Privacy Policy

Who we are, and who this is for

The Problem Calendar is made by [COMPANY NAME AND ADDRESS]. You can reach us at support@theproblemcalendar.app.

It is for adults aged 18 or over. You confirm that when you create an account.

What we keep, and why

Your account: your email address, the name you give (if you continue with Apple or Google, the name and email address they share with us, and nothing else from them), your password (kept only in a protected form by our sign-in provider) and your language. A profile photo, only if you add one: it is stored privately, shown only to you and your connected partner, and deleted when you remove it or delete your account. When we ask you to confirm your address, or you forget your password and ask for a link to choose a new one, your email address is sent to the service that delivers that email, for that and nothing else.

What you write: moments (the words, the kind, up to three feelings, a note for next time, and your answers to the optional reflection questions and to the questions an AI asks in a private reflection, which only you can ever read), your optional answers to the preference questions, what you prepare for a check-in, and agreements you make with your partner. We keep these so the app can show them back to you.

Your connection: that you and your partner are connected, the name you choose to show them, your agreed rhythm for check-ins, any single check-in you agreed to move, and a change either of you has suggested while it waits for the other to answer. An invitation code is stored only as a one-way fingerprint, and stops working after 48 hours or one use. The invitation link you share is an address on our website and also carries your first name, so that it can greet your partner by it. The code and the name are in the part of the address that the browser keeps to itself: our website never receives or stores them. Anyone who holds the link can read them.

Your choices: whether AI may process anything, the time you chose it, and, for each moment, the scope you gave it.

On your phone only: an unsent draft, your light or dark choice, which reminders you turned on, which agreements you paused reminders for, and the reminders themselves. Reminders are scheduled on your phone. Nothing about them is sent to us.

A count of AI requests (the kind and the time, never what was in them), so that we can keep a daily limit.

An AI summary of a check-in, if you both asked for one: the summary itself (so you can both read it), and whether each of you said yes to it for that check-in.

While you talk a check-in through together: which question you are on, whose turn it is to share, whether it is paused or has ended, and the latest moment each of you had it open (replaced each time, never a history). Nothing you write in a note or say is kept. It is deleted with the check-in.

How a check-in left you, if you choose to say: a short answer to each of two questions and an optional note of up to 300 characters. Only you can read it. Your partner never can. It is deleted with your account.

On Our journey, either of you can offer to have AI write a short summary of what you chose to share and agree. It is made only if you both say yes, separately, each time; either of you can take your yes back before it is made, and making one uses both yeses up. Then the dates of the check-ins you held (never what was said in them), the wording of your agreements and whether they are open, completed or let go, and the appreciation you both shared, with your language, are sent through our servers to Anthropic. A private moment, answer, note or draft is never sent, and neither is anything only one of you approved. The summary is shown to you both and kept until either of you removes it, takes back an appreciation or words it may have used, or deletes their account; if either of you disconnects, neither can read it. Your partner can see whether you said yes, and nothing else about your AI choice. Narrowing or switching off AI withdraws your yes at once.

Whether you have stepped out of shared check-ins, and whether it is a pause or because you don’t feel safe. Only you can read this. Your partner is told only that check-ins are paused, the same either way, and never why. Your private journal is not affected. It is deleted with your account.

How an agreement has been going for you, if you choose to reflect on it: your answer and an optional private note, which only you can read, and one sentence you may choose to bring to your partner, which they can read only once you have both finished and which you can take back. Your partner is never told that you wrote an answer or a note. An appreciation you choose to share outside a check-in: your words (up to 200 characters), whether it is a thank-you or something you both noticed, and when. A thank-you is readable by your partner as soon as you share it. Something you both noticed is readable by your partner only so they can say yes or not now, and is added only if they agree. You can take back anything you shared.

On our website, before the app is available: if you ask us to email you when it is, and then confirm with the link we send, we keep your email address, the wording you agreed to and where on the page you signed up. Nothing is kept if you do not confirm; until then, the link itself carries your request, encrypted, and we store nothing. We use the address for one email when the app is available on iOS and Android, and nothing else. [LAUNCH UPDATES CONSENT AND WORDING: to be confirmed with counsel before the sign-up is switched on.]

What your partner can see

Nothing you write is shared unless you decide it is. Your moments, your answers and your drafts are private to you, and the database refuses any request from your partner for them.

At a check-in, your partner can read only what you approved and were ready to share, and only once the check-in has started. Before that they can see only that you are ready. While a check-in is going you can take back any of your words, or step out of it, and they stop being readable at once; your partner is not told why.

You and your partner can each choose to show a small dot on the days you write. A dot appears only when you have both chosen yes. It marks a day on which a moment was added, including a moment only its author can see, and shows the day only: never the words, the kind or a feeling.

An agreement is shared by its nature: your partner sees it as soon as you propose it, and you both see how it changed.

For each check-in, your partner can see whether you said yes to an AI summary of it, because the summary uses both of your words. They cannot see any other AI choice you make.

When you talk a check-in through together, the two of you share only its controls: the question, whose turn it is, a pause, the end, and whether the other of you has it open right now. Leaving ends it for both of you, and your partner is told that it ended, not who ended it or why.

If you pause shared check-ins or turn them off, nothing you prepared can be read and no check-in starts until you come back. Your partner sees that check-ins are paused, not whether it was a pause or a choice about your safety.

If your partner disconnects, you are told once, by the name they chose to show, that they did. You are not told when or why. You can disconnect on your own too, and your partner is then told the same. If your partner deletes their account, you are told once that they did, without their name, and not when or why. If you delete yours, your partner is told the same.

An appreciation you share outside a check-in is read by your partner: a thank-you at once, in your exact words, and something you both noticed only after they agree. If they say not now, it is deleted and you are not told. You can take back anything you shared. If your partner disconnects, what was already shared stays with the one who stays, and a suggestion that was still waiting is hidden. A sentence you brought to your partner from a follow-up is not read by them after you disconnect.

If your partner turns on updates, their phone may show a short notification when you are ready for a check-in or when you suggest a new rhythm. It holds no name and no words of yours, and says only what the app already shows them. If they have not turned updates on, nothing is sent. You are never told whether they did.

AI

AI is off unless you turn it on. You give your permission once, in Settings (the first time you pick an AI option for a moment, you are taken there after saving), and then choose for each moment, up to that level. Until you have given it, a moment keeps the option it already had (“Only me” for a new moment), and the screen you are taken to says which option you asked for and what the moment is until you choose. You can revoke it anytime, which stops all processing at once.

When you ask for a private reflection, the words of that moment, its kind and feelings, your language and your preference answers are sent through our servers to our AI provider, Anthropic, to write questions for you. Your partner never sees them or the result. We do not keep a copy of what was sent. The questions that came back are kept on your phone only, until you ask again or change the moment. If you answer a question and save, that question is kept with your answer in your journal, where only you can read it; you can edit or remove it, and it is deleted with the moment and with your account. Choosing to bring an answer to a check-in shares nothing: it is offered as a talking point that you read, change and approve first.

You can switch AI off at any time in Settings. That stops all AI processing at once, including for moments you allowed earlier.

[PROVIDER RETENTION AND TRAINING TERMS: to be confirmed against the provider’s current terms before launch.] The app tells you the provider does not use your text to train models. That must be true when this policy takes effect.

AI can be wrong. It is a tool for reflection and communication, not therapy, a diagnosis or emergency support.

An AI summary of a check-in is made only if you both said yes for that check-in before it started, and only after it starts. Then the words you each approved and were ready to share, with a label for which of you wrote each (not your names), and your language, are sent through our servers to Anthropic to write it. We do not keep a copy of what was sent. We keep the summary, because you both read it. It is shown only while you are both connected, it is deleted if either of you deletes your account, and it is never made for words you did not approve. If what was shared sounds as though someone may be unsafe, no summary is made and support is offered instead.

When you ask for a draft of something to bring to a check-in, the words of the one moment you choose, its kind and feelings, and your language are sent through our servers to Anthropic to propose a short wording. Only you see it. Nothing is saved unless you keep it as a draft, and your partner sees it only if you approve it and say you are ready. We do not keep a copy of what was sent. Your partner is not told that a draft began with AI.

When you ask for a clearer version of an agreement you are writing, only the two fields you have typed (what we are trying, and what each of us will do) and your language are sent through our servers to Anthropic to suggest a wording. Nothing about your partner, and nothing else you wrote, is sent. It is only done when you tap, only while your AI choice allows it, and the suggestion is shown to you and kept nowhere. Your partner sees only what you choose to send them as an agreement.

When you and your partner have both finished following up an agreement, either of you can offer to have AI suggest one question to start from. It is made only if you both say yes, separately, for that review; either of you can take your yes back before it is made. Then the agreement’s wording and the one sentence each of you chose to share (never your private answers or notes, and without saying who wrote which) and your language are sent through our servers to Anthropic. The question is shown to you both and kept until either of you changes what you shared, until the agreement is closed, or until either of you deletes your account. Your partner can see whether you said yes, and nothing else about your AI choice. Narrowing or switching off AI withdraws your yes at once.

Where it is kept

Your information is stored with our database and sign-in provider, Supabase [REGION]. It is protected in transit by encryption [CONFIRM details with the provider].

Access is controlled in the database itself, so that each person’s information can be read only under the rules described above.

Purchases: if you subscribe to Premium, the app store (Apple or Google) takes the payment and our subscription service, RevenueCat, receives your random account number, what you bought, when it renews or ends and whether it is a trial. It receives no name, email address, journal text, answer or AI text. We keep only that you are covered, until when, and how many free AI uses are left. When you set the welcome plans aside, a free trial of Premium starts by itself: it needs no payment, covers you and your partner, and ends on its own date without charging anything. If you pay, Premium also covers the partner you are connected to, for as long as you are connected; they are told only that Premium is on, not who pays. Deleting your account does not cancel a store subscription: cancel it in your store account.

Notifications: if you turn on updates from your partner, or news from us, your phone’s random notification address (a device token) is kept with your account, with which of the two you chose and the date you last opened the app. It is removed when you turn both off, when you sign out, when you disconnect from your partner (for updates), and when you delete your account. Notifications are delivered by Google (Firebase Cloud Messaging) on Android and Apple (Apple Push Notification service) on iPhone, which receive that address, the short fixed text of each notification and when it was sent. The text never holds a name, a word you wrote, an answer or a feeling. [MARKETING CONSENT AND NEWS WORDING: to be confirmed with counsel before any news is sent.]

Launch updates from our website: the email address you confirm is kept by our email provider, Resend, which also sends the confirmation and the one email when the app is available. To keep automated sign-ups out, the form uses Cloudflare Turnstile, which checks your browser when you submit; your network address is used only for that check and for a limit on how often a form can be sent, and is not kept by us.

Analytics, crash reports and advertising

At present the app sends no analytics and no crash reports. If that changes, events will carry only identifiers, choices and counts, never your words, and this policy will be updated first.

What you write is never used for advertising.

How long we keep it, and deleting it

You can export what we hold about you from Settings, and delete your account from Settings. Deleting removes your account and what you wrote, including your contributions to check-ins. The check-in rhythm, check-in reviews and AI summaries you shared go with it. Agreements you made with your partner stay with your partner, because you wrote them together. [RETENTION PERIODS AND BACKUPS: to be confirmed with counsel and the provider.]

If you disconnect from your partner, you each keep what you wrote. What you made or shared together (the agreements, shared appreciation and check-in material) is no longer shown to the one who leaves. The one who stays can still see it until they connect with someone new; then it is closed to them too, and a later partner never sees it.

An AI summary of a check-in is deleted when either of you deletes your account, or takes back words it used. If you disconnect, neither of you can read it any more.

Launch updates: we delete the list once the email saying the app is available has been sent. You can unsubscribe at any time with the link in that email, or by writing to support@theproblemcalendar.app, and we remove your address.

Your choices and rights

In the app you can see, correct, export and delete your information, and withdraw any AI choice. [RIGHTS AND HOW TO USE THEM IN YOUR JURISDICTION: to be completed by counsel.]

Children

The app is not for anyone under 18.

Changes

If we change this policy we will tell you in the app before the change applies. [EFFECTIVE DATE]