Privacy Policy

1Information we collect

• Account information: the name, email address and password you provide, or your name, email address and account ID from Apple or Google if you sign in with them.
• Device and sign-in information: an identifier for each device you sign in on, which we use to keep you signed in and manage your sessions; a push-notification token; and your device model, operating system version and app version.
• Age information: the birth month and year you give us, and records that a parent or guardian agreed to our Terms for a user under 18.
• Your content: your tasks and their details (text, notes, dates, reminders, priority and completion history), your answers to the App's questions, facts the App records about your preferences and routines, and your goals and their notes.
• Chat conversations: your messages to the App and its replies, including coaching messages. A conversation stays visible in the App until you close the App, and the App does not keep a chat history you can return to. We keep copies of conversations with your account data and in our logs, as described in Section 6.
• Calendar events, only if you turn this on: the App reads events from your device calendar for the next 60 days (title, time, whether they repeat, and whether you accepted them) and sends them to us at most once a day, replacing the previous copy. The App never creates, changes or deletes calendar events. Turning the setting off deletes the stored copy.
• Settings and usage patterns: your time zone, notification preferences and schedule, and the times of day you usually open the App (used to time coaching messages).
• Subscription and usage records: your plan and its status, purchase records from Apple (transaction identifiers and dates; we never receive your payment card details), and a record of your AI usage against your allowance.
• Agreement records: the dates and versions of the Terms, AI permissions and health data consent you accepted.
• Safety and support records: flags created when automated systems detect a message that may raise a safety concern or violate our Terms; messages you send when you report a problem; and notes our staff make when reviewing them.
• Technical logs: server logs that include your IP address, request times and errors, and records of AI requests that contain the text sent to and returned by the AI model.

Health-related information. We do not ask for health information, but anything you enter may include it. Our Consumer Health Data Privacy Policy explains how we handle this information.

What we do not collect: your location, contacts, photos, Apple Health data or advertising identifiers.

Sources. We collect this information from you, from your device, from Apple (purchases and Sign in with Apple), and from Google (if you use Sign in with Google).

2How we use information

We use the information above only to:

• provide and maintain the App's features for you, including AI processing as described in Section 3;
• send the reminders and coaching messages you have turned on;
• manage your subscription and measure AI usage;
• respond to your requests and support messages;
• review flagged conversations and enforce our Terms, as described in Section 4;
• apply age-based protections required by law;
• diagnose problems and improve how the App responds, using records our staff review for support or safety; and
• protect the App and its users against fraud, abuse and security threats, and comply with law.

We do not use your information for advertising, and we do not use it to train AI models.

3How AI processing works

AI features stay off until you turn them on and give permission in the App's AI Features screen. When they are on, the App sends your content (tasks and notes, answers, recorded facts, goals, chat messages and, if you turned it on, calendar events) to AI models developed by third-party AI companies. We use these models through Amazon Bedrock, a service of Amazon Web Services ("AWS"), in AWS data centers in the United States. AWS runs the models on its own systems, sends the response back to us, and does not keep your content after responding, except for the short-lived cache described below.

The companies that develop the models do not operate those systems, do not receive your content and have no access to it. Your content is not used to train or improve any AI model. Your content and the AI's responses are stored only on your device and in our own AWS account. AWS acts as our service provider and, under its customer terms, does not access or use your content except as needed to provide its services to us. To speed up responses, AWS may cache parts of a request for a short time, no more than one hour, after which the cached content expires automatically.

Cassiel's chat replies, coaching messages and suggestions are generated by AI, not written by a person. You can view, edit and delete the facts the App records about you.

You can turn individual AI features off at any time in the AI Features screen.

4Safety review of conversations

The App uses automated systems to flag conversations that may raise a safety concern or violate our Terms. When a conversation is flagged:

• the flag is recorded with the conversation in our logs;
• our support staff are notified that a review is needed; the notification does not contain your messages; and
• a member of our staff reviews the conversation in our secure systems.

We use these reviews to check that the App responded appropriately, to improve its safety responses, and to decide whether to take action under our Terms. An automated flag alone never results in a suspension or ban; a person on our staff decides. We do not monitor conversations in real time.

5Who can see your information

We do not share your information with third parties for their own purposes. Only the following can access it.

Our employees. A limited number of authorized Winter Works employees, all located in the United States, can access your information when needed for support, safety review, security or operating the App.

Service providers. These companies process information only on our behalf and under our instructions, to run the App:

• Amazon Web Services: hosts our servers and storage and runs AI processing.
• Apple: processes purchases, delivers push notifications (which can include the text of your reminders), and provides Sign in with Apple.
• Google: provides Sign in with Google, if you choose to use it.

Other disclosures. We may disclose information when required by law or valid legal process, or transfer it as part of a sale or merger of our business.

We do not sell personal information or share it for advertising.

6How long we keep information

We may keep information longer when the law requires it, for example to comply with legal process or a report to authorities.

7Deleting your data or account

You can delete individual items at any time, and you can delete all of your data or your account in the App's settings or by contacting us. When you do, we delete your content from our active systems immediately, and copies in backups and logs are deleted automatically within 30 days. We keep only the records listed in Section 6 that we need to meet legal obligations, resolve disputes, prevent fraud and abuse, and administer purchases. Deleting your data or account does not cancel a subscription; cancel through your Apple Account settings.

8Where information is stored and how we protect it

Your information is stored in our AWS account in the United States and processed in AWS data centers in the United States, and a copy is kept on your device so the App works quickly and offline. We encrypt information in transit and at rest, keep each user's data separate, and limit access to authorized employees. No system is perfectly secure, and we cannot guarantee absolute security.

9Teens and children

Children under 13. The App is not for children under 13, and we do not knowingly collect their information. If you believe a child under 13 has given us information, contact us and we will delete it.

We comply with the Children's Online Privacy Protection Act (COPPA) and other applicable laws that protect the privacy of children and teens.

Teens aged 13 to 17. A parent or guardian must agree to our Terms before a teen uses the App. For teen users:

• we process information only as needed to provide the features the teen or parent turned on, keep the App secure and safe, and comply with law;
• we do not sell their information, use it for advertising, or use it for any purpose that requires separate consent unless we first ask for that consent and the teen can decline without losing access to the App; and
• a parent or guardian can contact us to review or delete their teen's information after we verify their identity and relationship to the teen.

10Your rights and choices

In the App you can view, edit and delete your tasks, facts and goals; turn AI features on or off; turn calendar access on or off; manage notifications; export your data; and delete all of your data or your account.

Privacy rights. Depending on your state, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, and to opt out of sales, targeted advertising and certain profiling. We do not sell personal information or engage in targeted advertising. We extend these rights to all U.S. users regardless of state.

How to make a request. Email support@winterworks.net from the address on your account. We may need to verify your identity before acting on a request. You may use an authorized agent, who must provide proof of your permission. We respond within 45 days, and we will tell you if we need more time as the law allows.

Appeals. If we decline your request, you can appeal by replying to our decision within 60 days. We will respond to your appeal within 60 days and explain our decision. If you are not satisfied, you may contact your state attorney general.

We will not discriminate against you for exercising your rights.

11Tracking and Do Not Track

We do not track your activity across other companies' apps or websites, and we do not allow third parties to collect information about your online activities over time and across apps or websites through the App. Because we do not do this kind of tracking, browser "Do Not Track" signals and Global Privacy Control signals do not change how the App works.

12Changes to this policy

We may update this policy from time to time. We will post the updated policy with a new effective date and, if a change is material, tell you in the App before it takes effect. If a change affects how your content is processed by AI or how we handle health-related information, we will ask for your permission again before continuing that processing.

13Contact us