Privacy Policy — Aetas (DRAFT v2)

This document is a draft under review. Its terms may change.

Last Updated: [Date] — DRAFT, not yet effective

Version history:

v2.2 (2026-08-06): published as a draft, by owner decision on issue #85. The internal do-not-publish banner this document used to open with was replaced by the user-facing draft-under-review notice above; no other text changed and no placeholder was filled. Attorney review remains outstanding — changes come after it.
v2.1 (2026-08-05): every substantive claim re-verified directly against the codebase (issue #85's owner decision) and rewritten where the app had moved past the draft. Four things changed since 2026-07-25: (1) Firebase Analytics/GA4 is now implemented in code, off by default, disclosed in Section 13 in place of the earlier "not implemented" status; (2) account deletion (Section 7.2) is now a verified, complete erasure, not the partial one this draft used to describe; (3) auditLogs — named in Section 3 as an example of security processing — was removed from the app entirely; (4) Section 7.3's export status is corrected to describe the calendar/task exporter that actually ships today. No bracketed placeholder was filled in this pass — [Date], [Contact Email] and [Company Address] remain the owner's and an attorney's call, tracked in the same issue. See the Verification Notes section at the end of this document for the full claim-to-code mapping.
v2 (2026-07-25): added Section 13 (planned product-usage analytics instrumentation), Section 14 (planned feedback/support data collection), and Section 15 (planned third-party AI-agent access, specification stage). Codebase was checked directly (grep for PostHog/GA4/Mixpanel/analytics SDK imports, for a feedback Firestore collection, and for MCP/agent-token infrastructure) — as of that version, none of these three features were implemented; all three were disclosed as forward-looking plans, not live data collection. Everything else below was carried forward from v1 unchanged. See v1 for the original text if you need to diff.
v1: original draft.

1. Introduction

Flow Apps ("we," "us," or "our") operates Aetas (the "Service" or "App"), a personal productivity, time-management, and self-reflection application. This Privacy Policy explains what information Aetas collects, why we collect it, how it is stored, and what choices and rights you have.

Aetas is designed to help you track tasks, goals, schedules, and personal well-being patterns (mood, energy, sleep, and emotional reflection) over time. Because some of this data is unusually personal, we've written a dedicated section (Section 4) specifically about it — please read that section even if you skim the rest.

By creating an account and using Aetas, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

We collect only the information needed to provide the App's features. Specifically:

2.1 Account and Authentication Data

Email address, display name, and profile photo, obtained via Google Sign-In (Firebase Authentication).
We do not collect or store your Google password — authentication is handled entirely by Google/Firebase.

2.2 Productivity and Planning Data

Tasks and goals: task titles, descriptions, due dates, priority, status, and goal hierarchies you create.
Schedule and time-tracking data: calendar entries, time blocks, working-day preferences, recurring/repeatable task instances, and related timestamps.
Quick-capture content: short-form notes, ideas, and "in the moment" captures you record, including any context you attach to them (e.g., what you were doing, what distracted you, urgency level).

2.3 Journaling Data

Journal entries you write, including free-text content (up to several thousand characters), titles, tags, category (e.g., "daily reflection," "gratitude," "work," "health"), and any gratitude items you log.
Journal entries may reference or embed mood/energy ratings (see Section 2.4) and can contain anything you choose to write, including personal or sensitive disclosures. We do not read, moderate, or analyze the content of your journal entries for any purpose other than the pattern-detection features described in Section 3, and only insofar as those features process the data you've explicitly enabled.

2.4 Mood, Energy, Sleep, and Emotional-Tracking Data — see Section 4

Aetas includes optional wellbeing-tracking features that record:

Mood score, energy level, and stress level (numeric self-ratings)
Sleep hours, sleep quality, and self-reported sleep "impact"
Structured emotional-assessment data: named emotional dimensions (e.g., happiness, anxiety, anger, stress), emotional triggers (e.g., work pressure, relationship issues, financial stress), coping strategies you log (e.g., exercise, meditation, talking to someone), and recurring emotional patterns you identify
Free-text notes attached to any of the above

This is treated as a distinct, higher-sensitivity category of data. See Section 4 for how we handle it and what consent we ask for.

2.5 Technical Information

Basic device/browser information and standard Firebase/Google Cloud request logs (e.g., timestamps, error logs) generated as a byproduct of operating the Service.
Firebase Analytics (Google Analytics for Firebase, "GA4") is built into the app, but is off in every deployment unless an operator explicitly turns it on — see Section 13 for what it collects and how it is kept away from your sensitive data. No other third-party analytics or tracking SDK (Mixpanel, PostHog, Sentry, etc.) is integrated.
If you enable push notifications, Firebase Cloud Messaging is the mechanism used to attempt delivery (e.g., reminders). As of this version of this policy, the production deployment has no push-delivery credential configured, so no push notification has actually reached a device yet.

2.6 Feedback and Support Submissions (Planned) — see Section 14

If you use an in-app feedback/support form once it ships, we plan to collect what you submit (category, free-text description, and related metadata). This feature is planned, not yet built — see Section 14.

3. How We Use Your Information

To operate the Service: storing and syncing your tasks, goals, schedule, journal entries, and wellbeing data across your devices; sending reminders and notifications you've enabled.
Pattern-detection and "insight" features: Aetas includes statistical features that look for patterns across your own data — for example, correlating logged mood/energy with time-of-day, activities, or sleep. These are basic statistical summaries of your own data, not clinical, medical, or diagnostic analysis, and not AI-generated psychological assessment. See the Terms of Service for more on the limits of these features.
Account management and support: to authenticate you, respond to support requests, and maintain your account.
Security: Firestore Security Rules validate the shape and ownership of every write before it is accepted (see Section 5). This app does not run a separate abuse-detection system or keep an audit log of your actions — an earlier version of this app did write one, and it was deleted outright rather than kept, because a log written by the browser under your own credential, with no export and no alert on it, gave the appearance of accountability without the substance.
Product-usage analytics (planned, not yet live): see Section 13.
Feedback and support handling (planned, not yet live): see Section 14.

We do not use your data for advertising, and we do not sell your personal data to anyone.

4. Special Category Data: Mood, Emotional, and Health-Adjacent Tracking (Please Read)

Some regulations — including Article 9 of the EU/UK GDPR — treat data revealing information about a person's mental or physical health, or similar deeply personal information, as a "special category" requiring extra protection and, in most cases, your explicit, separate consent before it can be collected.

Aetas's mood, energy, stress, sleep, and structured emotional-tracking features (described in Section 2.4) may fall into this special category, because they are designed to capture information about your emotional and psychological state over time (for example, named "emotional dimensions" like anxiety or sadness, and self-identified emotional "triggers" and "coping strategies").

What this means in practice:

These features are optional. You are not required to use mood tracking, sleep tracking, or the emotional-assessment tools to use the rest of Aetas (tasks, goals, scheduling, and basic journaling can be used independently).
As of this version of this policy, there is no separate consent step for this category of data. Signing in and using a mood, sleep or emotional-assessment screen is, today, the only gate — the same general acceptance described in Section 1, not a distinct opt-in. We are stating this plainly rather than describing a consent flow that does not exist: a generic acceptance is not, on its own, adequate grounds for processing special-category data, and closing that gap (a specific opt-in before first use, separate from account creation) is open work, tracked against this policy.
There is no in-app control to turn this off today. You can stop entering new mood/sleep/emotional data by simply not using those screens, and you can delete individual entries you have already created (Section 7.1). But a dedicated settings toggle that stops collection going forward without deleting your whole account does not exist yet. Until it does, contact us at [Contact Email] and we will act on the request manually.
We do not use this data to make judgments about your mental health, diagnose any condition, or share it with any third party for profiling or advertising. It stays within the pattern-detection features described in Section 3.
Withdrawing consent: you can withdraw consent for this category of data going forward at any time; this does not affect the lawfulness of processing before withdrawal.
Analytics carve-out (see Section 13): the product-usage analytics built into the app is designed so it can never receive the free-text content of your journal/reflection entries or your raw emotional-dimension values as an event property — only category labels, IDs, or booleans (e.g., "a reflection was completed," not what it said). Only four events are wired up at all, and none of the mood/sleep/reflection/assessment ones are among them (Section 13). This rule exists specifically so that instrumenting the product does not create a second, analytics-vendor copy of this special-category data.

We flag this prominently, rather than folding it into generic "personal data" language, because we think you should be able to make an informed, specific decision about this category before turning it on.

5. How Your Data Is Stored

Your data is stored using Firebase Authentication (for sign-in) and Cloud Firestore (for all app data), both Google Cloud Platform services.
Data in transit is protected by standard TLS encryption provided by Firebase/Google's infrastructure. Data at rest benefits from Google Cloud's standard infrastructure-level encryption.
Access control today is enforced through Firestore Security Rules and Firebase Authentication — each user's data is scoped so that only that authenticated user (identified by their Firebase user ID) can read or write their own records. This is the actual mechanism protecting your data today.
We do not currently apply any additional client-side (end-to-end) encryption on top of Firebase's platform defaults. In plain terms: your journal, mood, and emotional-tracking data is stored as regular (unencrypted-by-us) data in Firestore, protected by access-control rules and Google's infrastructure security — not by a separate encryption layer that only you can unlock. If this changes in the future, we will update this policy before making any claim about additional encryption.

6. Third-Party Processors

We rely on the following infrastructure providers to operate the Service:

Google LLC / Google Cloud Platform — hosting, Firebase Authentication, Cloud Firestore (database), Firebase Cloud Messaging (push notifications), and Firebase Analytics / Google Analytics for Firebase ("GA4") for the limited product-usage events described in Section 13. Google acts as our data processor for these services. See Google's Privacy Policy and Firebase's data processing terms.

We do not integrate any advertising or customer-support third-party tool. GA4's own automatic page-view tracking and Google-signals/ad-personalization features are switched off in this app's configuration — see Section 13. No analytics processor other than GA4 has been evaluated or integrated.

7. Your Rights and Choices

You have the following rights over your data, subject to the honest caveats below:

7.1 Access and Correction

You can view, edit, and correct your tasks, goals, journal entries, and wellbeing data directly within the app at any time, since the app's core UI is built around viewing and editing your own records.

7.2 Deletion — current status (please read carefully)

Deleting your account from in-app settings erases every record we can find across all of the collections this app writes to — tasks, goals, journal entries, mood/sleep/emotional-tracking records, quick captures, and every other category listed in Section 2 — and only then deletes your sign-in record (Firebase Authentication account). That order is deliberate: our access rules key off your sign-in, so deleting it first would have left your data behind and unreachable by anyone, including you.
The deletion is verified, not assumed. After deleting, the app reads every collection back and confirms it is empty before it reports success. If anything remains — for example because a delete was denied for a reason we did not anticipate — you are shown which collections and how many records, rather than a blanket "done."
It is resumable. Deletion runs in your browser, so it is not instantaneous and not atomic. If you close the tab partway through, a marker records that a deletion started; signing back in resumes it rather than starting over or losing track.
One known exception: an internal audit-log feature (Section 3) operated for a period before being removed from the app outright. Records it wrote while it existed can no longer be read, written, or deleted by any part of the app — including this deletion feature — because the underlying storage rule was removed along with the feature. If you used the app during that period, this is data we cannot currently reach to erase on your behalf; correcting that needs an administrative process outside the app, which is tracked as open work.
If you believe any of your data was not reached by this process, contact us at [Contact Email].

7.3 Data Portability / Export

An in-app Export control exists today, but it is narrower than full data portability: it exports your tasks and goals as a CSV file or an iCalendar (.ics) file, filtered by date range and by which goals you select. It does not include journal entries, mood/sleep/emotional-tracking records, or quick captures.
A complete, machine-readable export of everything this app holds about you — the kind Article 20 portability calls for — is not yet built. Until it is, you may request a full copy of your data by contacting [Contact Email].

7.4 Withdrawing Consent for Special-Category Data

See Section 4. You may disable mood/emotional/sleep tracking at any time going forward.

7.5 How to Exercise These Rights

8. Data Retention

Honest current state: Aetas does not currently have an automated data-retention or scheduled-deletion policy. Data you create (tasks, journal entries, mood/emotional/sleep records) is retained indefinitely in Firestore unless you manually delete individual entries in-app or contact us to request deletion (see Section 7.2).

We consider this a gap we intend to close — an eventual production version of this policy should state a concrete retention schedule (e.g., "data is deleted N days after account closure") once an automated mechanism actually exists in the codebase. Until then, this section should not claim a specific retention period that isn't enforced.

9. Children's Privacy

Aetas is not directed at, and is not intended for use by, children under 18. We do not knowingly collect data from children under 18. If we learn we have collected such data, we will delete it.

10. International Data Transfers

Your data is processed on Google Cloud Platform infrastructure, which may involve processing or storage outside your country of residence. [This section requires attorney input on specific transfer mechanisms (e.g., EU Standard Contractual Clauses) applicable to your actual hosting region(s) and user base before publication.]

11. Changes to This Policy

We may update this Privacy Policy as the app evolves — in particular, as the export and retention gaps described above are closed, and as the feedback/support (Section 14) and AI-agent access (Section 15) features move from planned to live, we will update the relevant sections to reflect what is actually true at that time rather than what is aspirational. This app currently has no email-sending capability and no in-app broadcast mechanism, so we cannot yet notify you of a change through the product itself; until one exists, the "Last Updated" date and version history at the top of this document are the only record of when it changed.

12. Contact Us

Questions about this policy or your data: [Contact Email] Address: [Company Address]

13. Product Usage Analytics — new in v2, status corrected in v2.1

Status, verified directly against the codebase as of this version: implemented in code, off by default in every deployment. This is a change from the previous version of this policy, which described analytics as not yet built at all — Firebase Analytics (GA4) has since been added to the app. Two independent switches must both agree before a single event leaves your browser: an operator has to set the deploy-level flag NEXT_PUBLIC_ANALYTICS_ENABLED to exactly the value "true", and your browser must not have set a stored opt-out. As of this version of this policy, that flag is unset, meaning no SDK is loaded, no analytics network request is made, and no event listener is mounted — regardless of what is described below. This section discloses what would happen if that changes, so the disclosure exists before collection does rather than after.

Only four events exist, all about how you use two specific features — not eleven, as an earlier internal plan once described:

capture_created — a Quick Capture entry was saved: its type, effort, urgency, whether it references a cost, a time-of-day bucket, and how many tags it has.
capture_converted_to_task — a capture became a task: its type, minutes elapsed, whether it was scheduled, whether it has a goal, and its priority.
reminder_delivered — the server confirmed a push reminder reached Firebase Cloud Messaging: source type and delivery latency.
reminder_acted_on — the source of a delivered reminder was completed or converted within a short window: source type, action type, and minutes to action.

None of these carry free text, and none touch mood, sleep, journal, reflection, or assessment data at all. Every event parameter is restricted at the code level to a boolean, a bounded number, or a value from a fixed, closed list — there is no parameter kind that can hold a string. A call site that tried to attach the content of a capture or a journal entry would have that value silently dropped before anything left your browser, and an automated test in the app's codebase enforces this. This is a hard design rule specifically because this app's mood, sleep, journal and assessment data are the special-category data described in Section 4, and instrumenting the product must not create a second, analytics-vendor copy of it.

Which processor: Firebase Analytics / Google Analytics for Firebase (GA4), a Google Cloud Platform product — not a separate third-party vendor, and not the self-hosted alternative an earlier internal plan had recommended. GA4's own automatic page-view tracking, and its Google-signals and ad-personalization features, are switched off in this app's configuration; a route in this app (e.g., which journal you opened) is itself a disclosure, so we do not send it.

Per-browser opt-out exists at the code level, but has no visible control yet. The app can remember that a specific browser has opted out, and that opt-out overrides the deploy-level flag even when analytics is otherwise on. As of this version of this policy, there is no settings-page toggle that sets it — the mechanism exists for one to be built on top of, but you cannot exercise it from within the app today.

Consent and sequencing: we have not built a consent or cookie-notice mechanism for analytics, and analytics stays off by deploy-level default specifically because that mechanism does not exist yet. We will not turn the deploy-level flag on in production before a consent surface exists.

14. Planned: Feedback & Support Data Collection (Not Yet Implemented) — new in v2

Status, verified directly against the codebase as of this version: not implemented. There is no feedback Firestore collection and no in-app feedback/support submission form in Aetas today. This section discloses a designed, not-yet-built feature (see the internal SUPPORT_GUIDELINES.md).

What we plan to collect, if and when this ships: if you submit a bug report, feature request, point of confusion, or praise through an in-app "Feedback & Support" form, we plan to store what you submit — your account identifier, the category you select, your free-text description, and a timestamp — in a dedicated feedback collection.

Security-sensitive reports: the planned form is expected to include a way to flag a report as involving account security, data exposure, or suspected unauthorized access, which would set a securitySensitive: true marker on the stored record so it can be routed to a faster response path instead of the normal weekly review queue.

What we plan to ask you not to submit: because this form's free-text field is not designed for bulk sensitive data, guidance shown alongside it will ask you not to paste your full journal/mood entry text or other highly sensitive content into a feedback submission — a screenshot with sensitive fields redacted, or a reference to a specific record, will be requested instead. This avoids creating a third copy of sensitive content (beyond the app's own database and, potentially, an analytics tool per Section 13).

Not live yet: no feedback or support submission collects data today. This section will be revised to describe the feature as active, and to state a concrete retention period for submitted feedback, once it actually ships.

15. Planned: Third-Party AI Agent Access (Specification Stage) — new in v2

We are evaluating (not building yet) a way for you to optionally connect your own AI agent (e.g., Claude or a similar tool) to your Aetas account via a per-user, individually revocable API token, so the agent can read your schedule/tasks/goals or take actions like logging a capture on your explicit request. This is presently a written specification only (MCP_SERVER_SPECIFICATION.md) — no such token system, server, or integration exists in the app today, and this idea is gated on our internal security/compliance review before any implementation begins. If this is built, any token would be scoped to the same per-user access rules that already protect your data (Section 5) — never a broader "admin" credential — and any action it takes on data covered by Section 4 would be named explicitly in a future version of this policy before that capability shipped. We are flagging this now, at the design stage, rather than waiting until it is built.

Verification Notes

Every substantive statement above about what this app does or does not do was checked against the source rather than assumed, as part of issue #85's verification pass (2026-08-05). The mapping, for anyone auditing this document:

Section 1, 3 — Google Sign-In only, no password stored, 30-minute inactivity auto-signout. Verified in contexts/auth-context.tsx (signInWithPopup, SESSION_TIMEOUT).
Section 2.1–2.4 — task, goal, journal, mood, sleep and assessment field shapes. Verified against types/goal.ts, types/journal.ts, types/mood.ts, types/assessment.ts and types/quick-capture.ts.
Section 2.5, 6, 13 — Firebase Analytics (GA4) is implemented, gated off by a deploy-level flag and a per-browser opt-out. Verified in lib/analytics/index.ts (isEnabledByDeploy, isAnalyticsEnabled, setAnalyticsOptOut) and lib/analytics/events.ts (EVENT_SCHEMA, sanitizeEventParams). The four live events, their parameters, and the closed bool/int/enum parameter kinds are read directly from EVENT_SCHEMA. GA4's automatic page-view and Google-signals features being off is verified in next.config.js (the Content-Security-Policy host list). Push notifications having never actually delivered in production is stated in the codebase itself (lib/analytics/reminder-signal.ts) and depends on NEXT_PUBLIC_FIREBASE_VAPID_KEY, which is empty in .env.example.
Section 3 (security) — the audit-logging feature this section used to name as an example no longer exists. Verified by its absence: lib/firestore/user-data-registry.ts and config/firebase/firestore.rules both record that the auditLogs collection and logAuditEvent() were removed outright, and no call site remains anywhere in lib/.
Section 4 (consent) — no consent UI and no settings toggle for wellbeing-tracking collection exist. Verified by absence: no match for "consent" or "opt-in" under app/, and no analytics or tracking-disable control in app/settings/page.tsx.
Section 5 — Firestore Security Rules enforce per-user ownership; no additional client-side encryption. Verified in config/firebase/firestore.rules (the isOwner helper and its use in every top-level match block) and by absence of any encryption library in package.json.
Section 7.2 (deletion) — deletion is complete, ordered, verified by read-back, and resumable. Verified in lib/firestore/account-deletion.ts (deleteAccount, deleteUserData, verifyUserDataDeleted, markDeletionRequested) and the collection list it sweeps in lib/firestore/user-data-registry.ts (USER_ID_FIELD_COLLECTIONS and related). The one exception — data written to the now-removed auditLogs collection before it was withdrawn — is recorded in the same registry file's WITHDRAWN_COLLECTIONS list and its accompanying comments.
Section 7.3 (export) — the shipped exporter covers tasks and goals only, as CSV or iCalendar. Verified in app/export/page.tsx (handleExport, its CSV and iCalendar branches, and the absence of any journal/mood/sleep field in what it reads or writes).
Section 11 (change notices) — no email-sending capability and no in-app broadcast mechanism exist. Verified by absence: no email-sending dependency in package.json or functions/package.json, and no general-announcement route or component under app/ or components/.
Section 14, 15 (feedback, AI agent access) — both remain unimplemented, unchanged from the previous version. Verified by absence: no feedback collection referenced anywhere in lib/firestore/, and no token, MCP-server or agent-scoped-credential code anywhere in lib/, types/ or app/.

Known Gaps

Things this pass found that are real, current, and not fixed by this document:

No consent mechanism for special-category data. Section 4's honest description of this — using a mood/sleep/emotional feature requires nothing beyond ordinary sign-in — is itself the gap. A specific opt-in, and a way to withdraw it that stops future collection without deleting the whole account, remain to be built.
No settings-page control for the analytics opt-out that already exists in code. setAnalyticsOptOut() (lib/analytics/index.ts) has no UI calling it.
Data from the withdrawn auditLogs collection is unreachable, including by account deletion. Documents written while that feature existed cannot be read, exported, or deleted by any part of the app today; removing them needs an administrative process outside the client.
No full personal-data export. The shipped exporter (Section 7.3) does not cover journal, mood, sleep or assessment data — a genuine Article 20-style export of everything this app holds about a user is not yet built.
No mechanism to notify users of a policy change other than this document's own "Last Updated" field and version history.
This document itself is not yet attorney-reviewed and is missing a jurisdiction clause entirely (see the placeholder count above). Nothing in this pass substituted for that review — it verified only that the app-behavior claims are true today, not that the document is legally sufficient.

This is a first-iteration draft pending review by a licensed attorney. Do not treat any statement in this document as a final legal commitment until that review is complete.