Privacy

What we keep

• Your email address and a scrambled (hashed) version of your password. We never see or store the password itself.
• Your name, only if you give one or sign in with Google.
• Your timezone, so reminders arrive at 10:00 AM your time.
• Your reminders: the name, the due date, how often it repeats, and any notes you type. We don't ask for passport, license or policy numbers, and you shouldn't enter them.
• Your tasks: the name, the time of day, the days of the week, an optional end date and any notes you type.
• Failed log-in and password-reset attempts (the email typed and the visitor's IP address), kept for about a day to stop password guessing.
• The web server keeps ordinary access logs (time, IP address, page requested).

Sign in with Google

If you choose “Continue with Google”, we ask Google for three basic things: your email address, your name and an identifier that is unique to you. We store the email address, the name and that identifier, so the next sign-in finds your account. We do not get your password, and we cannot read your Gmail, calendar, contacts, files or anything else in your Google account, because we never ask for that access. We use this information only to log you in and to run your account. We do not share it or use it for advertising. It Is Time's use of information received from Google follows the Google API Services User Data Policy, including its Limited Use rules.

Phone calls (optional)

Phone alarms are off until you add and verify a number. If you do, we store the number, the times you allow calls, and the date you agreed to be called. A telephone provider (Twilio) receives the number and places the call, which says the name of the reminder. Calls are only for reminders you set up, and you can remove the number in Settings at any time.

Security features

If you turn on an authenticator app, we store its secret in encrypted form, plus recovery codes as scrambled hashes. If you add a passkey, we keep only its public half; the private half never leaves your device. Your private calendar link contains a secret token, which you can replace in Settings.

What we don't do

• No advertising, no tracking scripts, no selling or sharing your information.
• Only two cookies, both essential: one keeps you logged in, one protects forms from forgery.

Who helps us run it

• Supabase stores the database (below).
• Cloudflare sits in front of the website, so it handles your requests and your IP address in transit and filters abuse.
• An email delivery service sends our messages to you (see Email).
• Twilio places phone calls, only if you turn them on.
• Anthropic runs the AI helper, only if you use it.
• Google signs you in, only if you choose that option.

They act on our behalf to run the service. We don't sell your data.

Where it is stored

Your account and reminders are stored in a managed database run by Supabase, a cloud database provider, over an encrypted connection. Supabase is a service provider that holds the data on our behalf; it does not use it for its own purposes.

The AI helper

If you use “Add with AI”, the sentence you type, today's date and your timezone are sent to Anthropic, which runs the Claude model that drafts your reminder. Nothing else about you or your other reminders is sent. We don't keep what you typed; only a count of uses, to limit abuse. Please don't type ID, card or policy numbers; we block long numbers before anything is sent.

Email

We email you to confirm your address, to reset a password if you ask, and to send the reminders you set up. To deliver email we use an email delivery service, which receives your address and the text of those messages.

Deleting your data

You can delete your account yourself under Settings. Your reminders and scheduled emails are removed immediately. Copies in our backups (and in the database provider's own short-lived backups) are overwritten within 14 days. Questions? Write to [email protected].