone — that copy is encrypted by Apple and is not something we can see. The main time your content reaches our server is when you use an AI feature.

Version 2 introduced AI features that communicate with a server, and iCloud sync that backs your data up to your own Apple account. We think it's important to be upfront about exactly what each of those means. This policy covers everything: what we collect (very little), what lives on your device and in your private iCloud (almost everything), and what passes through our server when you use AI (temporarily, with minimal data retained only for safety and service integrity).

Information We Collect

We collect the bare minimum needed to make the App work. Here is what we collect:

Device Token
When you first open the App, it generates a random identifier (a UUID) and stores it in your device's secure Keychain. This token is sent with server requests so we can manage your rate limits and premium status. It is a random string of characters, not linked to your name, email, Apple ID, or payment details. That said, this token is pseudonymous: because it is persistent and tied to your subscription and usage, we treat it as personal data under laws like the GDPR and CCPA, and the rights described below apply to it.

Rate Limit Counts
We store simple counters of how many AI calls you have made — daily, monthly, and lifetime. These are just numbers (like "7"), stored alongside your device token. No details about what you asked, what the AI said, or anything else. Just counts, so we know whether you have reached your limit.

Premium Status
If you subscribe to premium, we store your subscription expiration date alongside your device token. Just a date, so the App knows whether to unlock premium features.

Age Verification Band
If you use AI features, the App asks whether you are 18 or older. We store only a broad age band ("adult" or "under 18") alongside your device token for one year. We do not collect your date of birth or exact age. The 18+ rule is our own policy, applied throughout the App (see Children's Privacy below), and it keeps us outside the additional obligations Anthropic's usage policy places on services that let minors interact with its models.

AI Report Data
If you choose to report an AI response (via the in-app report option), we store: your reason (up to 200 characters), a brief excerpt of the reported message (up to 500 characters), a 16-character hashed reference derived from your device token, and a timestamp. This data is stored for 90 days, then automatically deleted. Reports are user-initiated only — nothing is reported without your action.

Subscription Validation Identifiers
When your subscription is validated, we store a mapping between your Apple transaction ID and your device token in our server-side key-value store. The device mapping expires after 35 days (refreshed on each validation). The transaction binding is retained for the duration of your subscription. These identifiers do not include your name, email, or payment details, but because they are linked to your device token they are pseudonymous personal data, handled as described in this policy.

Operational Metadata
When you use AI features, our server logs limited operational data: hashed device or subscription identifiers, which AI feature was used, the AI model used, token counts, estimated cost, and rate-limit status. This does not include the content of your messages or AI responses. It is used for service reliability and abuse prevention — not for advertising, profiling, or behavioral tracking.

IP Address (transient, anti-abuse only)
Like any internet service, our server (through Cloudflare) receives the IP address your request comes from. We use it only briefly — to group requests into short-lived rate-limit buckets that stop abuse (IPv6 addresses are shortened to a network prefix first). We do not use it to identify you, build a profile, or track you across sessions, and these anti-abuse counters are deleted automatically within about two days (see Data Retention).

That is the core of what we collect. A pseudonymous ID, some counters, some dates, and — only when you use specific features — the items described above. None of it includes your name, email, or anything from your Apple account — but it is still data about you, and the rights described below apply to it.

AI Features

The App includes optional AI features powered by Claude, a large language model made by Anthropic, PBC. Here is exactly how they work:

When you use an AI feature — like asking for help building a routine, planning your day, or making a plan for a thought — your request travels from the App, through our secure server (hosted on Cloudflare), to the Anthropic API, and the response comes back the same way. To make its suggestions useful, that request includes more than the words you type: depending on the feature, it can also include your routines and roughly how long they usually take, your calendar events for the day and the next several days, plus the days up to and including a calendar entry your request points at further ahead (see Calendar context below), what's already on your Day plan (including a routine you're running right now), and, when you ask about a particular thought, that one thought's words — or, with "AI Thoughts Support" on, the thoughts on your board, one thought per request (see Your thoughts and the assistant below — it also covers what an App version that still has the Thought Analysis switch sends). And in exactly one more case — when you ask the assistant to help you get ready for a specific calendar event — that one event's notes are included too (see Event notes and prep below). The sections below spell out each of these. By default, our server acts as a pass-through: it forwards your request, returns the response, and does not store your conversation. We do not manually review your conversations; AI output is automatically scanned for safety before delivery. Two exceptions: (1) if you choose to report an AI response, a brief excerpt (up to 500 characters) is stored for 90 days so we can review it; (2) limited safety and operational metadata (such as hashed identifiers, which feature ran, model used, and token counts — not message content) may be logged for service reliability and abuse prevention.

Your thoughts and the assistant: A thought on your Thoughts board reaches the assistant in two ways, and both are things you do. One: you ask about it. Press Smart Plan on a thought, or build a routine from it, and that one thought's words go with that one request — because you asked. (A thought that has no words of its own sends the text the App already read out of its photo on your device when you captured it — see Photos and AI below.) Two: you turn on "AI Thoughts Support" (Settings → AI; Premium; off unless you turn it on, and it asks for your consent on its own sheet first). With it on, the App sends the thoughts already on your board to Claude, newest first, some each day, and then each thought you save or change, once, right after. Each request carries one thought: its words (or the text the App read off its photo on your device) and a line or two of dates (today, and the day you wrote it) — never a photo, never your calendar, never anything else on your board. The first of the thoughts already on your board are sent as soon as you turn the switch on — from Settings, without opening the board — while the App stays open in front of you. After that it sends a little at a time, only while the App is open on your board; a thought it could not send at the time (offline, or captured on your Watch) is sent when you next open the board. A thought it has read and left unmarked may be sent once more after an App update — once after the update that adds this, and once after any later update that changes how the assistant reads — at the same times and a little at a time, like the rest, so that one that is urgent or near its date under the assistant's current instructions gets its mark; a thought it has marked is not sent again on its own unless you change its words. What comes back from each request is, at most, a mark on that thought — urgent, or near its date — sometimes with a date, the part of the day it would be good to start, and a few words saying why. It is saved with the thought, on your device and in your private iCloud, and nowhere on our servers; you can take the mark off or fix the date, and turning the switch off stops the sending on that device and deletes nothing. Otherwise, nothing else about your thoughts is sent: the assistant is not given your board as background, no thought you type or photograph goes to it unasked, and nothing about your thoughts goes out on a schedule. The Day assistant also sorts a "brain dump" — whatever you type or dictate into the Day tab's ask bar — and that text is sent when you send it. An App version that still shows a "Thought Analysis" switch in Settings → AI is from before that switch was removed: with it on, that version sends new thoughts (with a small preview of a new photo thought, and a few days of your calendar events) to Claude in the background to flag what looks time-sensitive, checks again about a day later, and lets the Day assistant's chat draw on your board as background context (that chat also lets you tap a thought in yourself); with it off, nothing from your board is sent unless you ask about a thought, tap one into that chat, or dictate one. Update the App and that switch, and the sending it controlled, are gone.

Optional personalization: Two switches let the assistant learn from your history to plan better: "Learn from my week" (your recurring calendar patterns and how you tend to schedule things) and "Use my real pace" (how long your routines actually take you). They turn on when you first accept the AI notice — the consent screen tells you so, and if you accepted before this update they stay however you already have them set — and you can turn either off at any time in Settings → AI. Only a compact summary is shared with the assistant while they are on; turn them off and none of that leaves your device.

Assistant memory (off by default): The assistant can keep a short, opt-in memory of durable preferences you tell it — or that it notices and you confirm — like "evenings work better for me" or "mornings need extra buffer," so it doesn't have to relearn them every time. It is off unless you turn it on ("Remember things about me" in Settings → AI). When it's on, the assistant may propose a few things to remember at the end of a chat; nothing is saved unless you tick it and confirm — every box starts unchecked, and anything you skip is simply not stored. It keeps only a small, capped number of short notes (never the things the App already measures for you, like how long your steps take), and it will never remember anything about a diagnosis, medication, therapy, or a named health condition — that is blocked both by instruction and by a built-in content filter that works independently of the AI. It is also instructed never to note your symptoms or anything about other people. You can read, edit, or delete every remembered note anytime in Settings → AI → "What it remembers," or clear them all with "Forget everything" — and once you delete a note it kept, it won't be suggested again. Remembered notes are stored on your device (and sync through your own private iCloud, like the rest of your data, when iCloud sync is on); when the feature is on, a compact list of them rides along in the AI request on a relevant planning turn — the same secure path as everything else above, and never with your name or account. Turn the feature off and the assistant stops remembering new things and stops sending any it already has; your existing notes stay saved (and viewable) until you delete them. Reset All Data deletes them from the App and — when iCloud sync is on — from your iCloud copy; like the rest of your data, they can remain in the App's temporary on-device recovery copies for safety, which never leave your iPhone and are deleted with the App.

Photos and AI: No photo is sent to the assistant — not in the background, and not with any request. When you press Smart Plan on a thought that is only a photo, what goes is the text the App already read out of that picture on your device (see OCR below): the words, never the image.

Calendar context: When you use AI planning features, your calendar events for the current day and the next several days may be included in the AI request — each event's title, time, and location (if it has one), and an estimated travel time — so Claude can help you plan around your real schedule. When your request points at a calendar entry or a date further ahead — a birthday, a trip — that entry's title and the plans and events on the few days up to and including it may be included as well, so the assistant can plan backwards from it. An event's notes can also be included, in exactly one case — see Event notes and prep below. This information passes through the same secure path and is not stored on our servers.

Event notes and prep: An event's notes are included in exactly one case: when you ask the assistant to help you get ready for that specific event. That one event's notes then go with that one request, because you asked — never in the background, never on a sync, and never for an event you have not asked about. The event can be any event on your calendar, including one months away. Before the notes go, they are filtered on your device: web addresses, email addresses, and long runs of digits are each replaced with a plain marker, and a very long note is cut short. That filter is mechanical, not a judgment about meaning — it does not remove names, and everything else in the note is sent as written. Notes are also the one part of a request you may not have written yourself: an invite's notes are often written by whoever sent it, and they can mention other people. The event's attendees, its URL field, its organizer, and its alarms are never sent — not with a prep request, not with anything else. The notes are read fresh from your calendar at the moment you ask, never from a calendar you've unticked in the App, and we keep no copy: not in the App, not on our servers. They pass through the same secure path as every other AI request, and Anthropic's retention applies to them as it does to every request — see Anthropic's data policy below. What you accept from the assistant afterward — a prep step, a routine, a block on your day — becomes ordinary App content, saved on your device and synced through your private iCloud like the rest of your data. One switch controls all of this: "Read my event notes" in Settings → AI. It starts on; turn it off — before you ever ask, or any time after — and the App does not read an event's notes at all.

Consent: Before you use AI features for the first time, the App displays an explicit consent dialog explaining that your text will be sent to Claude through our server. You must affirmatively accept to use AI features. You can decline, and the App works without AI — you just won't get AI-powered suggestions. "AI Thoughts Support" asks separately: turning it on shows its own consent sheet, which says what it sends and when, and the switch stays off until you accept it there. The first dialog does not turn it on.

Sensitive information: Please avoid including sensitive personal information in AI conversations — such as government IDs, financial account numbers, or detailed medical diagnoses. The App is a planning tool, not a medical or financial service, and AI features are not designed to handle that kind of data. One part of a request may not be yours to write: an event's notes, sent when you ask for help getting ready for that event, are often written by whoever sent the invite. The App filters web addresses, email addresses, and long runs of digits out of them first, but it cannot judge what a note means — so if an event's notes hold something you would rather not send, turn off "Read my event notes" in Settings → AI before you ask. With "AI Thoughts Support" on, every thought on your board is sent — including text the App read off a photographed page — so keep IDs and account numbers off the board, or leave the switch off.

AI limitations: AI-generated suggestions are for convenience and planning purposes only. They are not professional advice of any kind. The App is not a medical device and is not a substitute for professional medical, psychological, or therapeutic guidance. You are responsible for any decisions you make based on AI suggestions.

Anthropic's data policy: Per Anthropic's current published policy, which controls: Anthropic retains API request logs for up to 30 days, then automatically deletes them, and does not use API data to train their models. In rare cases where content is flagged by their automated safety systems (for example, content that may involve harm or abuse), it may be retained for up to 2 years for abuse prevention, and Anthropic may keep the related safety-classification scores — not the content — for up to 7 years. By using the App's AI features, you acknowledge this third-party retention. For details, see Anthropic's privacy policy. You can also contact Anthropic directly at privacy@anthropic.com regarding their data handling.

On-Device Data

The vast majority of what the App does happens entirely on your device. The items below are never stored on our servers. Three things can carry some of this data off your device, at your option: iCloud sync (on by default — see "iCloud Sync & Backup" below) backs your content up to your own private iCloud, AI features send the specific things described above to Claude when you use them (with "AI Thoughts Support" on, that includes the thoughts on your board, one at a time — when you turn it on, and after that while the board is open), and — when "Use Location for Travel Time" is on — event addresses and, from the next App update, your home, your saved spots, a place you choose for a drive and what you type into the place search go to Apple to find places and estimate travel time (see "Location" and "Drive addresses and saved spots" below). Here's the detail:

Crisis line card: If a thought you write contains certain words about ending your life or hurting yourself, the App shows a card with the 988 crisis line. That check happens on your device, for everyone; nothing is sent, and nothing about it is saved with the thought.

Calendar: The App reads your Apple Calendar (via EventKit) to display events in your day planner and calculate scheduling conflicts. Your calendar stays on your device and is never stored on our servers. (Event titles, times, and locations may be included in AI requests if you use AI planning features, and one event's notes when you ask the assistant to help you get ready for that event — filtered first, with no copy kept by the App or our servers. See Calendar context and Event notes and prep above, and the "Read my event notes" switch in Settings → AI to turn notes off. A rolling copy of your calendar is stored on your device to draw the planner — refreshed about two weeks back and three months ahead, so the assistant can also find an entry you point it at further out and plan backwards from it. Beyond that range, a day you open, and the few days up to an entry you point the assistant at, are copied too. The copy keeps about three weeks of the past: a day older than that is removed automatically — from your device, and from your iCloud copy while sync is on — unless something you made still points at it (such as a prep step you built for that event, a thought you linked to it, or a drive block you moved, brought back or removed), in which case it stays as long as that item does. Open an older day and the App simply reads it from your calendar again. Notes are not part of that copy, and it syncs through your private iCloud like the rest of your data.)

Location: Used to estimate travel time to events that have an address. When "Use Location for Travel Time" is on, the App sends the event's address text to Apple's geocoding service to turn it into map coordinates, and asks Apple Maps for directions from your location — so the address and those coordinates are shared with Apple (never with us) for that calculation. When the switch is off, the App does neither. From the next App update, the App also asks Apple Maps — likewise only while the switch is on — for drives between two places: two of your events, or an event and your home, one of your saved spots or a place you chose for one drive (see "Drive addresses and saved spots" below). It does this to work out its drive blocks — now also between your events, and the drive home after your last event of the day — and, when you open a drive block, to show how long the drive would take to or from each place it offers. A request between two such places carries their map coordinates and can carry the time of the drive, worked out from your calendar; the App does not add your location to it. Opening a drive block that starts at your phone — such as the day's first drive — also sends requests from your location to places the block offers, so each of those pairs where you are with your home, a saved spot or the event. The place search described below is centred on where your phone last was, when the App knows it, and that area goes to Apple with what you type. Location is also used — if the automatic light/dark appearance option is on (it's on by default) — to calculate your local sunrise and sunset times; that happens entirely on your device, and nothing is sent anywhere for it. We don't store your location on our servers. While "Use Location for Travel Time" is on, every drive block the App works out for getting to an event with an address — whether or not you ever moved or saved it — records where your phone was when it worked that block out, whenever the App has a current location fix; that starting point is stored on your device and syncs through your private iCloud like your other data. Drive blocks belong to the same rolling calendar copy described under Calendar above and leave with their event: when an event older than about three weeks is removed from the copy, the drive blocks the App worked out for it go too, starting point included — from your device, and from your iCloud copy while sync is on. A drive block you moved, added, brought back or removed keeps its event and its starting point, so your choice holds if you reopen that day. An event you delete from your calendar is different. From the next App update, every drive block the App still holds for it — one you had moved, added, brought back or removed included — leaves with the event, from your device and from your iCloud copy while sync is on, starting point and all, as soon as the App, refreshing its copy of your calendar for that day, finds the event gone. A drive from it to your next event belongs to that next event and stays with it. Two kinds of deleted event are not covered by that: one date of a repeating event (or that date and the ones after it) while other dates of it stay on your calendar, and an event the App had already removed from its copy before that update reached you. For those, the drive blocks worked out for the event stay behind — on your device, and in your iCloud copy while sync is on — until a later visit to that day, with "Sync with Calendar" and this switch on and with Premium, clears them, all but one you had removed, which keeps its starting point until you use Reset All Data.

Drive addresses and saved spots: From the next App update, a drive block can start, stop on the way or end at your home, at one of up to ten spots you save, or at a place you choose for that one drive. Each is set the same way — typed as an address, or found by searching for a place or an address: your home in Settings or on the Day tab, a spot in Settings or from a drive block's own Save word, the one-drive place on the drive block itself. Like an event's address, none of this goes to Apple Maps unless "Use Location for Travel Time" is on. While it is on, the search sends what you type — for your home, for a spot or for one drive — to Apple Maps as you type, together with an area to search in when the App has one — around where your phone last was or, failing that, around your first event with an address on the day whose drive block you last searched from; a place you pick from Apple's suggestions is looked up with Apple Maps for its name, address and coordinates; and an address you type and use without picking a suggestion is sent to Apple's geocoding service to be turned into map coordinates. The App never sends any of it to us or puts it in an AI request. Your home, your spots and the places you pick for your drive blocks are saved on your device and sync, encrypted, through your private iCloud. A spot, or a place chosen for one drive, is copied onto each drive block that uses it, and each copy is deleted with its block — when you delete the block, or when the App removes it with its event (see "Location" above). A copy can also sit on a drive block the App keeps but is not showing; that copy goes, at the latest, when the block goes with its event. The home address you save is never copied onto a drive block: change or remove it in Settings → Travel → Home Address, and removing it deletes it from the App and, while sync is on, from your iCloud copy. Remove a spot in Settings → Travel → Saved Spots, or by pressing and holding its tile on a drive block: that deletes it from your list of spots, on your device and, while sync is on, in your iCloud copy, but a copy a drive block already holds stays until that block is deleted. The App also keeps, with your other synced data, whether you usually head home between two events. It tells the two events apart by a one-way code made from their names and addresses — the code is what is stored, not the names or addresses — so this memory is not part of the calendar copy described above and does not leave with it. It is never sent to us or to an AI; it holds up to 200 such pairs, letting the oldest go as new ones are recorded, and Reset All Data clears it.

Camera and Photos: Used for capturing thoughts as photos. Photos are stored on your device (and sync through your private iCloud like the rest of your data). When you capture one, the App reads the text out of it on your device, so photographed pages are searchable (see OCR below). The photo itself is never sent to the AI.

Microphone and Speech: Voice input — dictating a thought, or dictating into the Day tab's ask bar — is transcribed on your device using Apple's built-in Speech framework. The App requests on-device transcription when your device and language support it. For some devices or languages, Apple's Speech framework may use server-based recognition per Apple's own policies. Audio is not stored by the App. What you dictate into the ask bar is treated like typed text: it is sent only when you send the ask. A thought you dictate — in the Thoughts composer, or while parking a thought during a routine — is treated the same way: the words land in the field as you speak, you can edit them, and saving it sends nothing a typed thought would not. From then on the saved text is part of that thought, treated like any other thought — it syncs through your private iCloud, and it goes to the assistant when you ask about it or, with "AI Thoughts Support" on, when the App reads it.

Contacts: Accessed only when you tap "Add to Contacts" for a specific item. The App writes to your device contacts via Apple's Contacts framework. No contact data is ever sent to any server.

OCR (Text Recognition): The App can extract text from photos using Apple's on-device Vision framework. The recognition itself happens entirely on your device. The extracted text becomes part of that thought, so from then on it's treated like any other thought — it syncs through your private iCloud, and it can be included in an AI request if you use AI features on it. With "AI Thoughts Support" on, that extracted text is also what the App sends when it reads a photo thought — the words, never the picture.

Routines, steps, checklists, thoughts, and planner data: Stored on your device using Core Data. We don't store this data on our servers. By default it does sync to your own private iCloud (see below) so it survives a new phone, and parts of it are sent to Claude (passing through our server, never stored there) when you use AI features, as described above — and, with "AI Thoughts Support" on, your thoughts are sent one at a time — when you turn it on, and after that while your board is open — as described under Your thoughts and the assistant.

Your device token is stored only in the local Keychain on your device and is not synced to iCloud Keychain. How the App uses iCloud for your other data is described in the next section.

iCloud Sync & Backup

The App uses Apple's iCloud (via CloudKit) to back up your data and sync it across your devices. Here is exactly how that works:

It's on by default, and it's yours. Sync is turned on unless you turn it off. It copies what the App stores — your routines, your thoughts and jots (including any photos and their extracted text, and any mark "AI Thoughts Support" has put on a thought, stored with that thought), your Day plans, and your locally cached calendar events — to your own private iCloud database, tied to your Apple Account. Apple encrypts it. It goes to Apple's servers, never to ours — we cannot see it, read it, or access it.

Why it's on. Before this, a lost or replaced phone meant losing everything you had built. Sync means you can set up a new phone and your routines and thoughts come back. That's why the default is on — but it's a single switch.

Turning it off. Open Settings in the App and turn off "Sync & Back Up with iCloud." From then on, the App stops copying changes to iCloud. Your data may still be included in your iPhone's own iCloud Backup; while sync is off, the App shows an "Include in iPhone's iCloud Backup" switch if you want to stop that too.

Uninstalling. Deleting the App removes the on-device copy. If iCloud sync was on, the copy in your iCloud remains — that is what lets your data return if you reinstall. Turning sync off stops future syncing, but it does not remove what's already in iCloud; to delete that copy, remove the App's data from your iPhone's iCloud settings (Settings → your name → iCloud) after uninstalling.

Apple Watch

If you use the App on Apple Watch, your data syncs between your iPhone and Watch using Apple's WatchConnectivity framework. This sync happens directly between your paired devices, does not pass through any third-party servers, and is managed entirely by Apple's secure protocols. We never see or have access to this synced data.

Third-Party Services

We use four third-party services. There are no tracking SDKs, no ad networks, and no behavior analytics tools in the App. Here is what each service does:

Anthropic (Claude AI)
Processes AI requests when you use AI features. Per Anthropic's current published policy, which controls: Anthropic retains API logs for up to 30 days, then deletes them, and does not train on API data. Safety-flagged content may be retained up to 2 years. Anthropic also collects standard API usage metrics (request counts, token usage) on their developer platform. See Anthropic's privacy policy.

Apple
Apple plays three roles. First, iCloud (CloudKit) stores your synced data in your own private iCloud database (see "iCloud Sync & Backup" above) — this is your storage with Apple, not ours, and we cannot read it. Second, Apple Maps — only while "Use Location for Travel Time" is on — receives event addresses (to turn them into map coordinates) and a directions request from your location, so the App can estimate travel time; from the next App update it also receives addresses you type for your home, a saved spot or a drive block (to turn them into map coordinates), what you type into the App's place search (and, when the App has one, an area to search in), the place you pick from Apple's suggestions, directions requests between two places (which can carry the time of the drive) and, when you open a drive block that starts at your phone, directions requests from your location to your home, a saved spot or the event; when the switch is off, the App sends none of these (see "Location" and "Drive addresses and saved spots" above). Third, Apple handles all subscription payments and in-app purchases through the App Store. When you subscribe, your Apple transaction ID passes through our server's memory for validation — we forward it to Apple's Server API, confirm your subscription is active, and to support ongoing subscription verification and prevent abuse, your transaction ID and device token are stored as a mapping in our server-side key-value store. The device mapping expires after 35 days (refreshed on each validation). The transaction binding is retained for the duration of your subscription. We never receive your name, email, or payment details. See Apple's privacy policy.

Cloudflare
Hosts our server infrastructure (the proxy that forwards AI requests and validates subscriptions). Cloudflare does not log request or response bodies, and your messages and images are not stored on their servers — apart from the short report excerpt described above, which is kept in our Cloudflare-hosted key-value store for up to 90 days. However, Cloudflare collects standard operational metrics as part of running their platform, including request counts, response status codes, CPU time, and bandwidth. This is infrastructure-level data, not user behavior tracking. See Cloudflare's privacy policy.

Resend
Delivers the email alert to us when you report an AI response for review. Resend receives only the contents of that report: the reason you selected, the time it was received, a report ID, a salted hash of your device identifier (never the raw identifier), and up to 500 characters of the AI response you are reporting. It receives nothing else — no routines, thoughts, photos, calendar data, or anything you did not submit — and nothing you created ever reaches Resend unless you choose to submit a report. Resend also delivers one other kind of email, and it has nothing to do with your content: if an automatic check of our server's subscription records finds something wrong, it emails us a short alert — just counts and shortened, hashed device references (never your raw identifiers), so we can fix it before anyone loses access. See Resend's privacy policy.

These are the only third-party services that receive any data from the App. We maintain appropriate data processing agreements with our service providers and only share the minimum data necessary for each service to function as described above. If we add or remove service providers in the future, we will update this policy accordingly. We are not responsible for the privacy practices of these third-party services and encourage you to review their privacy policies.

What We Don't Do

• No accounts. No email, no username, no password, no sign-up. Ever.
• No user behavior tracking. We don't run analytics or advertising trackers, and we build no advertising or marketing profile of you. There are no analytics SDKs in the App — no Google Analytics, no Firebase, no Facebook SDK, no crash reporting services. To keep the assistant fast, reliable, and affordable, our server does keep short-lived operational records of AI requests — which assistant feature ran, which model answered, how big the request and the reply were, and what it cost us — never the content of your messages or the assistant's replies. Those records are retained for up to 7 days.
• No advertising. No ad networks, no ad identifiers, no ad tracking. The App has zero ads.
• No identity data. We never receive your name, email, Apple ID, or payment details, and we build no advertising profile. What we do hold is keyed to the pseudonymous device token described above. The only demographic data we store is a broad age band (18+ or under 18) for the App's 18+ rule, with no date of birth or exact age.
• No conversation history on our servers. We do not store your full AI conversations. (The assistant's cards and chats are kept only in memory on your device and aren't saved or synced; what you accept from them — a block on your day, a routine, a prep step — becomes ordinary App content. Neither the conversation nor the cards are stored by us.) One more thing the assistant produces is kept: the mark "AI Thoughts Support" puts on a thought — urgent, or near its date, sometimes with a date, the part of the day it would be good to start, and a few words saying why — is saved with that thought on your device and syncs, encrypted, through your own private iCloud. It is never stored by us. The only exception on our side: if you actively report an AI response, a brief excerpt (up to 500 characters) is retained for 90 days for safety review, then automatically deleted.
• No data sales. We do not sell, rent, lease, or trade your personal information to any third party, for any reason.

A note on infrastructure metrics: Beyond the short-lived operational logs described above, we run no analytics of our own — but our infrastructure providers (Cloudflare and Anthropic) collect standard operational metrics as part of running their platforms — things like request counts, response codes, and API token usage. This is standard for any cloud service and does not include the content of your requests.

Data Security

All communication between the App and our server uses HTTPS (TLS encryption), meaning your data is encrypted in transit. On-device data is stored using Apple's Core Data framework within the App's sandboxed container, and your device token is stored in the iOS Keychain (Apple's encrypted credential storage).

No security system is perfect. While we take reasonable measures to protect the limited data that passes through our server, we cannot guarantee absolute security. In the unlikely event of a data breach affecting device tokens or other server-side data, we will notify affected users as promptly as practicable and in accordance with applicable law, and we will post a notice on our website describing the incident and steps taken to address it. If you become aware of a security issue, please contact us at developer@ziggy-zag.com.

Data Retention

Here is exactly how long data is retained:

• Daily and monthly AI usage counters: reset automatically at the start of each new day and month — only the latest values are kept (numbers only: a call count and a monthly cost estimate, no content), keyed to your device token.
• Lifetime AI call count: Persists as long as your device token exists. This single number is retained because it is necessary to enforce the App's free-tier usage limits. It contains no content — it is one number, keyed to your pseudonymous device token.
• Premium status: Refreshed roughly every 24 hours or upon subscription expiry.
• Operational AI-request logs (Cloudflare Workers Logs): retained for up to 7 days. Each entry records when the request happened, which assistant feature ran, which model answered, the size of the request and the reply (token and character counts), what it cost us, where that leaves your monthly usage, and a shortened, hashed reference to your device or subscription — never your raw identifiers, and never the content of your messages or the assistant's replies. A request "AI Thoughts Support" makes is logged the same way: which feature ran, never the thought. (Separately, if you choose to report an AI response, that report is kept for 90 days — see AI Report Data.)
• Anthropic API logs: Up to 30 days, then automatically deleted by Anthropic. Safety-flagged content may be retained up to 2 years.
• Infrastructure metrics: Retained by Cloudflare and Anthropic per their respective data retention policies.
• On-device data: Persists until you delete the App, with one exception: the App's copy of your calendar, and the drive blocks worked out from it, keep only about three weeks of the past. Older days are removed automatically — from your device, and from your iCloud copy while sync is on — unless something you made still points at that day (see Calendar and Location under On-Device Data). Everything else you create stays until you delete the App. Deleting the App removes the local copy; if iCloud sync was on, the copy in your own private iCloud remains until you remove it (see "iCloud Sync & Backup"). A temporary on-device recovery copy the App makes for safety (before Reset All Data, for example) keeps whatever it held when it was made; those copies never leave your iPhone and are deleted with the App.
• Device-to-subscription mapping: 35 days, refreshed on each subscription validation.
• Transaction-to-device binding: Retained for the duration of your subscription.
• Age verification band: 1 year, then automatically deleted.
• AI report data: 90 days, then automatically deleted.
• Moderation incident metadata: 90 days. Hashed device reference and timestamp only — no message content.
• Subscription health-check alerts: the latest check's summary — counts and shortened, hashed device references only, no content — kept up to 30 days, overwritten by the next check.
• Anti-abuse rate counters (per device): 2 hours, then automatically deleted.
• IP-based anti-abuse buckets: up to 48 hours, then automatically deleted.

Your Choices and Rights

AI features are opt-in. The App asks for your consent before the first AI use. If you decline, AI features are disabled and no AI prompt or response processing occurs on our server. Subscription validation still communicates with our server if you are a subscriber. Age verification and report submissions send limited data to our server only when you actively use those features. One request happens on its own in App versions from October 2026 on: each time the App starts, it sends your device token to our server to check whether this device has premium access; nothing you have written goes with it. A device our team has given access to for testing also asks again when you open or return to the App while that access is in its last day or has run out, no more than once every ten minutes — the same token, nothing else. One more happens on its own, and only if you turn it on: turning "AI Thoughts Support" on, and after that opening your Thoughts board while it is on, sends thoughts to Claude one at a time, as described under Your thoughts and the assistant; with it off, opening the board sends nothing.

Every device permission is optional. Calendar, location, camera, microphone, contacts — the App requests each permission individually, and you can decline any or all of them. The App works without them; you just get fewer features.

Deleting the App. Uninstalling removes the on-device copy of your data. If iCloud sync was on, the copy in your own private iCloud remains — that's what lets your data come back if you reinstall — and you can remove it as described in "iCloud Sync & Backup." Our server-side data (your pseudonymous device token, rate-limit counts, and premium status) expires automatically via the retention periods listed above. There is no account to delete because there is no account.

Request deletion of server-side data. If you want your server-side data removed before it expires naturally, email us at developer@ziggy-zag.com with "Data Deletion Request" in the subject line. Include any details that may help us locate your data (such as approximate dates of use). We will process your request within 30 days.

International Users and Your Privacy Rights

The App is available worldwide. Our servers are located in the United States (Cloudflare's global network) and data processed by Anthropic is handled in accordance with their privacy policy. By using AI features, your data may be transferred to and processed in the United States.

For users in the European Economic Area (EEA), United Kingdom, and Switzerland: To the extent that EU/UK data protection law (GDPR) applies to our processing of your data, we rely on the following legal bases: for the pseudonymous device token, rate limiting, subscription validation, short-term operational service logging, and safety and moderation retention, we process data on the basis of our legitimate interest in providing and securing the App and — where you subscribe — performance of our contract with you (Articles 6(1)(f) and 6(1)(b) GDPR); for AI features that transmit your content to third-party services, we rely on your explicit consent, which you provide through the in-app consent dialog before first use (Article 6(1)(a) GDPR).

You have the right to access, correct, delete, restrict processing of, or request portability of your personal data. You also have the right to withdraw consent for AI features at any time, and withdrawing it is as easy as giving it: tap "Turn off the assistant" in the App's Settings → AI and confirm. That takes back the consent you gave; nothing is deleted, and no AI feature sends anything of yours again until you accept the same notice a second time. Short of withdrawing, the switches beside it narrow what a request may carry — "Learn from my week," "Use my real pace," "Remember things about me," "Read my event notes" and "AI Thoughts Support" — the latter off unless you turn it on, and turning it off stops that device sending your thoughts on its own; each device has its own switch, so turn it off on each device you use it on — and, on an App version from before these changes, "Thought Analysis," which stops the background sorting described under Your thoughts and the assistant. Beyond those, the App only sends data to the AI when a feature you actively use calls for it, so not using the AI features sends nothing. We hold no name or email to search by, but we can act on the data keyed to your device token — the deletion request process described under "Your Choices and Rights" is how these rights work in practice. To exercise any of these rights, contact us at developer@ziggy-zag.com. If you have concerns about our data practices, you may also lodge a complaint with your local data protection authority.

Data processed through our services is handled by our sub-processors Anthropic (AI processing), Cloudflare (proxy and edge infrastructure), and Resend (email delivery) and may be processed in the United States. Those transfers rely on the safeguards each provider publishes — such as Standard Contractual Clauses and their data processing agreements — per their current published terms, which control.

For users in California: Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), you have the right to know what personal information we collect, to request deletion, to request correction of inaccurate personal information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information with third parties for their own commercial or marketing purposes, and we have not done so in the preceding 12 months. The limited data we collect (a pseudonymous device token, usage counts, subscription dates) is not linked to your name or contact details. We will never discriminate against you — in price, features, or service — for exercising any of these rights. To exercise any of these rights, contact us at developer@ziggy-zag.com with "Privacy Rights Request" in the subject line. We will respond within the timeframes required by applicable law.

For users in Canada: We handle personal information consistently with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec's Law 25. You may request access to or correction of the personal information we hold (it is keyed to your pseudonymous device token) using the process described under “Your Choices and Rights.” As this policy describes, personal information is stored and processed outside Canada — by our service providers Cloudflare, Anthropic, and Resend in the United States, and by Apple — only as needed to run the App, and while it is outside Canada it is subject to the laws of that country. If you believe we have mishandled your personal information, contact us at developer@ziggy-zag.com and we will respond within 30 days; if you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Notifications

The App may request permission to send local notifications during your routines. These notifications are generated and delivered entirely on your device, do not transmit any data to external servers, and can be disabled at any time in your device's Settings. We do not send marketing notifications, re-engagement prompts, or "come back!" reminders.

Children's Privacy

The App is an 18+ app. It is not directed at anyone under 18 and does not knowingly collect personal information from anyone under 18. AI features specifically require a declaration that the user is 18 or older; anyone who indicates they are under 18 is locked out of the App entirely, not just its AI features. The App collects no names, emails, or accounts from any user, which substantially limits children's-privacy risk.

If you are a parent or guardian and believe someone under 18 has used the App's AI features (which transmit text to third-party servers), please contact us at developer@ziggy-zag.com with "Child Privacy Concern" in the subject line. We will take steps to delete any associated server-side data within 30 days of your request.

Changes to This Policy

We may update this Privacy Policy to reflect changes in the App, our practices, or the law. Every revision is posted at this URL with a new effective date and a dated entry in the update log below that says what changed and why, so you never have to hunt for the difference. A change that would collect, use, or share your data in a new way is written here before any App update that does it reaches you, and it never applies to you quietly: where the processing rests on your consent (the AI features), the App asks you, on its own screen, before the change applies to you; continued use alone is never treated as consent to a new use of your data; and nothing already sent to us is used in a new way without that consent. Your continued use of the App after a revision's effective date indicates your acceptance of its other changes. If you do not agree with a revised policy, you may stop using the App and delete it from your device.

Update log — October 15, 2026: One data flow removed: the tidy-up of a dictated thought. Dictation is the App's own, in the Thoughts composer and while parking a thought during a routine; the words land in the field, you can edit them, and saving them sends nothing a typed thought would not. Nothing you dictate goes to us or to the assistant unless you later ask the assistant about it or have AI Thoughts Support on; transcription itself works as described under Microphone and Speech.

Update log — October 14, 2026: One clause added to what the App sends on its own, and nothing new collected by us: a device our team has given access to for testing also sends its device token to our server when you open or return to the App while that access is in its last day or has run out, no more than once every ten minutes — the same check the October 2 entry describes, at one more moment, so that a renewal, or the end of that access, reaches the App without a restart. Also removed: the free AI promotion check. On a device without a subscription, the App version now with testers no longer asks our server, when you open or return to the App, whether one is running, and our server now refuses that request from any version, so an older version that still sends it gets an error back. That check carried no token, no identifier and nothing you had written. "AI features are opt-in" under Your Choices and Rights carries both changes. Setting your home address (in Settings or on the Day tab) and adding a saved spot now search Apple Maps as you type, like a drive block's search: what you type goes to Apple Maps as you type, a place you pick is looked up there, and an address you use without picking one is geocoded — all only while "Use Location for Travel Time" is on, and never to us or into an AI request, and you can hold a saved spot's tile on a drive block to remove it or drag it into a new order.

Update log — October 2, 2026: One request added to what the App sends on its own: from the October 2026 versions on, each time the App starts it sends your device token to our server to check whether this device has premium access. Nothing you have written goes with it.

Update log — October 1, 2026: Two changes. First, one thing added to when "AI Thoughts Support" sends (arriving in the next App update; still off by default, behind its own switch and its own consent sheet). Until now a thought the assistant had read and left unmarked was never sent again on its own unless you changed its words. From that update, each such thought may be sent once more — once after the update itself, and once after any later App update that changes how the assistant reads — at the same times and a little at a time, like the rest, so that one that is urgent or near its date under the assistant's current instructions gets its mark; a thought it has marked is not sent again on its own unless you change its words. Nothing else about it changed — what each request carries, where it goes, what it is for, how long it is kept, the switch and how to turn it off are the same — so this is not a new way of sharing your data. "Your thoughts and the assistant" carries this change. Second, one gap narrowed, arriving in the next App update, and nothing new collected by us. Location said that the drive blocks of an event you delete from your calendar stay until a later visit to that day clears them, and that one you had removed kept its starting point until Reset All Data. From the next App update, every drive block the App still holds for an event you delete — one you had moved, added, brought back or removed included, starting point and all — leaves with the event, from your device and from your iCloud copy while sync is on, as soon as the App, refreshing its copy of your calendar for that day, finds the event gone. For two kinds of deleted event the blocks stay as Location describes: one date of a repeating event deleted while other dates of it stay on your calendar, and an event the App had already removed from its copy before that update reached you. Location under On-Device Data carries the change.

Update log — September 30, 2026: Three things added, arriving in the next App update, and nothing new collected by us. One: drive blocks between your events, and a drive home after your last event of the day. To work them out, and to show how long each choice would take when you open a drive block, the App asks Apple Maps for drives between two places — such as two of your events, or an event and your home, a saved spot or a place you chose for one drive — sending the two places' map coordinates and, often, the time of the drive worked out from your calendar, but not your location; when the drive block you open starts at your phone, it also asks for drives from your location to places the block offers, pairing where you are with your home, a saved spot or the event. Two: up to ten saved spots, and a search for a place or an address. What you type into the search goes to Apple Maps as you type, with an area to search in when the App has one (around where your phone last was or, failing that, your first event with an address that day), and a place you pick from Apple's suggestions is looked up for its address and coordinates. All of this goes to Apple only while "Use Location for Travel Time" is on, and none of it goes to us or into an AI request. Three: a memory of whether you usually head home between two events, so the App can plan the same way next time — kept with your other synced data as a one-way code made from the two events' names and addresses, never the names themselves; it is never sent to us or to an AI, and Reset All Data clears it. A spot or a place chosen for one drive is copied onto each drive block that uses it and deleted with that block, so removing a spot does not remove a copy a drive block already holds; the home address you save is never copied. And because a drive block can now leave an event, Location now says that the drive blocks that record where your phone was are the ones worked out for getting to an event, and that a drive block you add keeps its event like one you moved, brought back or removed; it also says that the drive blocks of an event you delete from your calendar stay until a later visit to that day clears them, and that one you had removed keeps its starting point until Reset All Data. The On-Device Data introduction, Location and "Drive addresses and saved spots" (which replaces "Drive addresses") under On-Device Data, and the Apple entry under Third-Party Services, carry these changes.

Update log — September 26, 2026: One thing added, arriving in the next App update, and nothing new collected by us: an address you type for a drive block goes to Apple to work out the drive, only while "Use Location for Travel Time" is on, and never to us or into an AI request. See "Drive addresses" under On-Device Data. Wording about "the next App update" was also brought up to date where that update has reached you.

Update log — September 23, 2026: One promise replaced, under Changes to This Policy, and no change to what the App does with your data. The old text promised at least 30 days' notice before a material change took effect. That was a promise we made ourselves, not one the law requires of us, and it did not describe how this page really works: a change is written here before the App update that carries it reaches you, and the App asks you on its own screen before anything new is sent — a wait we did not always keep on TestFlight builds, where every such change sat behind its own switch and consent sheet. The section now promises exactly that, and keeps the rest: continued use is never consent to a new use of your data, and nothing already sent to us is used in a new way without your consent. The September 12, 20 and 21 entries below are unchanged and stay behind the "AI Thoughts Support" consent sheet, which says what is sent and when. Nothing about what is sent, where it goes, or how long it is kept changed.

Update log — September 21, 2026: One detail was added to what comes back from "AI Thoughts Support" (arriving in the next App update; still off by default, behind its own switch and its own consent sheet): a mark may now also say which part of the day would be a good time to start. Nothing about what is sent changed — no time of day, and nothing else on your board, leaves your device. Your thoughts and the assistant, and "No conversation history on our servers" under What We Don't Do, carry this change.

Update log — September 20, 2026: One thing changed about timing, for "AI Thoughts Support" (arriving in the next App update; still off by default, behind its own switch and its own consent sheet). The September 12 entry below says the App sends your thoughts "a little at a time while the board is open." That is now true of everything except the start: the first of the thoughts already on your board are sent as soon as you turn the switch on, from Settings, without opening the board, while the App stays open in front of you. After that, as before, it sends only while the App is open on your board. Nothing else changed — what is sent, where it goes, how long it is kept and how to turn it off are the same — and the consent sheet you see before the switch goes on says so in its "When it sends" row. Your thoughts and the assistant, the On-Device Data introduction, "Routines, steps, checklists, thoughts, and planner data," and "AI features are opt-in" under Your Choices and Rights carry this change.

Update log — September 12, 2026: One optional data flow added, arriving in the next App update, off by default and behind its own switch and its own consent sheet. New: "AI Thoughts Support" in Settings → AI, on Premium. Turn it on and the App sends the thoughts on your board to Claude, one thought per request, a little at a time while the board is open — first the thoughts already there, newest first, some each day, then each thought you save or change — so it can mark what looks urgent or near its date; the mark is saved with the thought, on your device and in your private iCloud, never on our servers. Unlike the old Thought Analysis, it never sends your calendar or a photo, and never sends anything in the background or on a schedule; each request carries one thought's words (or the text read off its photo) and a line or two of dates, nothing else. It changes nothing until you turn it on, and turning it off stops that device sending and deletes nothing. Also new, for everyone and sending nothing: if a thought you write contains certain words about ending your life or hurting yourself, the App shows a card with the 988 crisis line; the check happens on your device, and nothing about it is saved with the thought. The TL;DR, the AI Features introduction, Your thoughts and the assistant, Consent, Sensitive information, the On-Device Data introduction, Crisis line card, Microphone and Speech, OCR, "Routines, steps, checklists, thoughts, and planner data," iCloud Sync & Backup, What We Don't Do, the Operational AI-request logs row under Data Retention, "AI features are opt-in" under Your Choices and Rights, and the withdrawal paragraph under International Users carry these changes.

Update log — September 6, 2026: One data flow removed, arriving in the next App update, and the switch that controlled it goes with it. Removed: the automatic sorting of your thoughts. Until now, with "Thought Analysis" on, the App sent new thoughts — with a small preview of new photo thoughts and a few days of your calendar events — to Claude in the background to flag what looked time-sensitive, checked again about a day later, and let the Day assistant's chat draw on your board as background context. From the next App update the App does none of that: nothing reads your thoughts or photos in the background, a thought reaches the assistant only when you ask about it (Smart Plan, or building a routine from it) or dictate it, and no photo is sent at all. The "Thought Analysis" switch is removed from Settings → AI in that same update, because nothing is left for it to control; until the update reaches you, it still works as described above. Anything the old sorting already wrote onto a thought stays with that thought, like the rest of it, until you delete the thought. Withdrawing consent is unchanged — "Turn off the assistant" in Settings → AI — and the withdrawal paragraph now names it, and the switches beside it, instead of a switch that is going away. Four corrections, none of them a change in what the App does. First, and the one that matters most: Microphone and Speech said a dictated thought went to the AI only if you used an AI feature on it. That was wrong. On Premium, and online, the App sends the transcript of a dictated thought to Claude right after you stop speaking, to tidy it up, and it did so before this update too; the section now says so, and says how to keep the original or stop the sending. Second, Photos and AI said a photo is also sent when you run an AI action on a specific photo. The App has no such action — not in the version on TestFlight today, and not in the next — so that sentence described nothing; it is gone. Third, iCloud Sync and What We Don't Do described saved AI conversations on your Thoughts board. No version of the App has ever saved one, so those clauses are gone. Fourth, the Age Verification Band paragraph said our 18+ rule was required by an App Store guideline. It is our own policy; the paragraph now says so. Also written down, under Your Choices and Rights: a device without a subscription checks our server, when you open the App, for whether a free AI promotion is running — a request that carries nothing about you; it was always the case and is now stated. The TL;DR, the Age Verification Band, the AI Features introduction, Your thoughts and the assistant, Photos and AI, Calendar context, Camera and Photos, Microphone and Speech, iCloud Sync & Backup, What We Don't Do, "AI features are opt-in" under Your Choices and Rights, the withdrawal paragraph under International Users, and Children's Privacy carry these changes. This update removes a data flow and adds none; the rest is the page catching up with what the App already did.

Update log — September 4, 2026: Two new behaviours arriving in the next App update, and one correction. New, the assistant's reach: when your request points at a calendar entry or a date further ahead, that entry's title and the plans and events on the few days up to and including it may be included in the request, so the assistant can plan backwards from it; to make that possible, the App's on-device copy of your calendar now reaches about three months ahead instead of about one, and this page now states that span. New, how long the copy lasts: from the next App update it keeps about three weeks of the past and removes older days automatically, from your device and from your iCloud copy while sync is on; until now nothing removed them, so the copy grew for as long as you had the App. Correction, not a change: the Location description said a starting point was stored only if you saved a commute. That was wrong about how the App already worked — while "Use Location for Travel Time" is on, every drive block the App works out records where your phone was when it worked the block out, whenever it has a current location fix, and always has. It now says so, and, from the next App update, those starting points will leave with their days under the same three-week rule, except on a drive block you moved, brought back or removed, which is kept. The AI Features introduction, Calendar context, Calendar, Location, and the On-device data row under Data Retention carry these changes.

Update log — August 29, 2026: Disclosed a new, optional AI data practice arriving in the next App update: when you ask the assistant to help you get ready for a specific calendar event, that one event's notes are included in that one request — filtered on your device first, shortened if very long, and kept by neither the App nor our servers (Anthropic's retention, described above, applies to them as to every AI request). The event's attendees, its URL field, its organizer, and its alarms are not sent. A new switch, "Read my event notes" in Settings → AI, controls it; it starts on, and with it off the App does not read an event's notes at all. The AI Features introduction, Calendar context, the new Event notes and prep section, Sensitive information, and Calendar say all of this. This is a new data practice, not a description of how the App already worked.

Update log — August 15, 2026: Disclosed a second kind of email Resend delivers to us: an automatic alert when a check of our server's subscription records finds something wrong — counts and shortened, hashed device references only, never your content or raw identifiers. The previous wording said Resend receives nothing at all unless you submit a report; that stopped being the whole story when we added this check. Added a matching row to the retention table.

Update log — August 9, 2026: Corrections to descriptions that did not match how the App works. Travel time: the previous wording said the App asks Apple Maps for directions, which means the relevant coordinates are sent to Apple. That was wrong about both what is sent and when — the App sends the event's address text to Apple's geocoding service to turn it into coordinates, and that sharing happens only when "Use Location for Travel Time" is on. The Location description, the On-Device Data introduction, and the Apple entry under Third-Party Services now say exactly that. iCloud: the previous wording said that after turning sync off, your data stays only on that device. That was not accurate — your data may still be included in your iPhone's own iCloud Backup. The description above now says so and names the switch that controls it. Reset All Data: the assistant-memory section said a reset erases remembered notes completely; it now discloses that, like the rest of your data, they can remain in the App's temporary on-device recovery copies, which never leave the device.

Update log — July 26, 2026: Disclosed the short-lived operational AI-request logs we keep on our own infrastructure (Cloudflare Workers Logs, retained up to 7 days — which feature ran, which model answered, request and reply sizes, cost, and a hashed device or subscription reference; never the content of your messages or the assistant's replies), added a matching row to the retention table, and clarified that beyond those logs we run no analytics of our own. Also named Resend in the EEA sub-processor sentence and added short-term operational service logging to the GDPR legal-bases list.

Update log — July 25, 2026: Named Resend as a fourth service provider — it delivers the email alert to us when you report an AI response, and receives only that report. Corrected the description of the two optional personalization switches: they turn on when you first accept the AI notice, and the previous wording incorrectly said they were off by default. Raised the minimum age to 18 throughout. Replaced the Australian privacy section with a Canadian one (PIPEDA and Quebec's Law 25).

Update log — July 16, 2026: Added an "Assistant memory" disclosure (an opt-in, off-by-default feature stored on your device and synced through your private iCloud, never covering health or diagnosis topics; viewable, editable, and deletable in Settings → AI — it adds no new data practice for anyone who leaves it off). Also disclosed that our server receives your IP address transiently, for anti-abuse rate-limiting only, and refined the Cloudflare and Anthropic-retention wording for accuracy; clarified that a photo is sent only in background triage or when you run an AI action on it yourself; added an Australian Consumer rights section; and corrected the wording of the daily/monthly usage-counter retention.

Update log — July 11, 2026: Clarified that the device token is pseudonymous personal data; named the AI/proxy sub-processors and transfer basis; unified the contact address; stated legal bases.

Update log — July 5, 2026: This revision describes iCloud sync and backup (on by default, to your own private iCloud), spells out the fuller context sent with AI requests (routines, calendar events including locations, your Day plan, and — when Thought Analysis is on — your thoughts and photo previews), and corrects earlier statements that implied this data never left your device. These changes describe how the App already works; they add no new data practice.

Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Michigan, United States, without regard to its conflict of law provisions. However, California residents retain all rights afforded to them under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Residents of the European Economic Area, United Kingdom, and Switzerland retain all rights afforded to them under the General Data Protection Regulation (GDPR) and applicable local data protection law. Nothing in this policy limits any mandatory consumer protection rights you may have under the laws of your jurisdiction of residence.