The short version. TimePeace's one lasting promise is this: you are in control of your own data, and your choice is respected. You decide how it's used — let TimePeace use it to show you things (recommendations, insights, recaps), or keep it zero-knowledge, sealed so that even we can't read it — and whichever you pick, we honour it. TimePeace keeps your data so that the features you choose can work — and for no other reason. Nothing is switched on without your say-so, apart from counting how the app is used and, on the iPhone app, telling Meta when the app is installed or opened or a new account is made, so we know which of our adverts work — never what you write in it. One switch turns both off; in the European Union, the European Economic Area and Switzerland we ask before counting, and there and in the United Kingdom the iPhone app tells Meta nothing unless you say yes to Advert measurement. You can change your mind at any time, and your data is always yours to read, download or delete. The rest of this page spells that promise out properly.
Who we are. TimePeace is a personal life-tracking app made by Nathan Duvel ("we"), based in South Africa, who also acts as the Information Officer under POPIA. If you ever have a question or worry about your data, email privacy@timepeaceapp.com and a person — not a form — will reply.
What we collect, and why it helps you.
· The essentials. You can start using TimePeace straight away, with no account — everything you log is then kept privately on your own device and never leaves it until you choose to create an account. When you create one (to back up your diary, sync it across your devices and turn on encryption), your entries so far are carried up into it; we keep your email address so you can sign in, with the language you read TimePeace in and your phone’s time zone name (such as Europe/London — never where you are), so the emails we must send are in your language and tell the time on your own clock, and we save the things you write — your diary, quick notes, plans, meals — including your eating pattern (the meal slots you keep), any fasting windows you set (their dates, which meals they pause, an optional eating window and an optional name you type) and a diet preference you choose, all ordinary food settings used only to fit the app to how you eat and never a record of anyone’s religion — lists, trips, the dates you’re counting down to, the habits you choose to build — what you call them, how many days a week, your optional why, and your own check marks, counted from your own diary on your device (a habit may also be about staying in touch with someone you’ve added, linking to that person) — (if you use the Studies feature) your courses, classes and deadlines, and (if you use the Work feature) the employment details you choose to enter — employer, role, your leave allowances, the balances computed from them, and the time off you book against them (single days or a stretch, in full days, half days or hours) — so they are safe in your account and waiting on every device you use. We also keep routine security logs that protect your account. We also keep a small operational record of the important in-app notices we show you — for example an occasional service or announcement banner: which notice it was, that your account was shown it, and when. It is a service record, like a delivery receipt — it holds only the notice and a timestamp, never anything you wrote — so we can see which notices actually reached people and keep an honest history of what we sent; it is never used to study how you use the app or for advertising. This is simply the service working as promised, so the legal basis is performance of a contract (GDPR Art 6(1)(b); POPIA s11(1)(b)); backups and abuse prevention rest on legitimate interest. To keep the service healthy we also look at simple aggregate numbers that fall out of running it — how many accounts exist, and how many synced on a given day. These are counts, not behaviour: we never read what you wrote to produce them, they identify no one, and they rest on our legitimate interest in operating TimePeace.
· Health & wellbeing. If you switch this on, we store the wellbeing moments you log yourself — mood, sick days, workouts, sleep, your weight (and body fat, where a scale you connect through Apple Health measures it) and the drinks you log (water, plus the other drinks you tally — tea, coffee, soft drinks, energy drinks, alcohol and any you name yourself — kept only as simple counts of what you drank, never calories or nutrition) — so you can see them woven through your diary and notice gentle patterns over time. This also covers the optional "Breaking a habit" tracker: if you use it, we store what you choose to record about a habit you’re changing (your own label, your check-ins, slips and notes) — it is private to your account, never shared, and shown to no one. When a watch, a file or you yourself give them, we also keep the detail of a workout — its laps, the heart-rate, pace and power line over the session, the time spent in each effort zone and the effort you rate a session or a set at — as part of that same workout (never where you went). If you build yourself a training plan, we keep the sessions it holds and the days you placed them on — a plan you wrote for yourself, never a judgement of you. If you set the heart rate your effort zones are drawn from — your own number, or the estimate your phone works out from your own sessions — we keep it with your workouts, with the day you last checked it. If you switch on Self-care, we also store the short skincare routine you keep in your own words and — only if you turn the skin note on — the gentle daily word you give for how your skin feels, an optional where, and a line of your own. If you separately turn on progress photos, any weekly skin photo you take is kept only on this device, encrypted, and is never uploaded or synced — only the date and an optional note ride your account; you can set two side by side, save or delete any of them, and clearing Self-care or deleting your account destroys them. It is names and your own words only (never products, ingredients, a skin score, a diagnosis, face detection or any analysis of a photo), private to your account, and held as skin/health condition data under this same explicit Health consent. If you join a group that runs Training and say yes there — asked in that group alone, before anything is sent — the training you log (each session’s sport, when it was, how long, how far and the effort you gave it) is shared with the people who lead that group whom you named when you said yes, and, only if you separately choose it, the number of sessions you did that week is shown to its members. Never your diary, your sleep or recovery reading, your body log or your photos. It is kept on our servers only so those people can see it — like anything in a group, it is not sealed with your own key — and it stops the moment you say so in that group, or leave it; a leader who joins later sees nothing until you say yes to them too. If you also say yes to sharing your fuelling there — a separate yes, asked in that group alone — those same people see three counts worked out on your phone from your own logs, and nothing more: how often your plate matched the kind of day you trained, how often the carbs you took in a key session matched your plan, and your gut score after long sessions. Never what you ate, your weight, your cycle or your check-ins; stopping it, or stopping the training share, stops it at once. If someone who leads that group sends you a training plan, it is kept on our servers for you and that group’s leaders to see. It reaches your planner only if you say yes, on your own phone; a change they make later reaches only a day still ahead that you have not done; and it goes when you leave the group or delete your account. Once you follow a plan there, the days of it you follow and where they now stand — never their names, minutes or your notes — join the training you share with the people you named. Health information is specially protected in law, so we only process all of this after your explicit consent (GDPR Art 9(2)(a); POPIA s27(1)(a)), asked in its own clearly-marked step. Withdraw whenever you like: the health features simply go to sleep, and your data stays yours until you clear it. Mood also has its own switch in Settings → Features: switched off, mood disappears everywhere in the app and nothing new is recorded, while the moods you already saved are kept, untouched, for when you switch it back on.
· People & relationships. If you switch this on, we store the names and catch-up rhythms you choose to record, anything you note about the people you care about — what’s going on in their life, life events and gift ideas — and the gatherings you plan (who’s coming, where, when, and a group gift), so TimePeace can help you remember birthdays, nudge the friendships you want to keep warm, show who shared your days, and organise the occasions you host. The basis is your consent — and because these notes describe other people, please record them considerately.
· The people you cook for. If you tell TimePeace who you cook for, it keeps a short list on your phone: a name (or a person you already keep in People), a plate size, how they eat, and any food they avoid and how strictly. It uses this only to plan meals, portions and your shopping list. Allergen notes are based on a recipe's listed ingredients — always check the pack. Nothing about the people at your table is shared with anyone unless you share your week with a group, and the People record is never changed by it.
· Your sweat tests. If you work out your sweat rate on the drinking page, TimePeace keeps one result for each kind of weather — litres an hour and the date, never your weight — on your phone and in your own backup, so the drink plan can use it next time. It is kept only if you may see weights in Food, it goes out with your Food data and is cleared with it, and a new test in the same weather replaces the old one.
· Your numbers. If you switch Numbers on in Food, TimePeace can keep your weight, height and — only if you choose to say — your sex, and the goal you pick, to estimate ranges for energy and protein. Your age is the one you gave at sign-up. These are estimates, not measurements; they stay on your phone and in your own backup, you can change or clear them any time, and Numbers is never offered to anyone under 18 or in pregnancy.
· Your Monday check-in. If you let your training shape your food, Food can ask a short check-in once a week that you choose to answer — eight answers in words (energy, sleep, hunger, mood, training, soreness, illness and your gut) and how your gut was on the week's long run, which helps pace how much you practise eating during long sessions. It is kept on your phone and in your own backup, at most two years, shown back to you only in words (never a total or a score), goes out with your Food data and is cleared with it, and is never sent to anyone unless you share it into a training group yourself.
· What you ate. If you log what you ate in Food — from your plan, a copy of an earlier meal, a few words you type or say, or a photo — TimePeace keeps each meal as its parts and, when Numbers is on, an estimated range. If you have let TimePeace's AI read your words, the words you type or say for a meal can be read into parts that way, and only the words are sent: saying it uses your phone's own dictation, and no recording is sent. A photo is read only under its own permission (see Reading a meal photo), and only the list of foods is kept. It is health information: kept on your phone and in your own backup (if your backup is encrypted, months older than a year are kept only as sealed parts of it), it goes out with your Food data and is cleared with it, and it is never used for ads or sold.
· Numbers off. If you choose plates instead of numbers in Food — a quiet line under the Numbers switch offers it, and nothing is ever switched for you — TimePeace keeps that one switch so Food shows you plates and plain words instead. It is health information: kept on your phone and in your own backup, cleared with Food, never used for ads, never sold and never shared. We never ask why, never infer it, and you can switch numbers back on any time.
· Your health in Food. If you switch on “Pregnant or breastfeeding” or, as an adult, “On a weight-loss medicine” in Food, TimePeace keeps that switch so Food can suit it: in pregnancy, foods to take care with, folate and vitamin D to ask your clinician about, and no weight-loss goals or numbers; on a medicine, protein at each meal and the short notes you choose to write for your clinician — your own words and the day you wrote them, newest first, to show at an appointment. TimePeace never reads those notes, never acts on them, and never gives a dose or advice about your medicine. “See the full list” opens the NHS’s public page in your browser and sends nothing about you. It is health information: kept on your phone and in your own backup, cleared with Food, never used for ads, never sold and never shared. We never ask why or infer either one, the medicine switch is never offered to anyone under 18, and you can switch either off any time.
· Weather on your days. If you set a town for the weather (on the drinking page in Food, or in Food’s settings), TimePeace keeps that town’s name and a point for it rounded to about ten kilometres — never your address — with your settings, and uses it to look up the forecast: tomorrow’s heat for your drinks, and the sky on today’s diary page. Only that rough area and your time zone go out, through our own server to MET Norway (see “Who helps us run the service”) — never who you are, and never your phone’s location, which TimePeace does not read for this. Weather you set yourself on a day is never changed, a day you clear stays clear, and “Stop using the weather” removes the town and ends the lookups.
· Money & spending. If you switch this on, we store the budgets, savings goals and spending you track, the account balances you keep (including any credit-card amount you owe), and the recurring income and bills you enter, so the Money features can show you where things stand and what is safe to spend. Every figure is one you type — nothing is read from a bank unless you also choose the separate statement import (“Importing a bank statement” below), which has its own permission. If you split a shared expense, we store the amounts and who owes whom (scoped to a trip or gathering, with the people you choose) — settling is only a marker, we never move money. On a trip you can record spend in its local currency; to show the rand equivalent, our own backend fetches a live public exchange rate (see “Who helps us run the service”) and sends nothing about you. The basis is your consent, and nothing about your money is processed before you give it.
· Messages. If you switch on Chat, we store the messages you send and receive inside TimePeace — what you wrote, when, who you are in that conversation, what you attached and who you named — so they can be delivered and so the conversation is there when you come back. We hold their contents; they are not end-to-end encrypted. They are used for nothing except carrying the conversation and answering a report about it.
· How we count usage. To find out what is confusing, what breaks and what nobody finds, TimePeace counts how it is used: which screens you open and which buttons you tap, and when; which optional features you have switched on; the permissions you were asked for and what you answered; and, if the app hits an error, a short technical report — what went wrong, where in the app and the app version — scrubbed of anything that looks personal before it leaves your phone. With each batch go a few facts about the device it was counted on, so a problem can be traced to the kind of phone it happens on: whether it is a phone, a tablet or a computer; its operating system and the main version number; the app’s version and edition; whether TimePeace is running installed or in a web browser; the device’s language and time zone; a rough speed class of its connection; and a session number that starts afresh each time the app is opened — never the browser’s identifying string, never a device identifier, and never your internet address. Never what you write: not an entry, a title, a name, an amount or anything you type. The app itself sends this to us, TimePeace; it is stored with Supabase, our provider, in London, under a one-way code that replaces your account before anything is stored, and it goes to no one else — never to an advertiser, and never sold. Why we may, and how to say no. In South Africa we rely on our legitimate interest in making TimePeace work well for the people who use it (POPIA s11(1)(f)), and you may object at any time (s11(3)); in the United Kingdom, on the exception the law makes for statistics about how an online service is used; and everywhere else outside the European Union, the European Economic Area and Switzerland, on that same legitimate interest. Saying no is one switch — Settings → Privacy & data → Usage measurement — or an email to privacy@timepeaceapp.com; from that moment nothing more is counted, and nothing else in the app changes. In the European Union, the European Economic Area and Switzerland we ask you first: nothing is counted unless you say yes, and you can take that yes back the same way (GDPR Art 6(1)(a)). To know whether to ask, your account keeps one setting: the country your phone’s language and time zone settings point to — and, if you buy a subscription through the App Store or Google Play and the store’s country is one where we ask first, that country instead, so a store can only ever make us ask, never stop us asking — never your location, and never worked out from your internet address. The health areas are counted only with a separate, explicit yes, “Count my use of the health areas too”, off unless you switch it on (GDPR Art 9(2)(a); POPIA s27(1)(a)) — and then only which of their screens you open and what kinds of entry you log there, never a reading. Anyone who has told us they are under 18 is never counted as a person — only in totals that say nothing about anyone. How long: the detailed record of what was used is kept for at most 13 months; after that only totals that cannot be traced to anyone remain.
· Before you have an account. Where we would count you by default, the app also counts how far you get through the welcome — which of its screens you reach, never what you choose or type — under a random code made on your phone that says nothing about it. If you then make an account, those steps join it and the code is deleted from your phone. In the European Union, the European Economic Area and Switzerland nothing is counted before you say yes.
· How Help gets used. When you use Help, the app counts — with no account and nothing that says who you are — which articles are opened, whether you found one helpful (and, if not, the reason you pick), and how many searches found something. When you ask the assistant in Talk how to do something, we also count, by day and language, whether it answered from one of our help articles (and which one) or had no article for it — a count only, with no account, nothing that says who you are, and none of your words. For a search that found nothing, it keeps the words you typed after taking out anything that looks like an address or a number, so we can write the article that is missing. A random code made on your phone and mixed with the day stops one phone counting the same thing twice; it changes every day and cannot be linked to you. These counts are sent at most once an hour and never while your phone’s Data Saver is on, and until then they stay on your phone. When Help or the assistant in Talk can’t answer a question, we add a short, general version of it to one list of unanswered questions, with a count of how often it was asked — for Talk that is the assistant’s own rewording, never your own words and never anything from your diary, and names, numbers and addresses are taken out first. If you write to us and we have no article for it, we may add only the kind of question it was (for example “a question about billing”), never what you wrote. The basis is our legitimate interest in making Help answer what people actually ask.
· When signing in or saving goes wrong. If signing in fails — with Apple, Google, your email and password or the link in one of our emails — or saving to our servers fails several times in a row, the app counts it, and counts the times it works, so we can tell when one of them is broken for people and fix it. A count says only which way you were signing in (or that it was a save), what kind of error came back — for example that it was refused or got no answer — and the app version: no account, nothing that says who you are, no email address and nothing you wrote. It is sent whether or not you are signed in, because a sign-in that failed has no account yet. The counts are kept for 90 days. The basis is our legitimate interest in keeping signing in and saving working.
· The feedback you send. When you use “Share feedback” in Settings, what you write reaches the maker tagged only with a one-way code for your account — never your name or email. If you tick “let the maker reply to this”, that one item is kept so you can see its status and read any reply right here in the app, under “Your feedback”; without the tick it stays a one-way note (we read it, but it is not linked back to you). If you also turn on “Also email me when you reply”, the email address you give is kept with that one request, together with the quiet hours and time zone your app had set, so that we can send one short email saying a reply is waiting — never the reply itself — never during your quiet hours, and at most once a day. The address is used for nothing else and is never matched to your account; you can turn the email off for that request under “Your requests” at any time, and it goes when the request does. The basis for this is your consent — turning it on. You can clear your feedback list at any time. The basis is your consent — the tick — for keeping an item so we can reply, and otherwise our legitimate interest in improving TimePeace.
· When Talk gets something wrong. If Talk could not do what you asked, or did it wrongly, you can tap “Not right?”. Before anything leaves your phone you see exactly what would be sent: this sitting’s Talk conversation (what you said and what Talk replied), what Talk did with it (what it filed or changed), and the app’s version and language — nothing else from your diary. Only if you then tap Send does that copy reach the maker, tagged only with the one-way code for your account — never your name or email — so we can find out what went wrong and fix Talk. We keep the words for 90 days; after that they are deleted and only the kind of problem and how often it happened remain. When a problem is fixed, we may turn it into a test sentence that checks Talk keeps getting it right, rewritten so it carries none of your details. If your diary is sealed with your own key, sealing still protects everything stored in it; a flag is a copy you chose to send us, like feedback, so we can read the copy you send, and nothing else. Each Send is its own choice — there is no standing switch, and not tapping Send sends nothing. The basis is your consent: the Send tap.
· Messages from the maker. Sometimes the maker will send a short announcement to a group of people at once — say, to everyone, or to people who joined recently. You read it inside the app, under Settings → Help & Feedback (“Messages from the maker”), just like a reply to feedback. Who receives one is decided only from ordinary account facts — whether you subscribe, and roughly when you joined — and never from anything you wrote, your mood, health, the people you note, your money or how you use the app; the message is tied to your account by the same one-way code used for feedback, never your name or email. We store only the message itself and whether it has been shown to you. It is a service message about TimePeace; the basis is our legitimate interest in keeping you informed about the service you use. If you also switch on News & updates by email (below), the maker may send these same announcements to your email too; if you don’t, they reach you only inside the app. Who gets one by email is still decided only from the ordinary account facts above — never from anything you wrote. (A notice that something you use has gone wrong is different — see “Service notices by email” below.)
· News & updates by email. If you switch this on, we use your email address to send you the occasional announcement about TimePeace — a new feature, an important change — so you can hear about it without opening the app. Only the announcement is sent; we never include anything you wrote, and who receives one is chosen only from ordinary account facts (whether you subscribe, roughly when you joined), never from your mood, health, the people you note, your money or how you use the app. The email is delivered by Resend, our email provider (see “Who helps us run the service”), which receives only your address and the message in order to send it. The basis is your consent: it is off by default, every email carries a one-tap way to turn updates off, and one tap here in Settings → Privacy switches it off again. This is only about getting announcements by email — the in-app “Messages from the maker” reaches you either way.
· Service notices by email. Rarely, something goes wrong with a part of TimePeace you use — say, a connection you switched on stops working — and we need to tell you, and tell you again when it is fixed. A notice like that is about the service you use, not news, so it is emailed to everyone it affects, whether or not you switched on News & updates by email. It says only what happened to that part of the service and what to do; it never carries anything you wrote, and who receives it is chosen only from ordinary account facts (such as having that part switched on), never from your mood, health, the people you note, your money or how you use the app. It is delivered by Resend, like any other email from us. The basis is our legitimate interest in keeping the service you use working and telling you when it isn’t. Service notices can’t be switched off, which is why we keep them to real service matters and never use them for news or offers.
· A thank-you for sharing. If you first arrive through a friend’s share link or QR code, we keep one quiet record — their share code next to a one-way coded id for your account (never your name or email) — so that if rewards for sharing ever exist, the people who shared early are honoured too. It is written once, other users can never read it, and it is never used for advertising or tracking. The basis is our legitimate interest in saying thank you; it changes nothing about how the app treats your data. In the same way, if you first arrive on a campaign link — a launch post, a community link or a directory — that link may carry plain campaign labels (the place, the kind of link and the campaign name, such as “producthunt”, “community” or “day1-launch”), and if you then create a new account we keep one quiet record of those labels next to that same one-way coded id, so we can see in aggregate which efforts brought people in. These labels describe the link, not you; like the share record it is written once, other users can never read it, and it is never a third-party or cross-site tracker, an ad cookie or a profile — only first-party labels we set ourselves. The basis is our legitimate interest in understanding where our own audience comes from. Alongside the campaign name we keep a few more details of exactly the same kind, for the same reason and under the same rules: which advert inside a campaign the link belonged to; the page you landed on and, where your browser offers it, the site you came from; and, if you choose to answer it, your own reply to “how did you find TimePeace?”. On a phone there are two more, and both come from the app store itself rather than from any code of ours: on iPhone, Apple’s own signed note that an install followed a particular advert — Apple sends it to us, nothing of theirs runs on your device, and Apple alone decides how much detail it will share, while the app adds just one thing to it: when a new account is made, it tells Apple once, with a fixed mark that says only that an account was made — nothing about you and nothing you do in the app — and on Android, the install referrer Google Play hands the app the first time you open it — and, also on Android, if the Facebook, Instagram or Facebook Lite app is on your phone, the note Meta’s app keeps of which of our adverts on Facebook or Instagram, if any, you tapped or saw before installing TimePeace. The app asks Meta’s app for that note once, on your phone, with none of Meta’s code inside TimePeace, and only where “Measuring our own adverts on iPhone” below would allow it (in the European Union, the European Economic Area, Switzerland and the United Kingdom only once you say yes to Advert measurement, never for anyone who has told us they are under 18, and never after you switch usage measurement off — or, there, Advert measurement). Meta’s app can see that TimePeace asked, but nothing about you is sent to Meta, and from the note we keep only the campaign’s name and whether the advert was tapped or only seen — the rest is thrown away. Every one of these describes the link, the page or the shop-front you arrived through — never you, and never anything you wrote — and none of them is sent on to anyone else — with one exception. When you arrive from a Google advert, Google adds its own click identifier to the link — a gclid, or the newer gbraid or wbraid it uses instead on iPhones and on links into the app — and if you then create a new account we may send exactly one of them, with the time you signed up, back to Google Ads, which ran the advert, as a conversion signal: a way of telling Google Ads that the advert led to a sign-up. Nothing about you and nothing you wrote goes with it, it goes to no one else, and the basis is the same legitimate interest in understanding which of our adverts work. When you arrive from a Facebook or Instagram advert, Meta adds its own click identifier to the link too — an fbclid. If you then create a new account, we keep it only one-way coded: mixed with a secret of ours and scrambled, so the identifier itself is never stored and cannot be read back from what we keep. Unlike Google’s, it is never sent to Meta or to anyone else; it is kept for the same purpose, on the same legitimate interest.
· Measuring our own adverts on iPhone. When we advertise TimePeace on Facebook or Instagram, Meta (Meta Platforms, the company behind them) can only tell us whether an advert led anyone to install the app if the app itself tells Meta. So the iPhone app carries a small piece of Meta’s code, kept to the minimum, which tells Meta three things and nothing else: that the app was installed, that it was opened, and that a new account was made. Never how you use the app, and never anything you write or log in it — not an entry, a name, a screen you opened or a button you tapped — and never your name, your email address or your account. With each of those three messages goes what any app sends when it talks to a server: the app’s name and version, the kind of phone, its operating system version, its language and time zone, and a random number Meta’s code makes on the phone so one install can be told from another. When it reports that the app was opened, Meta’s code also says how long the last visit lasted and how many times the app was put aside during it — never what was done in it. Because Meta’s code talks to Meta straight from the phone, Meta also sees the internet address the messages come from, as any server does. We switch the rest of that code off: it never reads your phone’s advertising identifier, it records nothing by itself, and TimePeace never asks for permission to track you across other companies’ apps, so your iPhone does not let it. If Meta’s code itself breaks, it may send Meta a report of that fault, with nothing about you in it. Meta uses the three messages to tell us, as totals, how many installs and new accounts our adverts led to, and to show our adverts to people more likely to want TimePeace; it receives them under its own terms for businesses and its own privacy policy (facebook.com/privacy/policy). This happens only in the iPhone app — never on our website, in the web version or in the Android app — and in the European Union, the European Economic Area, Switzerland and the United Kingdom only if you say yes to Advert measurement (decided by where your phone is, read from its time zone — see below), never for anyone who has told us they are under 18, and never after you switch usage measurement off — or, there, Advert measurement. Why we may, and how to say no. The basis is our legitimate interest in knowing which of our adverts work (POPIA s11(1)(f)), and you may object at any time (s11(3)): turning off Settings → Privacy & data → Usage measurement stops it from that moment, or email privacy@timepeaceapp.com. In the United Kingdom and Europe it is your choice first. There the law asks for your yes before an app stores anything on your phone for advertising (ePrivacy Directive art 5(3); PECR reg 6), so there the basis is your consent (GDPR art 6(1)(a)) instead. The app asks once, after you save an entry — “Not now” means we will not ask again for six months — and nothing goes to Meta unless you say yes to Advert measurement. It is a permission of its own, separate from usage measurement, and switching it off in Settings → Privacy & data stops it from that moment.
Linking with other people. If you switch on Connections, you can link with another TimePeace member by showing a single-use code and having them open it with their phone’s camera (or by sending them the link) — and only when both of you confirm. When you do, we store that the two of you are linked, and the display name each of you chooses to show the other (which defaults to your name and you can edit). The other person never sees your email or account, and none of your diary, plans, money or other content is shared by linking itself. Once you are linked, either of you may also choose to send the other: a short written note (a few lines you type); a list — a shopping list, a packing list or a checklist — with an optional “do by” date; a saved artefact you keep — a recipe, a reusable packing template, or a plan (a week of meals, or a trip’s dates, stops and packing list); or a hangout you propose (a name, an optional day/time and note). You may also choose to share your own contact details — name, surname, birthday, phone and socials, field by field — which then appear on the card the linked member keeps about you, shown there as shared by you (never mixed with what they typed) and removed if you stop or unlink. The person who receives any of these is always in control of it: a note can be added to their diary, kept aside in a “From friends” section, or dismissed; a list, recipe, template or plan can be added to their own things or dismissed; a hangout is confirmed or declined, and only a confirm puts a matching gathering in both your diaries — nothing is ever added automatically. A note, list, artefact or hangout you send is held on our server only until the other person acts on it and is then deleted; contact details you choose to share are held as a small standing record only while you keep sharing them. When you share a shopping list you may also make it a live list — ONE shared list that appears in both your Shopping lists and that either of you can add to, tick off and remove from, with changes syncing to both phones; this one is kept on our server while it is live so both devices stay in step, and is removed when either of you taps “Stop sharing” or you unlink, at which point each of you keeps your own ordinary copy. None of it is ever read from any of your other content. This is the first time anything about you is stored in relation to another person, which is why we ask for it as its own clear, explicit step. The basis is your consent; it is off until you turn it on, and either of you can unlink at any time, which ends the connection for both of you immediately. (Each of these shared things is always a separate, deliberate choice; any future ones will be too.)
Groups — the one place other people see anything of yours. If you switch on Groups, you can create or join a group — a club, a trip, a team, a class, a household. We then store the group’s name and purpose, who is in it and their roles, and the shared to-dos, checklists, lists, plans, rosters, polls, trip plans and money records you and the other members add, so every member of that group can read and change them. When someone shares an invite link to a group, anyone holding the link can see the group’s name and picture and, unless its owner turns them off, what it is for, who sent the invite and how many people are in it, before they sign in. Nothing else from inside the group is shown until they join. Answering one question by link. The people who run a group can also send a guest link for one question — a poll, a dates poll or who is coming to an event — so that someone with no TimePeace account can answer it in their browser. Whoever opens it sees the group’s name and that one question with the choices its members wrote; they type the name their friends know them by and give their answer (for an event, how many of their household are coming). Afterwards they see only how many chose each answer, never who chose what, and nothing else of the group. We keep only that name, that answer and when it was given, and a secret in their browser that lets them change or take back their answer — no email, no account and nothing about their device. Their answer shows in the group marked as a guest’s, so members always know who can see what they wrote. Before they answer, the screen tells them what is asked, who will see it, how long it is kept and how to remove it; answering is their choice. A guest link stops working when its question closes (or its trip begins), takes only so many answers, and is limited in how often it can be used; the people who run the group can close it or remove a guest’s answer at any time, and deleting the group deletes its guests’ answers with it. Budget polls. In a budget poll each member privately picks what they can spend from the bands the organiser sets. That pick is kept apart from the group’s shared things, on our server, where nobody but the member can read it — not the other members and not the organiser — and the group sees only one line: the most the person with the smallest budget is comfortable with, and only once three people have answered. Leaving the group, being removed from it or deleting your account deletes your pick. Whoever runs a group can also post announcements to it — a short message every member of that group can read, kept with the group like anything else in it. Announcements travel one way on purpose: there is no reply, no comment and no reaction, because TimePeace is not trying to be the group’s chat. This is the only place your TimePeace information is visible to other people: to the members of the groups you create or join, to whoever answers a question sent by guest link (that question and its counts), and to no one else — never publicly, never sold, never used for advertising. Your diary, and everything else you keep, stays yours alone; a group only ever holds what you deliberately put in it. Your diary itself is never shared. You can send one moment from it into a group by hand — a single entry, picked by name, with a tap — and what arrives is a copy, which becomes an ordinary group note with your name on it. Nothing goes automatically, no setting shares your days for you, and no group ever gets a live window into your diary: change or delete the original afterwards and the copy stays as it was, and changing the copy leaves your diary alone. Three of the things a group can hold deserve spelling out, because the app also shows the group something worked out from what people put in, not only the entries themselves. In a poll, your answer is visible to the group with your name on it — including, in a dates poll, which days you said you could make. A trip holds the destination, dates, place to stay and the bookings an organiser posts (with any link or price they include), and the app shows members a rough per-head estimate — the group’s shared costs divided by how many people are in. In the group’s money list, the shared expenses members add — who paid, how much, in what currency, and how it is split — are visible to the group, and the app works out from them who owes whom and shows that too; marking something settled is only a shared note that you squared it between yourselves. In a group that runs Home — a household on more than one phone — and only after you say yes in that group, its members keep one week of meals (what kind of meal each night is and what it is called), who plans, shops and cooks, and one live shopping list showing who added each item; never what anyone ate, anyone’s food needs or your diary, and you can stop it on your phone at any time in the group’s settings. When a chapter of a group — a trip, a weekend, a season — ends, the people it was for see a short recap of it, worked out on each phone from what the group already shows them: its dates, who was in, the events held, the jobs done, its money and its notes. Nothing new is collected or kept for it, and it reaches your diary only if you tap Add to my diary, as your own copy. TimePeace never moves, holds or requests money, and a group’s sums are never used for anything beyond showing that group its own numbers — never for advertising, and never for any judgement about you. Because a group is shared it has to be readable on our servers for the group to work, so it is not sealed with your personal encryption key the way your private entries can be. It is entirely optional and off until you create or join your first group, and you can leave a group at any time, which ends your access to it. The basis is your consent.
AI in a group. If you describe a group you want to set up, only the words you just typed are sent — that is part of Talk, the same permission Talk itself uses. Anything that reads what is already in a group is different, because it means reading things other members wrote. That has its own permission, AI in groups, which is off unless you turn it on — we ask the first time you try it — and it only works in a group where a leader has switched AI on as well. While it is on, every member sees so on the group itself. Every member may say no to their words being read by anyone’s AI in that group — when they join, or at any time in the group’s settings — and a note can be marked No AI: those words are then left out of everything sent, and every suggestion says how many members were left out, never who. A leader may lock the group’s AI settings so that only owners and leaders can change them; your own answer stays yours either way. When you ask for a change — “move everything back a week” — the AI reads only the parts of the group you can already see, and what it sends back is a set of suggestions shown to you first: nothing changes until a person accepts it. A change you cannot make yourself becomes a request, labelled as written by AI, for a leader of the group to decide on. Whoever asks pays from their own plan. What is sent goes to the same AI provider as Talk (Anthropic), only when someone asks and only to make the suggestions — it is never stored there, never used to train a model, never used for ads and never sold. Everything an AI wrote is labelled as AI-written, and you can report it exactly as you report anything else. The AI can never remove a member, report something, block anyone, move or settle money, or delete a group. You can turn your permission off at any time, and a leader can turn AI off for everyone. The basis is your consent.
Talking to people — chat. If you switch on Chat, you can talk to the people in a group you share, and one-to-one with someone you are linked with. A message you send is stored on our servers so it can be delivered and so the conversation is still there tomorrow — reachable only by the people in that conversation, enforced by per-conversation rules on our servers rather than trusted to the app, encrypted while it travels and while it sits. We keep what you wrote, when, who you are in that conversation, whatever you attached from the group, who you named, and — on your own row, for you alone — how far you have read, whether you have muted it and how you want to be alerted. Nobody else in a group is ever shown what you have read; a one-to-one read receipt happens only if you switch it on. And the plain fact, because every protection listed above invites the opposite assumption: this is not end-to-end encryption — we hold the contents of the conversation. Your private diary is the thing you can seal with your own key so that even we cannot read it; a conversation is shared by definition, so it cannot be sealed to you alone. What that means in practice is narrow and worth saying: no automatic moderation of any kind — we do not scan, score or read conversations — and the only time a person here reads a message is when somebody reports it. Nothing about a conversation is ever used for advertising, and nothing in it is used to make any judgement about you.
If you report something in a group. Reporting sends us the item you picked — a copy of its wording as it stood, because the person who wrote it can change or delete it afterwards — along with the group it is in and who wrote it. That is another member’s content coming to us, for a reason that is not running the feature, so we want to be exact about what does and does not happen: the group’s owner is usually the first person to read it — the person who runs the group sees the item’s snapshot and the reason you chose, never your name, and can remove the item, leave it, or pass it to us. We receive every report as well, whichever way it is routed: a report the owner has not acted on within 12 hours comes to us automatically, and a report about the owner themselves, or about the group as a whole, never goes to the owner at all — it comes straight to us, and that rule is enforced on our servers, not left to the app. Nothing is taken down, hidden or deleted automatically, the member you reported is not told, and your report is never shown to the person you reported or to the rest of the group. There is no automatic moderation of any kind: we do not scan, score or read what groups hold, only the reports people choose to send. Acting on a report is a human decision — the owner’s within their group, ours everywhere — and we may then remove content or an account under the Terms; anyone who thinks we got a decision wrong can appeal on our report page, and we look at our decision again, from the start. A reported message works the same way and moves faster: the message as it stood, the conversation it is in and who wrote it come to us, and we answer a report about a message within 24 hours — a clock we hold ourselves to because a conversation can hurt someone while a shared list cannot. Separately, you can block a member: that stops the two of you being put in a group together, in either direction, until you undo it. The basis is our legitimate interest in keeping a shared space safe for the people in it.
Who helps us run the service. A few trusted providers do the heavy lifting: Supabase stores your data and handles sign-in (under their data-processing agreement with Standard Contractual Clauses), Cloudflare serves the app to your browser, Frankfurter (a public, open-source exchange-rate service built on European Central Bank data) is queried by our Supabase backend — never your device — to show live currency conversions on trips, receiving only that generic server request and nothing about you or what you write, Photon (an open, OpenStreetMap-based address search) is queried by our Supabase backend — again never your device — when you look up a place for an event or the town for your weather, receiving the words you typed and nothing else: not who you are, not your device, not where you are, and nothing else you have written, MET Norway (the Norwegian Meteorological Institute) is queried by our Supabase backend — never your device — only if you set a town for the weather, receiving only a rough area around that town, about ten kilometres across, and your time zone — never who is asking (one shared, short-lived answer per area serves everyone in it, and our server keeps no record of who asked), Transport for London is queried by our Supabase backend — never your device — if you set up a commute, to show live departures and line status for the stops and lines you picked, receiving only which stop or line is being asked about and never who is asking (one shared, short-lived answer per stop serves everyone watching it, and our server keeps no record of who looked), and a saved commute is itself only the stops and lines you picked — public stop names and identifiers, never your coordinates, never a route or a trace — Resend (our email provider) delivers an announcement to your inbox only if you have switched on News & updates by email — receiving only your email address and the message in order to send it, never anything you wrote, and used for nothing else — Apple is involved if you choose to sign in with Apple (it confirms who you are and returns a token that signs you in, receiving only what is needed to do that and nothing you wrote) or, on the iPhone app, if you turn on a reminder (Apple’s Push Notification service delivers it, and from us it receives only your anonymous device token and the reminder message — never anything you wrote). If you sign in with a passkey (Face ID, Touch ID or your device PIN), your device’s own security hardware confirms it is you — nothing about your face, fingerprint or PIN leaves your device or is ever held by us, and the passkey credential is stored by Supabase (already named). Google is involved if you choose to sign in with Google, to connect your own Google Calendar or, on the Android app, to turn on a reminder (Google’s Firebase Cloud Messaging delivers it, and from us it receives only your anonymous device token and the reminder message — never anything you wrote). If you connect your calendar, TimePeace reads the events on it to show them in your day and weave them into your diary, and adds the plans and trips you choose back to it — it only ever touches events (never your calendar’s settings, and never anyone else’s calendar), the events it brings in are shown only to you, and disconnecting in Settings stops it. To keep that connection working without asking you to reconnect every hour, we securely store a Google refresh token for it on our server only — never on your device, and in a locked place our own app code cannot read — used solely to renew access to your calendar through a dedicated backend function; disconnecting deletes it. If you connect your phone’s health store — Apple Health on the iPhone app, or Google Health Connect on the Android app — TimePeace reads the sleep, workouts, steps and heart data — resting heart rate, heart-rate variability and blood oxygen — you choose to share — and, on the iPhone, your weigh-ins (weight and body fat, from any scale that saves them to Apple Health) — read only, to fill in your diary and your Health screens; it never writes anything back, shows it only to you, and stops when you disconnect. This happens on your device through your phone’s health store with your permission, so nothing of yours is sent to Apple or Google. When you import a recipe by a link, that same Supabase backend fetches the page you chose (so the recipe site sees our server, not your device) and returns only the recipe to fill the form — we keep just the recipe you save. On the iPhone app, Meta (Meta Platforms, the company behind Facebook and Instagram) receives the three messages described in “Measuring our own adverts on iPhone” — that the app was installed, that it was opened and that a new account was made — and nothing else. That is the whole list. We never sell your data, there are no ads in the app, and nothing you write or log is ever shared for advertising — what you log is kept only as your own diary, the service you asked for, and is never used to follow you across the web. (Our public website — the pages that explain TimePeace — and the web version of the app at timepeaceapp.com/app use Cloudflare’s privacy-first Web Analytics: cookieless, it stores nothing on your device, builds no profile and never tracks you across other sites, counting only aggregate visits and page loads so we can see what helps — how often the site is read and the app is opened, never who you are or anything you do or write in it. It touches none of your account data; the basis is our legitimate interest. The iPhone and Android apps do not carry it.) If you email us or send us a message from the app, one more provider may briefly help: Anthropic (the maker of the Claude AI assistant) can suggest labels for what you send — things like “question” or “urgent” — so we reply faster, and if you write in another language it can translate your message into English for our team and translate our reply into your language. It sees only the message you sent us, never your account or diary; it never acts on anything by itself — a person on our team reads and sends every reply; and your messages are never used to train AI.
When you write to us. Mail to support@timepeaceapp.com and privacy@timepeaceapp.com, and a report sent from our report page, is filed in our own support system — a queue with a clock on it — rather than left sitting in an inbox somebody remembers to check. Anyone, with or without a TimePeace account, can use that page — timepeaceapp.com/report — to report illegal content or an intimate image shared without consent, or to appeal a decision we made. A report holds what you type there: what you are reporting, where it is and why, and — if you give them — your name, your email address and the name you sign with (reporting child sexual abuse material, you may leave your name and email empty). We use them only to act on the report and to write back to you about it: straight away with your reference, and again with what we decided, why, and how to appeal. A report is tied to no account, the person you report is never told who you are, and nothing on the page asks you to send us the image — we look at the content where it is. So the page cannot be flooded, we keep a short-lived count against a one-way code made from your internet address and email address, never the addresses themselves. The basis for a report is our legitimate interest in keeping TimePeace safe for the people in it, and the legal obligations we have to act on such reports. Your message and anything you attach are held by Supabase and Cloudflare, both already named above, and are never handed to a third-party help-desk company. A message to privacy@ is logged as a formal data request with its legal deadline attached, so it is answered in time rather than whenever it happens to be noticed. How long we keep it: twelve months after the conversation is closed, everything about you is removed from it — the subject, every word of every message, the address it came from, any file you attached (deleted from storage, not merely unlinked), and the one-way code that ties it to your account. What is left is the bare shape of the conversation — that somebody asked about a thing on a date, and how long we took to answer — which is a record of how WE did and identifies nobody. If you ask us to delete your account, or make a data request, that same clean-up happens straight away instead of waiting out the twelve months. The AI assistant already named above may also suggest a label for your message and draft a reply for a person here to read, change or throw away before anything is sent — it is the same provider under the same terms, it sees only what you wrote to us, and it never sends anything itself. If you write in another language, it may translate your message into English for us and our reply into your language, so a reply may now and then read a little imperfectly — a person here still reads every message and sends every reply.
Where your data lives. Those providers may store data outside your own country — including outside South Africa (permitted under POPIA s72 with contractual safeguards) and outside the UK/EEA (covered by SCCs or adequacy decisions). The protections travel with your data.
When the law compels us to share data. Our default answer to anyone who asks us for your data is no — we do not hand your information to another person, a company, or an authority on request. To a private third party — an ex-partner, an employer, a curious stranger — the answer is simply no, every time, and we will not even confirm whether you have an account. The one thing that changes that answer is a genuine legal obligation: a court order, subpoena or lawful directive issued under South African law by a body with the power to issue it (a foreign authority can reach us only through a recognised legal channel, such as a mutual legal assistance request or a South African court — a letter on a letterhead is not enough). Before we disclose anything, we verify that the demand is authentic, current and specific, we have it reviewed against the law, and we produce only the narrow data the order actually covers — never your whole account, and never anyone else's. Wherever the law allows, we will tell you — ideally before we produce anything, so you have a chance to challenge it — and we stay silent only where a valid order legally forbids us from telling you, reading any such restriction as narrowly as we can. If you have turned on encryption and hold your own key, there is a hard limit on what any order can reach: your private entries are stored scrambled and we cannot read them, so the most we can ever hand over is the unreadable scrambled version, and we say plainly that we cannot open it (switching on the optional key-backup service changes this for you — which is exactly why we tell you so when you turn it on). We keep a record of every request we receive — including the ones we refuse — as evidence that we honoured both our obligations and our limits. A credible emergency involving an imminent threat to someone's life or safety can move on a faster timeline, but the same principles hold: we give only what is strictly needed and tell you afterwards unless the law forbids it. The lawful basis for any disclosure of this kind is our compliance with a legal obligation, never your consent.
When we report child sexual abuse. If we report child sexual abuse material to the authorities, as the law requires, the law then requires us to keep a locked copy of what was reported, and what we hold about the account that shared it, for at least one year, and the reference number of our report for five years, even if the content, the group or the account is deleted in the meantime. Only the people at TimePeace who handle these reports can reach it, it is used for nothing else, and it is erased when those periods end. The lawful basis is our compliance with a legal obligation.
How long we keep things. Your data stays for as long as your account is active, because that is what keeps it available to you. Anything you clear waits in your Trash for 30 days (in case you change your mind), then is deleted. Deleting your account erases what we hold about you straight away, in one step that either finishes completely or changes nothing: your synced diary, backups and history, your encryption keys, your sign-in and notification tokens, your calendar connection, the apps you connected and what they sent, the photos you synced, the feedback you sent us, your AI usage counts and your place in every group and conversation. Your sign-in record follows within 30 days. Messages follow the conversation rather than you: you can delete one for everyone, and what is left is a quiet line saying a message was removed so the thread keeps its shape; leaving a conversation stops anything new reaching you and hides what came after you left; deleting a group deletes its conversations; and deleting your account removes the words you wrote from every conversation, and your reactions, and leaves those same quiet lines behind, so the people you were talking to are not left with half a thread. What you shared with other people: the links you have with other people end, for both of you, exactly as unlinking does, and the other person keeps the ordinary copy already on their own phone. A group you own passes to its longest-standing leader, or else its longest-standing member, so the others keep their space; a group with nobody else in it is deleted; and an invite you made passes to the group’s new owner, so a link already shared keeps working. What we keep after you delete your account, and why: the records of your consent choices, as legal evidence that we honoured them, even after your sign-in record has gone; the record of each payment — what, when, how much and through which store, never card details — for five years, because tax law requires it; the record of any data request you made and how we answered it; a record of what our staff did to your account, and that the deletion happened, with none of your content; if we removed your account for breaking our safety rules, a one-way fingerprint of your email address and of your Apple or Google sign-in — a scrambled code that cannot be turned back into either, and nothing else — so that the same person cannot simply sign up again (write to support@timepeaceapp.com to ask us to lift it); your email address on its own, kept as a do-not-contact note in the system we send email from, so that it can never be emailed again — nothing else about you stays there; and, if someone reported something you wrote, the report, which stays as the group’s safety record with its link to your account cut. Support conversations keep only the bare shape described above. Usage statistics stay only as counts that are no longer linked to you. A block another member placed on you, and a report you made, last only until your sign-in record goes, so the people they protect stay protected in the meantime. Dormant accounts: if an account has not been signed into for 12 months in a row, and it has never held a paid subscription (or any paid period ended more than 12 months ago), we will auto-delete its data, in exactly the same way — we practise data minimisation as POPIA and GDPR require, and holding data we no longer need is something we deliberately avoid. We will send you reminder emails before anything is removed; simply logging in once resets the clock and keeps your memories safe.
Your rights — always. You can see your data, correct it, download it (Settings → Privacy → Download my data), restrict or object to processing, withdraw any permission, or delete everything — and withdrawing is always as easy as granting was. If you are ever unhappy, you can complain to the SA Information Regulator (inforegulator.org.za), the UK ICO (ico.org.uk), or your EU supervisory authority. We respond within one month.
Only the essentials are required. Everything else is optional — and all of it is off by default except usage measurement and, on the iPhone app, the advert measurement that goes with it, which one switch turns off (in the United Kingdom and Europe advert measurement stays off until you say yes; see “How we count usage” and “Measuring our own adverts on iPhone”) — and the app works happily without it: the related features simply rest until you want them. We only ask for a permission when a feature you have chosen actually needs it: if you skip a feature at sign-up it stays off and its permission is never requested, and turning it on later asks you then.
Age — who TimePeace is for. TimePeace is made for people aged 18 and over. When you create an account you confirm you are at least 18 — we ask it as a simple yes, and we never collect your date of birth. Where your phone or app store tells TimePeace your age range (an iPhone or Google Play can), and it says you are under 18, we cannot open the account — and that range is never kept, synced or sent to us. This is the same number in every country. It is our own rule about who TimePeace is for, not a local legal minimum, so it does not move up or down depending on where you are — which is a change: it used to be 13, and higher in some countries. We don't knowingly create accounts for, or keep data from, anyone under 18; if we learn that we have, we delete it.
How we protect it. Your data sits behind per-user row-level security (each account can only ever reach its own rows), travels encrypted, and every account gets the same row-level protection from its first moment. Your consent choices are stored in records that cannot be edited after the fact.
Locking the app on your device. You can set an app-lock — a passcode, and optionally Face ID or Touch ID — that locks TimePeace on the device you set it on, so it asks to be opened when you launch it or come back to it after leaving. This is a lock on your device, separate from your account password: the passcode is kept only on that device, as a scrambled one-way check (the passcode itself is never stored), it is never sent to us and never synced to your other devices, and it collects nothing new — it simply adds a lock over what is already there. It is also separate from encryption above: the app-lock is a quick local gate, while encryption scrambles your data itself. If you forget the passcode we can’t look it up for you — you log out on that device and sign in again to set a new one; your diary is safe in your account throughout. It is entirely optional and off until you set it, in Settings → Privacy & data.
Encrypting your private notes. You can choose to lock your most private entries — your diary notes and reflections, your mood, your wellbeing and "Breaking a habit" details, and the people you write about — with your own key. When you turn this on, those fields are scrambled on your device before they are ever synced, using a key derived from a passphrase only you know; we keep only the scrambled version and a wrapped copy of your key that we cannot open. So we genuinely cannot read those entries — and neither could anyone who breached our systems. In return it is yours to hold: keep your passphrase and the one-time recovery key somewhere safe, because if you lose both, those encrypted entries cannot be recovered by anyone, ourselves included (your account itself stays recoverable). It collects nothing new — it only adds protection — is entirely optional, and rests on your consent when you switch it on.
Photos you share into TimePeace. If you share a photo into TimePeace to keep it beside a note, the image is stored — encrypted — on this device. Unless you switch on Media sync, or you choose to send a meal or recipe photo to be read (below), it never leaves this device and is not part of your sync. It stays with you: you can open it, download it, or delete it whenever you like, and it is erased if you bin the note or delete your account. We keep only a small marker that a photo is there.
Reading a meal photo. If you choose to log a meal from a photo — its own permission, asked the first time — the photo you choose goes through our own server to our AI provider (Anthropic), which lists the foods it can see. Then it lets the photo go: it is never stored by us or by the provider, never backed up or synced, never used to train a model, and no person looks at it. On your phone, the copy made to send it is deleted as soon as the list comes back; the photo itself stays in your photo library. We ask it to describe only the food, never people or places. You check the list — the amounts are estimates, shown as ranges — before anything is saved, and only the list is kept, as what you ate. You can withdraw this permission at any time in Settings → Privacy & data.
Reading a recipe photo. If you choose to add a recipe from a photo — a handwritten card, a page of a book or a printout; its own permission, asked the first time — the photo you choose goes through our own server to our AI provider (Anthropic), which copies the recipe written on it: its name, its ingredients and its steps, as written. It never writes, completes or improves a recipe. Then it lets the photo go: it is never stored by us or by the provider, never backed up or synced, never used to train a model, and no person looks at it. On your phone, the copy made to send it is deleted as soon as the recipe comes back; the photo itself stays in your photo library. You check the recipe before anything is saved, and only the recipe you add is kept. You can withdraw this permission at any time in Settings → Privacy & data.
Media sync — your photos on your other devices, only if you choose. Media sync is its own permission, off unless you switch it on in Settings. If you do, a copy of each photo and keepsake you save — the picture, a small preview, and its width and height, never its file name — is kept on our servers, stored with Cloudflare (named above), so the other devices you sign in on can show it. Each copy is encrypted before it leaves your device, with a key we keep with your account so that any device you sign in on can open it. That means we could open your synced photos; we never look at them, no one at TimePeace opens them, and nothing about a picture is analysed. Synced photos count toward your storage. Turn Media sync off and every copy is deleted from our servers straight away — the photos on your devices stay; delete a photo and its copy is deleted too; delete your account and they are all deleted with it. Leaving Media sync off keeps each photo only on the device you saved it on.
Connecting other apps and your AI. If you turn on Connected apps (off unless you ask for it), apps you approve — including your own AI assistant — can add entries to your TimePeace for you. Each connection is write-only: it can add, it can never read your diary back. You approve every app yourself, you see each one and what it has added in Settings → Connected apps, and you can disconnect it at any time — and remove everything it added. A connection that adds health, people or money entries needs both this permission and that type’s own permission. An app you didn’t approve can never touch your TimePeace, and connecting an app never lets it read your life.
Letting your AI read your TimePeace. Separately from letting an app add to your diary, you decide whether an AI assistant you connect may add only, or add and read. An assistant you connect can only add at first: reading stays off until you turn it on for that assistant in Settings → Connected apps, where you are asked first, and you can turn it off again at any time. With reading on, you can ask your own AI about your own entries. It sees only what you’ve allowed — filtered by your health, people and money permissions — never your whole diary at once, and every read is logged so you have a record. If you’ve turned on encryption, your entries are sealed with your own key and cannot be read on our servers by anyone, including your AI — it is simply told your TimePeace is sealed. You can switch reading off, or disconnect the assistant, at any time. We never run our own AI over your diary to do this; your assistant does the asking, under your grant. With reading on, what your assistant reads is shared with the company that makes it — Anthropic for Claude, OpenAI for ChatGPT — and is handled under that company’s own privacy policy, not ours.
Letting your AI see the people in your life. For each assistant you can also turn on People in Settings → Connected apps: its own choice, off until you turn it on, asked first. Without it, an assistant that reads is never shown your hangouts and catch-ups, because they are about someone else as well as you. With it on and reading on, it can see who your hangouts and catch-ups were with; and, reading or not, it may attach someone already on your People page to an entry it adds. It never adds new people to your TimePeace, and it never sees the people’s own data — only what you wrote about your time with them. What it reads is shared with the company that makes it, as above. Turn People off there at any time.
Letting your AI change things you’ve made. Beyond adding and reading, you can separately allow an assistant you connect to change things you’ve made — but only in the areas you turn on for it in Settings → Connected apps, each asked first: your trips, your workout routines, or your meal plans and recipes, each an independent choice and all off until you turn one on. Every change is checked against what the assistant last read, so if you’ve edited the same detail yourself, your version stays and the assistant’s change to that detail is set aside. Every change is recorded in plain language with what it said before and can be undone, and deleting a whole thing — a trip, a routine, a plan — always waits for your explicit yes. If you’ve turned on encryption, nothing about your things can be changed on our servers by anyone, including your AI — it is simply told your TimePeace is sealed. You can switch any area off, or disconnect the assistant, at any time in Settings → Connected apps.
Key backup. If you have turned on encryption, you can separately choose to switch on an optional key backup: we keep a specially protected copy of your encryption key, sealed so that we alone can never open it — unlocking it always requires you to complete an identity check and a clear, one-time “yes, release my key” action, and we email your account the moment anyone starts a restore, whether or not it was you, with an immutable record kept of every attempt. Switching this on trades a little of your zero-knowledge guarantee for a way back in if you ever lose both your passphrase and your recovery key; leaving it off keeps you fully zero-knowledge, which stays the more private choice and is, and remains, the default. This is its own separate choice: agreeing to it never means you have agreed to anything else on this page, and none of the other permissions here — now or in future — imply it. Key backup is a convenience, offered “as is”: we protect it carefully, but we cannot promise a restore will always succeed, and we are not responsible for loss of, or damage to, a backed-up key; your passphrase and recovery key remain your main way in. Turning key backup off deletes the backed-up copy immediately. The basis is your consent, asked as its own clearly-marked step, separate from encryption itself.
The correlation programme. You can separately choose to join an optional correlation programme. If you do, TimePeace looks across what you already track — on your own device — to build a “correlation footprint”: a de-identified map of what tends to go with what in your life, such as how your sleep, activity or the things you do line up with your mood or energy. Your raw entries never leave your device to build it. You get a personalised report of your own patterns, and a pattern is only ever shown when it is statistically real; TimePeace keeps only the anonymous, de-identified footprint — the identifiable parts are destroyed once the map is built — and those anonymous footprints pool into an aggregate model we use to improve the app and for research. What you share this way is used to improve TimePeace and for research — it is not used to advertise to you; we do not sell or advertise individual-level data outside the company; and only general, aggregate insights are ever published — nothing that identifies you leaves as an individual record. This is its own separate choice, off by default: agreeing to it never means you have agreed to anything else on this page (including key backup), and none of the other permissions here — now or in future — imply it. If you turn the programme off, we stop any further contribution and delete your own footprint and report; but a past contribution that has already been anonymised and pooled in cannot be individually pulled back out, because by design nothing ties it to you any more — we tell you this plainly so the choice is honest. The basis is your consent, asked as its own clearly-marked step. (This is the opt-in “let TimePeace use my data to show me things” side of the promise at the top of this page; the mechanism itself arrives when the feature is switched on for you.)
Feature availability. As part of how we develop and manage TimePeace, we may make different features available to different accounts. This is a standing part of how the service is operated and adjusted during development, and happens on the basis of our legitimate interest in managing and protecting the service. Where your account has different feature availability, the app's Features section will note that some features may not be available to all accounts at this time. This practice affects only which features are visible to you — not the data you have already logged, and not the rights described here.
Using your location. If you turn on the optional Location feature, we read your device's location only while that feature needs it, to do the thing you asked for — resolve which of your own named places (home, work, gym…) you're at, and offer a one-tap log of the moment you arrive or leave. We keep the places you choose to save (a name, a spot, a radius); we do not store or sync your live position, and we never attach your coordinates to your diary. Normally that read only happens while TimePeace is open. If you also switch on “even when the app is closed” — a separate choice, off unless you turn it on, phone app only — your phone watches your 20 nearest saved places and wakes TimePeace when you cross one, so the same offer reaches you with the app shut; it will ask you to allow location Always, and that is all it is for. This widens when we may read where you are, never what we keep: still used in the moment, still never stored, synced or attached to your diary; still only ever an offer; still held to your quiet hours; and only places you named yourself — never a route, never a history of where you have been. One tap turns it off. If you also switch on “remember the kind of place” — a separate choice, off unless you turn it on — TimePeace keeps a private note on your own device of just the coarse kind of place you were at each day (such as “home” or “work”, never a street, an address or coordinates), for up to about six months, so it can show you your own patterns; switching it off clears that note. Commute uses it too, on your phone only: Commute appears only when your position — or one of the places you saved — is inside a city it works in, so nobody is offered train times for a city they are not in. That check is made on your device each time; its answer is never stored or sent to us, and if Location is off or your position is unknown, Commute simply stays hidden. Location is used only for these features once you've switched them on, never for ads and never sold. Turn it off any time and the saved places go with it. The basis is your explicit consent (GDPR Art 9(2)(a); POPIA s27(1)(a)), asked only when you turn the feature on, never proactively.
Checking in to a group's event. This is the one time your location produces something other people can see, and it never happens unless you switch it on. For one group at a time, inside that group, you can turn on checking in. After that — and only then — TimePeace compares where you are to the place and the time window that group's organiser declared for an event, and when both match it records a mark saying that you arrived, at that event, at that time, in that group's shared record, where the group's members can see it. That mark is the whole of what is shared. We do not share a coordinate, a trail, a history of your movements, or where you are at any other moment; nothing is recorded outside a declared place inside a declared window; and no organiser can switch this on for you. Turning it off stops it immediately, leaving or being removed from the group ends it, and you can always remove a mark of your own — you are the authority on a record about you. Saying yes to Location does not say yes to this; it is asked for separately, in the group it applies to. The basis is your explicit consent (GDPR Art 9(2)(a); POPIA s27(1)(a)).
The route of a session you bring in. TimePeace never records where you go, and that has not changed. Routes is its own permission, off unless you turn it on in Exercise settings, and it is never asked for anywhere else. If you turn it on, a run, ride or walk you bring in — from Apple Health on your iPhone, or from a workout file you choose (a FIT, TCX or GPX file) — can keep its route, drawn as a map on that session’s own page and nowhere else. The route that source recorded is read on your phone and turned there and then into the route’s shape: the line fitted into a small box, with no latitude, no longitude, no scale and no starting point kept, so it cannot be put back on a map of the world. Only that shape is kept, sealed on that phone — with your diary’s own key when you use encryption, otherwise with a key that never leaves the phone. It is never synced or backed up to our servers, never put on a share card, shown in your recap or shared with a group, and never sent to an AI. Because it stays on the phone it is not part of your export; the full route stays with Apple Health or the file you brought in. The map is drawn by the app itself: no map service is asked for anything. Apple Health asks you separately before it lets TimePeace read a workout’s route. Turning Routes off — in Exercise settings or in Settings → Privacy — deletes every route kept on that phone at once, and deleting your account deletes them too; a route whose session you delete goes when that session leaves the trash.
Searching for an address. When an event says where it happens, you can type a place and pick it from a list. Turning what you typed into a point on a map is a job we cannot do ourselves, so the words you type are sent to an outside address service — and it is worth being exact about how. The search goes from our server, never from your phone: the address service receives the words and nothing else, and never learns who asked, what device you are on, or where you are. It is an OpenStreetMap-based service, whose data we are required to credit wherever a result is shown. What comes back to you is a short list of place names and their coordinates. We keep recent searches briefly so the same lookup is not repeated, stored against the words rather than against you — there is no record of who searched for what — and cleared after a couple of weeks. This is deliberately different from Location above: it is a place you are looking up, not where you are, and it happens only when you type into that box. If the service cannot be reached we say so plainly rather than pretending the place does not exist, and you can always enter coordinates yourself instead.
Reminders on your device. If you turn on a reminder in the app (Settings → notifications) and you are using the iPhone or Android app, we keep a device notification token — from Apple (Apple’s Push Notification service) on the iPhone, from Google (Google’s Firebase Cloud Messaging) on Android — and the schedule you set on our server so we can send that reminder when the app is closed. On Android, the app does not ask Google for that token until you have switched notifications on. We send only a reminder you asked for, decided by your own schedule and quiet hours — never anything else, and never based on your mood, health, the people you note, your money, or what you wrote. The token is an anonymous device address (not your name or email) and is deleted when you turn reminders off, sign out, or delete your account.
Importing a bank statement. The Money features include an optional statement import with its own permission, off unless you turn it on — we ask the first time you try to import. If you use it, the statement file you upload — and, for a locked PDF, the password you type to open it — goes to our own server, which opens the file just long enough to read out the accounts, balances and transactions inside and show you what it found. The file and any password are discarded the moment that reading is done: they are never stored, never backed up, and no person looks at them. Only the entries you choose to add are kept, in your Money data, exactly as if you had typed them yourself — and you can withdraw the permission any time in Settings, which simply puts the import away.
Talk, the AI assistant. If you turn on Talk (off unless you ask for it), the words you say or type to it are sent to an AI model, which sorts them into suggested diary entries, to-dos and plans, answers questions about the app, and tells the app what to look for or which screen to open — most entries are filed straight away and shown to you with Undo, anything about a trip asks you first, and how much it does on its own is yours to set in Settings; the looking itself happens on your phone. Only the words you send are sent, with what was said earlier in that same conversation so it can follow along (never one you left more than three hours ago); your diary and your history never are. The one thing it learns is from you: when you move a line it filed to somewhere else, your phone keeps that correction as a rule — the words and where you put them — and sends your rules with each sort so it files them your way; you can see and forget every one in AI settings, under How you like things filed. What you send makes your answer and the AI provider then lets it go — never stored there, never used for ads, never sold, never used to train a model. Your Talk conversation itself is kept in TimePeace for 30 days so you can scroll back; clearing Talk’s data in Settings deletes it sooner. Your voice is turned into text by your own device; audio never reaches us. Anthropic (a named provider) runs the AI for us under a data-processing agreement. Switch it off any time and the feature disappears.
Talk’s memory. If you also turn on Talk’s memory — its own permission, asked the first time Talk offers to keep something, and off unless you say yes — Talk keeps the lines you say yes to (each one something you told it; you can see, change or delete every one in What Talk remembers), and your phone works out a short summary of your usual week from what you have already logged. Those lines and that summary are sent with each message so Talk can take them into account; the diary entries the summary was made from are not. When you ask Talk about your own days — when you last saw someone, or whether Friday is free — your phone looks first and sends only what answers that one question: up to eight of the entries, people, notes or plans it found, each with its date and a short line, and its own count of them, or, for a free day, the name and time of what is already on it. That is what lets Talk answer from your life rather than in general; nothing else from your diary is sent. Without Talk’s memory, your phone answers those questions on its own and sends none of it. Nothing from a part of your life whose own permission is off is included, nor anything someone else shared with you. If you seal your diary with your own passphrase, nothing is read from it for Talk — no summary and no entries. The same AI provider handles it on the same terms: used for your answer and then let go — never stored there, never used for ads, never sold, never used to train a model. Switch it off in Privacy & data and nothing more is sent from your next message.
If this policy changes. Any material change — a new purpose, a new kind of data, a new provider — is put to you in the app for fresh consent before it applies. Wording improvements get a new version number, like this one. Every previous version is archived and available on request.