Privacy Policy

When you use TimeSpace, we collect the following data:

• Account data: your email address, used for account creation and login. If you sign in with Google, we only request your email address and display name; we do not access any other Google account data or Google service content.
• User content: the time accounts, calendar events, todos, and related settings you create in the app.
• AI conversations: the prompts you enter when using the AI Time Assistant.
• Device data: device type and operating-system version, used to ensure service compatibility.

If you choose to integrate your device calendar, we will only access system-calendar data after explicit authorisation. Push notifications are scheduled entirely on-device and do not pass through our servers.

• To provide core features such as calendar, time accounts, analytics, and the AI assistant
• To sync your data to the cloud so you can use TimeSpace across devices
• To improve the app and the user experience
• To respond to your support requests

We do not use your personal data to train any AI or machine-learning model.

TimeSpace uses the following third-party services. Each has its own privacy policy:

• Supabase: authentication and data storage (servers located in the United States).
• Google Sign-In: third-party login. We only request access to your email address and display name for account creation and identification. We do not access any other Google service data.
• RevenueCat: subscription management and payment handling.
• Google Gemini: powers the AI Time Assistant. Your conversations are sent to Google for processing.
• Apple App Store: app distribution and payment. Payment information is handled directly by Apple.
• PostHog: product usage analytics (servers located in the EU). We only record anonymized behavioral events and aggregate metrics (e.g. app opens, block creation, analysis views, subscription changes) to help us improve the product. We do NOT send: AI conversation content, event/todo titles or notes, email addresses, or personal names. Analytics data is deleted when you delete your account.
• Sentry: crash and error reporting to help us fix bugs. Crash reports include your user identifier for reproduction purposes, but no operation content.

TimeSpace's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

TimeSpace offers optional Google Calendar integration. When you authorize the Google connection, we access your Google user data solely for the following purposes:

• Display your calendar events: render Google Calendar events inside TimeSpace so you can categorize them into time accounts and view analytics.
• Two-way sync of event changes: when you edit, create, or delete events in TimeSpace, propagate those changes back to your authorized Google calendars so both sides stay consistent.

We request the following Google API scopes:

• calendar.calendarlist.readonly: list your calendars so you can select which ones to sync.
• calendar.events: read and write events in the calendars you selected, powering display and two-way sync.

Limited Use Disclosure — Google API Services User Data Policy:

TimeSpace's use and transfer to any other app of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide or improve user-facing features you explicitly authorized (displaying and syncing your calendar events).
• We do not transfer Google user data to any third party except as necessary to provide or improve those features, to comply with applicable law, or with your explicit consent.
• We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• We do not allow humans to read your Google user data unless we have your affirmative agreement, it is necessary for security purposes (e.g. investigating abuse), to comply with applicable law, or the data is aggregated and used for internal operations.
• We do not use Google user data to train any AI or machine-learning model.

Storage and deletion: so you can see the same calendar content on both the web app and the mobile app, we store the necessary Google Calendar event fields (title, times, description, attendees, event id, calendar id) encrypted in our Supabase database. You can disconnect the Google integration at any time from the app settings — all events synced from that Google account are immediately deleted from our database. When you delete your TimeSpace account, all related data is permanently deleted as well.

Stored OAuth refresh tokens are server-side only, never sent to clients, and protected by column-level database permissions.

We do not sell or rent your personal data. We will not share your data with third parties except: with the service providers listed above (only as needed to operate the service); to comply with legal requirements or lawful requests from authorities; or where necessary to protect the safety of TimeSpace and its users.

We use industry-standard encryption (TLS/SSL) to protect data in transit and store passwords as hashes. We retain your data while your account exists. You may delete your account at any time from within the app; once deleted, your personal data is removed from our production databases.

TimeSpace is not intended for children under 13, and we do not knowingly collect personal data from children. If you become aware of such a case, please contact us using the details below and we will act on it promptly.

If we make material changes to this policy, we will notify you in-app. Continued use of the service constitutes acceptance of the updated policy.

For any questions, or to exercise rights of access, correction, or deletion, please contact us:
holoken05@gmail.com