Privacy Policy

Trueday's core planning runs on your iPhone or iPad and works without an account. Features you choose to enable, including cloud sync, dictation, weather and product analytics, can send data to the providers described below. Product analytics is off by default; session replay and revenue sharing have separate controls. The app contains no advertising SDKs, and we do not sell personal information.

Your tasks, events, locations, goals and profile are stored locally for core planning. Optional features may send the data described in this policy even without an account, such as coordinates for route estimates or weather and audio for Apple's speech recognition when on-device recognition is unavailable. If you create an account, we process your email address, display name, user identifier and authentication details. Collaboration can sync shared lists, tasks, comments, assignments, friend relationships (your in-app social graph), presence status and moderation reports.

Device permissions are optional, requested for the features that need them, and can be withdrawn in iOS Settings → Privacy & Security. These descriptions summarize their purposes. Optional app analytics and weather-sharing choices are controlled separately inside Trueday.

• Location (while using the app) — calculates travel times and supports location-based scheduling. Weather requests require a separate device-local choice to share coordinates with MET Norway; location permission alone does not enable them.
• Location (background) — used only for arrival reminders at places you have saved. It is not used for tracking, profiling, or advertising, and no location history is retained on our servers.
• Calendar (full access) — reads your existing events so Trueday does not schedule over real commitments.
• Calendar (write access) — writes your Trueday plan back into your calendar. Pro only.
• Reminders — imports your existing reminders and converts them into scheduled tasks.
• Notifications — sends task reminders and tells you when your schedule changes.
• Face ID — unlocks App Lock. Biometrics are handled entirely by iOS; Trueday never receives your face or fingerprint data.
• Microphone — active only while you hold or tap to speak to the assistant. Audio is not recorded to a file, not stored, and not synced.
• Speech recognition — converts your spoken request into text so you can review it before any action runs. Recognition runs on your device where your device and language support it; where they do not, iOS sends the audio to Apple for transcription.
• Health (read) — reads sleep analysis, workouts and step count only, to adjust today's energy curve on your device. See the health data page below.
• Health (write) — Trueday declares this string but never requests write access: it adds nothing to your Health app and changes nothing in it.

By default your data lives in a SwiftData database on your device, protected by iOS Data Protection, with authentication tokens held in the iOS Keychain. Cloud sync is optional, requires an account, and is a Pro feature. When it is on, your tasks, events, locations, profile, goals and scheduling data sync through our hosted Postgres database over TLS. Row-level security policies control access to account data and allow explicitly authorized collaborators to access shared content. Trueday does not use iCloud or CloudKit.

We keep this list short on purpose. These are the only third parties that can receive your data, and what each one receives:

• Supabase — provides account authentication and optional cloud sync of planning data. Collaboration can also send shared lists, comments, friend relationships, presence status and moderation reports. If a signed-in user enables product analytics, receives allowlisted usage events linked to that account.
• PostHog — after product analytics opt-in, receives allowlisted events under a random account identifier and a random app-instance device identifier, plus app version, device model and operating system information. Separately enabled session replay, revenue sharing and voluntary survey responses are described below.
• Apple — handles all purchases through StoreKit, and provides device services including Calendar, Reminders, Maps and speech recognition. Trueday never sees your payment card details.
• Apple Maps — receives coordinates to calculate travel time estimates when you use location features.
• MET Norway — after you explicitly enable Weather-Aware Outdoor Tasks on this device, receives precise latitude and longitude rounded to four decimal places, plus the request IP address, for weather forecasts. Requests identify Trueday through a User-Agent. General location permission or a restored scheduling preference alone does not enable weather sharing. Turning the feature off stops new weather requests. Weather data from MET Norway, adapted by Trueday, licensed under CC BY 4.0 (creativecommons.org/licenses/by/4.0/).
• Resend — delivers transactional and newsletter email if you opt in. Receives your email address.
• Google Analytics and Intercom — used on this website only, after you consent. They are not present in the iOS app.

Product analytics is off by default. If you enable Share product analytics in Settings → Data & Backups while signed in, Trueday sends allowlisted usage, planning outcomes, purchase interactions and reliability measurements to its Supabase analytics backend and PostHog. Supabase records use your account identifier. PostHog receives random account and app-instance device identifiers, app version, device model and operating system information. Guests do not upload these events. Automatic analytics excludes task titles, notes, calendar details, precise locations, spoken text and health data. Controlled error codes, limited operational logs and on-device AI timing/success measurements exclude prompts and generated content. Turning sharing off stops app-side collection and cancels app-side queued or active uploads; it cannot recall data already received.

Session replay requires a separate opt-in and stops when product analytics sharing is turned off. It is configured to mask text, images and private editors; touch, network and console recording are disabled. If you voluntarily answer an in-app survey, the answers you submit are sent to PostHog. You may dismiss surveys without responding. These features are not used for advertising tracking across unrelated apps or websites.

Sharing purchase and subscription revenue with PostHog requires its own choice as well as product analytics consent. Turning product analytics off stops app-side analytics and requests server revenue-sharing withdrawal. That server request may remain pending while offline until acknowledged; the app shows its status and retries. Apple purchase verification and premium access work independently of these optional analytics choices. Withdrawal cannot recall data already received.

Trueday's Supabase cleanup is designed to delete raw usage events older than 90 days when the deployed job runs; actual deletion timing depends on its schedule and successful execution. PostHog events, errors, logs, AI metadata, survey answers and recordings follow that provider project's retention settings independently of Supabase. Delete analytics history disables sharing, clears pending local analytics and requests deletion of Trueday usage history, purchase attribution and the related PostHog person, events and recordings. Provider erasure is asynchronous, retried and reported complete only after verification. Account deletion also initiates analytics erasure and removal of the account link. Apple transaction records may remain separately without account linkage for financial reconciliation.

Core planning works with no account at all. If you choose to create one, you can sign in with Apple, with Google, or with an email address and password (with complexity requirements, password reset and one-time codes). Sign in with Apple can return a private relay address rather than your real one, and Trueday works normally if it does. We receive only the identifier and email the provider passes on; we never receive your password for Apple or Google.

If you opt in to the Trueday newsletter on this website, we store your email address and the record of your consent, and we keep a delivery log so we can tell whether a message reached you. We send marketing email only on that consent basis, never because you created an account. Every message carries an unsubscribe link, and unsubscribing takes effect immediately.

The iOS app offers optional PostHog product analytics, with separate choices for replay and revenue sharing, as described above. It contains no advertising SDKs. This website uses Google Analytics and Intercom after website consent. Website cookie choices do not enable analytics in the iOS app; app and website consent are managed separately.

To operate the app and your account, to sync your data when you ask us to, to process privacy requests, to keep the service reliable and secure, and to meet legal obligations. We do not sell personal information, and we do not use your data for cross-app or cross-site advertising. We do not use your planning data to train machine-learning models; the on-device suggestion models learn only from your own history, on your own device.

Data on your device sits in an encrypted store under iOS Data Protection, with tokens in the Keychain. Traffic is encrypted with TLS in transit. Access to synced data is controlled by database row-level security, including permissions for shared content. Task titles and personal content are redacted from application logs. Report a suspected vulnerability to security@truedayapp.com.

You can delete your account from inside the app at Settings → Account & Subscription → Delete Account, or through the data rights page on this website. If you are using Trueday without an account, there is no account to delete and the same screen offers Erase Local Data instead, which clears everything Trueday holds on the device. Deleting your account removes your synced planning data and your account record from our database. Newsletter records are kept separately and are removed when you unsubscribe. If an account goes unused for 24 months, we email your registered address and erase the account and its planning data 30 days later unless you sign in during that window. A deletion request you make yourself is completed within 30 days of us verifying it. Where a backup copy of the database exists, it is never restored into live systems for operational purposes, it expires on our provider's rolling schedule within 30 days, and if a restore ever happens your deletion is re-applied to the restored data.

Depending on where you live, you may have rights to access, export, correct, delete, or object to the processing of your personal data, and to withdraw consent at any time. Trueday exports your full data set to JSON, CSV or PDF from inside the app on every plan, including the free one. You can exercise the rest through the data rights page. We respond to a rights request within 30 days of verifying it. Where a request is unusually complex we may extend that by up to two further months, and we will tell you that it is being extended, and why, inside the original 30 days.

Trueday 1.5 can read a small amount of health data, with your explicit permission, to make the day it plans match how you actually slept and moved. It reads sleep analysis, workouts and step count only; it is read-only, used in memory on your device, and never written to Trueday's cloud sync, never logged, and never shared or sold. The feature is off until you turn it on, free users get three days before it becomes a Pro feature, and Trueday is not a medical device. Because the rules around health data are strict, it has its own page — linked below — setting out exactly what is read and what happens to it.

Trueday is rated 12+ on the App Store and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact support@truedayapp.com and we will delete it.

We may update this policy. When we make a material change we will update the date at the top of this page and post the revised policy here. If the change affects how we handle data you have already given us, we will say so rather than relying on the date alone.