Privacy Policy

Last updated 12 September 2026

The short version

ProcrastBuddy stores what it needs to give you a plan and remember your progress, and nothing else. We don't sell your data, we don't run ads, and we don't build advertising profiles. You can use the app as a guest without an account at all.

What we store

Only if you create an account:

• Your email address, and a password held by our authentication provider - we never see or store the password ourselves.
• Your name, and the onboarding answers about what you're working on and how you like to work.
• Your plans: goals, deadlines, the tasks generated for them, and which ones you've ticked off.
• Study material you upload, the chat you have with Study Buddy about it, and any questions detected in it.
• Progress signals used for streaks and achievements - when you were last active, how many plans you've started, how many tasks you've completed.
• If you connect Google Calendar: a token that lets us add your tasks to your calendar. It's stored on our server and never sent back to the app.
• If you allow notifications: a device token so check-ins can reach your phone.

Guest mode

As a guest, everything above stays on your device only - nothing is sent to our servers to be stored against you. Starting a new guest session clears the previous one, so a shared device doesn't leak one person's work to the next. If you later create an account, we'll offer to bring that local data with you.

Who else sees it

A few services do specific jobs for us. Each one only receives what that job needs:

• OpenAI - receives your goal text, and study material or messages you send to Study Buddy, in order to generate plans and replies. It is not used to train their models.
• Supabase - stores your account and the data listed above.
• Google - handles Google sign-in, and Calendar if you connect it.
• Firebase Cloud Messaging - delivers push notifications to your device.
• Netlify - hosts the app and the server functions it calls.

Google user data

ProcrastBuddy asks Google for two things, separately, and only when you choose them:

• Signing in with Google gives us your name, email address, profile picture and Google account ID. We use these only to create and identify your account, so you can sign in without another password and find your plans again on another device.
• Google Calendar (the calendar.events permission), requested only if you tap Connect. We use it for exactly one thing: putting the tasks in your plan onto your calendar, and keeping those entries up to date as you reschedule or complete them.

The Calendar integration is write-only. We create, update and remove the events ProcrastBuddy itself added; we never read your calendar. Your existing events, their titles, attendees, locations and your availability are never requested, never received and never stored. The only Calendar information we keep is the ID of each event we created, so we can update that same entry later instead of duplicating it.

What we store from Google, in full: your Google account email, and an authorisation token that lets us add events on your behalf. That is everything.

We never sell Google user data, never share it with advertisers, never use it for advertising or profiling, and never transfer it to anyone except as needed to provide the Calendar feature you asked for.

Google user data and AI

ProcrastBuddy uses AI to generate plans and to answer questions about material you upload. Google user data is never part of that. Because the Calendar integration never reads anything, there is no Google data to send: the AI only ever sees text you typed into ProcrastBuddy yourself — your goal, your deadline, and study material you chose to upload.

Specifically, and without exception: we do not use, transfer or sell Google user data — raw, aggregated or derived — to create, train, improve or evaluate any foundational or generalised machine learning or artificial intelligence model, whether our own or a third party's. No Google user data is sent to OpenAI or to any other AI or ML service.

How we protect your data

Sensitive data — your Google authorisation token above all — is protected as follows:

• In transit: every connection between the app, our servers and Google is encrypted with HTTPS/TLS. There is no unencrypted path.
• At rest: all data is held in a managed PostgreSQL database (Supabase) with encryption at rest enabled.
• Your Google token never reaches the app. It is sent straight to our server the moment Google issues it, and is never returned to the phone or browser afterwards. It lives in a table with row-level security enabled and no read policy at all, so no app credential — yours or anyone else's — can retrieve it. Only our own server can, using a key that exists solely as a server-side environment variable and is never shipped in the app.
• Short-lived access. The token that actually touches the Calendar API is requested fresh for each operation, expires within the hour, and is never written to disk.
• Separation between accounts. Every table holding your data enforces row-level security, so one signed-in account cannot read another's rows even if it tried.
• Passwords. If you sign up with an email and password, the password is handled and hashed by our authentication provider. We never see it and never store it.
• Revocation actually revokes. Disconnecting Google Calendar deletes our stored token and calls Google's revocation endpoint, so our access ends at Google's side too rather than merely going unused.

Removing our access to Google

Disconnect Google Calendar from the Profile screen in the app at any time. You can also revoke access from your Google Account permissions page. Either way we stop being able to touch your calendar; events already created stay where they are, and you can delete them yourself.

Data retention

Your account data is kept for as long as your account exists. Deleting a plan removes it and its study history from our servers immediately. Disconnecting Calendar deletes the stored Google token immediately. You can delete your whole account from Profile in the app, which takes effect at once and cannot be undone; if you have already uninstalled, email us and we will do it within 30 days.

One thing survives deletion, and we would rather say so than claim a clean sweep: feedback you have sent us through the app is kept, with your name and account removed from it. Bug reports are how the app gets fixed, and one that vanishes takes the fix with it. What remains cannot be traced back to you.

Rate limiting

To stop the AI features being run up by automated abuse, we count requests per account - or, for guests, per IP address. That count is all that's kept, and it resets every hour.

Your choices

• Delete any plan, or all of them, from the plans list at any time - that removes it from our servers too.
• Disconnect Google Calendar from your profile whenever you like; we delete the stored token and revoke our own access with Google.
• Turn notifications off in your phone's settings, or from the check-in toggle in the app.
• Delete your entire account from Profile in the app - immediate, permanent, and it takes every plan, study thread and notification with it.
• Or, if you have already uninstalled, ask us to delete it by emailing olivinegeorge@gmail.com.

Cookies and local storage

We use your browser's local storage to hold guest-mode data and a few preferences (which tab you were on, whether check-in sounds are muted) on your own device. We do not use third-party advertising cookies, and we do not use analytics or tracking cookies of any kind.

Children

ProcrastBuddy isn't intended for children under 13, and we don't knowingly collect their data.

Changes

If this policy changes in a way that affects you, we'll update the date at the top and say so in the app rather than changing it quietly.

Contact

Questions about any of this go to olivinegeorge@gmail.com.