Privacy policy

The short version

TimeBud is a planner with an AI assistant called Bud. This page explains what we collect, why, and what you can do about it.
We collect what we need to run your planner. Nothing more.
AI features stay off until you agree to the AI notice. You can turn them off in Profile any time.
We don't sell your personal information. We don't show ads.
Our staff don't read your content. The only exceptions: you ask us for help and agree, we need to for security, or the law requires it.
You can delete your account yourself, in the app: Profile, then Delete account.
Questions? Email hi@usetimebud.app.

Who we are

TimeBud is operated by Sora Bon, Montréal, Québec, Canada.

Sora Bon is also our privacy officer. That is the person in charge of the protection of personal information under Québec's Law 25 (the Act respecting the protection of personal information in the private sector). You can reach the privacy officer at hi@usetimebud.app.

This policy covers the TimeBud website (usetimebud.app), the web app (i.usetimebud.app) and the TimeBud iOS app.

What we collect

What you give us

Account: email, display name, an optional avatar, your time zone, and how you sign in (email, Apple or Google). If you sign in with Google, Google gives us your basic profile data: your email and name.
Work content: missions, objectives, jobs, notes, due dates, repeats, focus runs and their timings, completions and XP.
Bud chat history: one thread per account. You can clear it any time.
Captures: text, and voice clips. A voice clip is deleted once it has been transcribed and your capture is filed. We keep only the text. If a clip is left over, for example after a failed capture, we delete it within 24 hours.
Feedback messages: with the app version and your device.
Waitlist sign-ups: your email, the consent text you saw, the time, and a hashed IP address.
Your choices: consent records (AI, marketing, analytics), each with the text, version and time. Also your notification settings, and your confirmation that you meet the minimum age, with the time.

What we collect as you use TimeBud

Calendar data, if you connect a calendar. See "Google Calendar" and "Apple Calendar" below.
Device data for notifications: push token, platform, app version and OS.
AI usage records: tokens and cost for each AI call. We use them for credits and abuse limits.
Security logs: IP addresses are stored only as a salted hash, for rate limiting.
Error reports (Sentry), so we can find and fix crashes.
Product analytics (PostHog), if allowed. See "Analytics and error reports".

Payments

Billing records: your Stripe customer and subscription status, and Apple transaction IDs. We never see or store card numbers. Stripe and Apple hold those.

A note about your notes

You can write anything in your notes and chat. TimeBud doesn't ask for sensitive details, such as health information. If you choose to write them, you are asking us to process them to give you the service. We treat them like the rest of your content.

Why we use it

We collect and use your personal information with your consent, or where the law allows it without consent (for example, to run a service you asked for). We use it to:

run your account and your planner;
give you Bud and other AI features, if you agree;
connect your calendar, if you choose to;
take payments and keep records;
send sign-in links, receipts and payment emails;
send notifications you opt in to, and marketing email if you say yes;
keep TimeBud safe and fair (rate limits, abuse limits and security logs);
find and fix errors;
understand which parts of TimeBud are useful, if analytics is allowed;
answer your support requests and read your feedback;
manage the waitlist;
meet our legal duties.

AI features (Bud)

Bud uses Anthropic's Claude to plan with you, split goals into jobs, file quick captures and answer chat. Voice clips are transcribed by OpenAI (Whisper).

It starts off. AI features stay off until you agree to the AI notice. We store your agreement with the notice's text, its version and the time. If we change the notice, we ask you again. You can turn AI off in Profile any time. Planning, runs and timers work without it.

What we send to Anthropic:

mission and job titles
notes, chat and captures
the plan for the day, which includes busy times from your calendar (no titles) and the titles of events in the TimeBud calendar

What we send to OpenAI: your voice clips, to be transcribed.

What we never send: your password, your payment details or your email.

Training and retention. Anthropic and OpenAI do not use the data we send them to train their models. We have turned training off in our accounts with both. They keep the data only as long as needed to provide and secure their service, under their terms. See Anthropic's privacy policy and OpenAI's privacy policy.

AI can be wrong. What Bud suggests is not professional advice. You decide. Bud asks before deleting anything. You can undo changes: the undo option that appears after a change lasts 10 seconds, and changes made in chat can be undone from the chat for 7 days.

Automated decisions. Bud suggests, and you decide. TimeBud doesn't make decisions about you with legal or similarly significant effects using only automated means. Only a person (an admin) can suspend an account. Two automatic limits exist: a daily cap on AI cost, which pauses AI features until the next day, and rate limits, which make you wait a short while. Neither blocks your account.

Google Calendar

Connecting Google Calendar is optional. TimeBud works without it.

What TimeBud accesses, and why

When you are busy. For the calendars you choose, TimeBud reads only the start and end of busy periods, from 24 hours ago to 8 days ahead. It does not read the title, description, location or guests of events in those calendars. We use these times so your plan never puts a job where you are already busy.
Your list of calendars. TimeBud reads the names and IDs of the calendars in your Google account, and the time zone of your main calendar. We use this to know which calendars to check, to let you choose which ones count as busy, and to set the time zone of the TimeBud calendar.
A calendar called "TimeBud". TimeBud creates one new calendar in your Google account called "TimeBud". It writes your planned jobs there as events: the job name, its start and end, and the mission name as the description. It updates them when your plan changes and removes ones you no longer need before they start. TimeBud also reads the events in this calendar, including the titles of events you add there yourself, so you can reserve time for a mission. TimeBud does not create, change or delete events in any other calendar.
Your Google account email. We read it once when you connect and show it in TimeBud's settings, so you know which account is linked.

What we store, and how

Google's access and refresh tokens. We encrypt them (AES-256-GCM) before saving them, and only our servers can read them. They are never sent to your browser or phone.
The names and IDs of your calendars, and which ones you count as busy.
Busy start and end times for the current window, without titles.
The titles and times of events you add to the TimeBud calendar, and a record of the planned events TimeBud wrote there.
The email of the connected Google account.

All data travels over encrypted connections (HTTPS). It is stored in our database, hosted by Supabase in the United States (West). Supabase encrypts the data at rest (AES-256) and in transit.

How long we keep it

TimeBud refreshes your busy times and TimeBud-calendar events about every 15 minutes. Each refresh replaces the previous copy, so we keep only the current window: 24 hours back to 8 days ahead.
Calendars you remove in Google are removed from TimeBud at the next refresh.
The record of planned events, your calendar choices, and the missions you linked to TimeBud-calendar events are kept while Google Calendar stays connected.
All of it is deleted when you disconnect Google Calendar or delete your TimeBud account. Copies in our backups are deleted within 90 days.

How we use it

We use Google Calendar data only to build and show your plan, keep the TimeBud calendar up to date, send the calendar alerts you turn on, and show your connection status.
We do not sell it.
We do not use it for advertising.
We do not use it to train AI models, ours or anyone else's.
People at TimeBud do not read it, except when you ask us for help and agree to it, when it is needed for security, or when the law requires it.

Who else receives it

Service providers that run TimeBud: Vercel (hosting) and Supabase (database). They process the data only to run the service.
Our AI provider, Anthropic, only if you turn on AI features. When you ask Bud about your day, Bud reads your plan for that day. The plan includes the start and end of busy periods (no titles) and the titles of TimeBud-calendar events you linked to a mission. This is sent to Anthropic only to answer you. Anthropic does not use it to train its models, and keeps it only as long as needed to provide and secure its service, under its terms. No other Google Calendar data is sent to an AI provider.
Notification services, only if you turn on "When a block starts". The alert shows the title of the TimeBud-calendar event (up to 50 characters). It is delivered through Apple Push Notification service, your browser's push service, or email through Resend.

We share Google Calendar data with no one else, except when the law requires it or as part of a merger or sale of the business, and in that case only after asking you first.

How to stop access

In TimeBud: go to Profile, then "Calendar and alerts", then Google Calendar, and choose Disconnect. TimeBud gives up its access at Google and deletes all the Google Calendar data it stored. The "TimeBud" calendar stays in your Google account; you can delete it in Google Calendar.
In your Google account: go to https://myaccount.google.com/permissions and remove TimeBud. TimeBud can then no longer reach your calendar. The data it already stored stays until you press Disconnect in TimeBud or delete your TimeBud account.

Deleting your account deletes all your data, including everything above, and revokes TimeBud's Google access.

Limited Use. TimeBud's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Apple Calendar (iPhone)

On iPhone, you can let TimeBud use Apple Calendar.

TimeBud reads your calendar on your device as busy times only. It never reads event titles.
Only the busy start and end times are sent to us. Titles stay on your device.
We use these times the same way as Google busy times: so your plan never puts a job where you are already busy. When AI is on, the plan Bud reads can include these busy times, without titles.
Busy data is a rolling window, from 24 hours back to 8 days ahead.
You can turn off calendar access any time in your iPhone's Settings.

Who we share it with

We use these providers to run TimeBud. Each one gets only what it needs for its job.

Provider	What it does for us	Where
Supabase	Database, sign-in, file storage	United States (West)
Vercel	Hosting	United States
Anthropic	AI (Claude)	United States
OpenAI	Voice transcription (Whisper)	United States
Stripe	Web payments	Worldwide, under its own policy
Apple	App Store payments, Sign in with Apple, push notifications	Worldwide, under its own policy
Google	Sign in with Google, Google Calendar if you connect it	Worldwide, under its own policy
Resend	Email delivery	United States
PostHog	Product analytics	EU servers
Sentry	Error reports	EU servers (Germany)

We also share information when the law requires it, to protect people's safety or our rights, or with our lawyers and accountants under a duty of confidentiality.

If TimeBud is ever sold or merged, we will tell you before your information moves and before a different privacy policy applies to it.

We don't sell personal information. We don't share it for advertising.

Where your data goes

TimeBud is based in Québec, but our providers work elsewhere. Most are in the United States. PostHog and Sentry use EU servers. So your information may be processed outside Québec and Canada. Those places have different privacy laws, and authorities there may be able to access data under their laws.

We protect it like this:

Our providers process your personal information on our behalf, under their data processing terms, and only to provide their service.
Data travels over encrypted connections (HTTPS).
We send AI providers only what is listed above, never your password, payment details or email.

Analytics and error reports

We use PostHog for product analytics, on EU servers. It helps us see which parts of TimeBud are useful. We use Sentry, also on EU servers (Germany), to find and fix errors. A Sentry report includes the error type, message and stack trace, the page or route, the app version and environment, and an anonymous technical context. It leaves out user details and AI text. We don't send your content, cookies or request bodies to Sentry.

What PostHog records. Only events we name ourselves. We don't record sessions, and we don't use automatic click capture.

On the web

For visitors in Canada, the EU, EEA, UK and Switzerland, analytics is off until you say yes on the cookie banner.
Elsewhere, analytics is on, and you can turn it off in "Cookie settings" in the site footer.
If your browser sends the Global Privacy Control (GPC) signal, we treat it as a "no" to analytics, and we don't show the cookie banner.

In the iOS app

Devices set to Canada, the EU, EEA, UK or Switzerland are asked once. Analytics is off until you tap "Yes".
Everyone has a "Usage analytics" switch in Profile.

When you are signed in, your choice is also saved to your account. See our Cookie policy for details.

Email and notifications

Marketing email. We send product news only if you say yes. We ask once, after onboarding, and it is off by default. We send at most one a week. Every email has a one-click unsubscribe link and our postal address. You can also switch it off in Profile, under Announcements.

Transactional email. We send sign-in links, receipts, payment problems and waitlist confirmations as needed. You can't unsubscribe from these while you have an account, because you need them to use the service.

Notifications. You choose each type: morning brief, block starting, due tomorrow, run left open, and announcements. You can set quiet hours. A "block starting" alert shows the title of the TimeBud-calendar event, cut to 50 characters.

How long we keep things

Account data: until you delete your account.
Deleting your account: sign-in is blocked at once. We then remove your data in the background, usually within minutes, and in any case within 30 days at most.
Backups: kept up to 90 days, then deleted.
AI usage records: kept after deletion, but without your user ID. They no longer identify you.
Billing records: kept as long as tax law requires.
Calendar busy data: a rolling window, from 24 hours back to 8 days ahead.
Bud chat history: until you clear it or delete your account.
Voice clips: deleted once transcribed and your capture is filed. We keep only the text. A clip left over, for example after a failed capture, is deleted within 24 hours.
Feedback, security logs, error reports and analytics: until you delete your account. Some providers delete sooner under their own retention rules (for example, error reports). When that happens, the shorter time applies.
Waitlist sign-ups: until you ask us to delete your sign-up, or you unsubscribe. You can do either any time.

Deleting your account

In the app, go to Profile, then Delete account. This:

cancels a web subscription right away;
revokes Google and Apple sign-in, and calendar access;
removes stored files and all your personal data.

An Apple subscription must be cancelled in your Apple settings. The app shows how. See Delete your data for the steps.

How we keep it safe

Data is encrypted in transit (HTTPS) and at rest in our database (AES-256).
Google Calendar tokens are encrypted at rest (AES-256-GCM).
Database access controls make sure each user sees only their own data.
Admin access needs two-factor authentication.
We store IP addresses only as a salted hash.

No system is perfectly safe. If a confidentiality incident puts you at risk of serious harm, we will tell you and the authorities as the law requires, and we keep a record of incidents.

Your rights

You can:

Access your data and get a copy. Email the privacy officer.
Correct it. Do this in the app.
Delete it. Do this in the app (Profile, then Delete account).
Withdraw your consent any time, with the AI, marketing and analytics switches.
Take it with you (portability). Ask the privacy officer for your data in a structured, commonly used format.

If you live in a US state with a privacy law, you have similar rights. We don't sell personal information or share it for targeted advertising, so there is nothing to opt out of. We honour the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as a "no" to analytics. We won't treat you worse for using your rights.

To use a right, email hi@usetimebud.app. We may need to check it's really you. We answer within 30 days.

Complaints. You can complain to:

the Commission d'accès à l'information du Québec (cai.gouv.qc.ca);
the Office of the Privacy Commissioner of Canada (priv.gc.ca).

We'd like to fix things first, so please write to us too.

Age

You must be at least 13 to use TimeBud. If you live in Québec, you must be at least 14.

When you sign up, you confirm that you meet this age. If you already had an account, we ask you once. We record your confirmation and the time.

TimeBud has no parental-consent flow. So if you are below that age, you may not use TimeBud. If we learn that someone is below it, we will close the account and delete the data. Parents or guardians can write to the privacy officer.

Changes to this policy

If we make an important change, we will tell you by email or in the app before it takes effect. If we change the AI notice, Bud asks for your agreement again before it uses AI. The "Last updated" date at the top always shows the latest version.

Contact

Sora Bon, privacy officer TimeBud, Montréal, Québec, Canada hi@usetimebud.app