Privacy policy

When you create an account, we store your email address and display name. If you sign in with Google, we also store your Google profile photo. We store the notes, tasks, finance books, health logs and settings you create. A health log can hold sensitive details, such as periods, sex (and whether it was protected) and medicines; turn on end-to-end encryption to keep them unreadable to us.

We use this only to run the app: to sign you in, keep your data and let you share it. We don't sell your data or use it for advertising.

Everything is stored with Google Firebase (Authentication and Cloud Firestore) and is covered by Google's security and privacy practices. So the app works offline, each browser you use also keeps a copy of your items (encrypted items stay encrypted) and of an entry you were typing and hadn't saved; for an encrypted book, that draft is kept only until the tab closes. Signing out deletes them from that browser.

With end-to-end encryption (offered when you sign up, and available to everyone in Settings), the content of your notes, tasks, finance books and health logs is encrypted on your device before it is saved, with keys only you and the people you share with hold. We and Google can't read it. What the app needs to work stays readable: who an item belongs to, who it is shared with, when it changed, and how many months a finance book's entries span (never which months). If you lose both your passphrase and your recovery code, nobody can recover your encrypted data.

Receipt scanning, quick add, dictation, note helpers and task list helpers are optional. Only when you use one is what you chose sent to Google’s Gemini (through Firebase AI Logic): a receipt photo, the text you typed or pasted, a voice recording you made, or the note’s or task list’s title and text, even for end-to-end encrypted items. Google may keep it and use it to improve its services. We don’t store what is sent; what you add or change is stored like anything else. You agree to this once, before the first use, and can take it back in Settings → Account.

When you share a note, task, book or health log, the people you invite can see its content (their invitation shows its title), and it is added to their lists only if they accept. Others can find you by your exact email address to share with you; they then see your name and photo. Nobody can browse a list of users. If you block someone, they can't invite you any more; your list of blocked people is private and they aren't told.

Push notifications are off until you turn them on for a device in Settings. Your browser's push service (Google, Apple or Mozilla) then gives that device an address, which we store on your account with a key made on the device. When someone invites you, or a health reminder or medicine dose is due, our server (Google Cloud Functions) sends a notification to your devices and to the people a health log is shared with (a fertile window reminder goes only to the log's owner, unless they choose to include them). The text, such as an item's title or a medicine's name, is encrypted on the sender's device for each receiving device, so we and the push service can't read it. What the server does see is the time of each upcoming reminder and who it goes to. Turning notifications off for a device deletes its address and key.

We use Google Analytics for Firebase to understand how the app is used, for example which pages are opened. It collects usage and device information, never the content of your items.

To keep out abuse, the app uses Firebase App Check with Google reCAPTCHA, which checks that requests come from this app using signals from your browser.

The home page has videos hosted on YouTube. They load only when you press play or choose a story, from YouTube's privacy-enhanced mode (youtube-nocookie.com); YouTube's own privacy policy then applies to them.

To get a copy of your data, or to delete your account and everything in it, email mail@ardeman.com.