Skip to main content

Privacy  ·  Policy

Privacy, in plain language.

Last updated  ·  October 10, 2026

This page covers the Rhythmos mobile app. If you're looking for the privacy policy for this website (the waitlist signup), see our website privacy policy instead. Most privacy policies are written by lawyers in language built to obscure what's actually happening. This one isn't. Read the short version below and you'll know what Rhythmos does with your data. Read the detailed version if you want the receipts.

Heads up: the Rhythmos app isn't publicly available yet. It's in active development, and this policy describes the privacy practices it will ship with at release. I'm building the app to meet this page, not the other way around. Until then, treat everything here as the standard I'm holding the app to.

The short version

What you need to know.

Your tasks live in your Rhythmos account.
Tasks are stored in your account on Supabase, so you need to sign in to use them, and your phone keeps a cached copy. Goals, routines, reviews, and settings stay on your phone and sync to your account when you sign in.
Signing in syncs more than your tasks.
When you're signed in, your goals, routines, gamification, reviews, and settings sync too, so you don't lose them. Protected by row-level security — only you can read your data.
AI features send what you give them to Anthropic.
When you use an AI feature, the text you type and whatever that feature works on (a task, a photo, a review, or a message) go to Anthropic Claude through a secure server-side proxy — never directly from your device. AI features send what you're working on in that feature, plus what the feature needs to do its job. Section 2 lists the main examples. We do not cache AI responses; the proxy counts your calls per day and per month to enforce fair-use limits — no content is stored.
Reply Assist reads messages only from apps you pick.
It's off unless you turn it on and give it notification access. Then Rhythmos reads notifications from the messaging apps you choose, and sends a message and its sender's name to the AI when you ask for help replying. To let you pick whose messages it watches, it reads contact names on your phone. Rhythmos never sends those names anywhere, except a sender's name when you ask for help with a reply.
Calendar Sync reads only the calendars you pick.
It's off until you give Rhythmos calendar access and pick calendars. Then Rhythmos reads your upcoming events so it can plan your tasks around them. Event titles stay on your phone, and your calendar never goes to the AI. The only calendar details in your account are which calendars you picked and, if you change an event's settings, those settings plus that event's ID and start time. Rhythmos never adds, changes, or deletes anything in your calendar.
Crash reporting is opt-in and off by default.
We don't track what you do in the app — no usage or behavioral analytics. You can optionally turn on anonymous crash and error reports (no personal content, no IP) to help fix bugs, but only if you explicitly choose to.
We don't run ads, sell your data, or do behavioral tracking.
Ever.
A few services help run the app.
Anthropic (AI), Supabase (your account and sync), RevenueCat (subscriptions), and two you opt into: Sentry (crash reports) and Todoist (only if you import your Todoist tasks). Each is named in detail below.
You can export or delete your data anytime.
Settings → Save a backup file (or Export readable copy) gives you what's stored on your phone; Clear All App Data wipes it. Your tasks aren't in the backup, and clearing doesn't delete them, because they live in your account. Email us to export or delete them, or any other cloud data.

Questions? See the detailed sections below or scroll to the contact section at the end.

The detailed version

Section by section.

1. Data collection

Stored on your device (AsyncStorage):

  • App settings and preferences
  • A cached copy of your tasks, which are stored in your account (see below)
  • Goals, routines, and habit-tracking data
  • Morning reflections (gratitude, check-ins, and worries). These stay on your phone and don't sync.
  • Gamification progress (XP, levels, streaks)
  • Focus mode session history
  • Smart Planner schedules
  • Upcoming events from the calendars you pick in Calendar Sync. Rhythmos keeps a copy of each event's title and times so it can plan around them. This copy stays on your phone. It doesn't sync and isn't in backup files.

Stored in secure storage (expo-secure-store):

  • Authentication tokens, encrypted via Android Keystore
  • Your Todoist token, if you import from Todoist

In your Rhythmos account (Supabase):

  • App settings and notification preferences
  • Tasks, labels, and task metadata. Tasks need an account, so this is where they live.
  • Goals, core values, life vision, and reviews
  • Routines
  • Gamification progress (points, levels, streaks)
  • Habit-learning and scheduling patterns
  • Which calendars you picked in Calendar Sync, and the settings you change for an event, saved with that event's ID and start time (never its title)

In short: your tasks live in your account, so using them means signing in. Everything else in this list starts on your phone and syncs to your account when you sign in, so you don't lose it.

Never collected:

  • Your name
  • Your email, other than the address you sign in with (tasks need an account)
  • Location data
  • Your contact list. If you use Reply Assist, it reads contact names on your phone so you can choose whose messages it watches. Rhythmos never sends those names anywhere, except a sender's name when you ask for help with a reply.
  • Browsing history
  • Advertising or cross-app tracking identifiers
  • Usage or behavioral analytics (which screens you visit, what you tap)

Crash reporting (opt-in, off by default):

  • Off until you turn it on. If you do, the app may send anonymous crash and error reports to help fix bugs.
  • A report contains only the error and stack trace, app version, and device model + OS. It's sent when the app crashes, or when it hits an error it recovers from. Any text in the error message is redacted before it's sent.
  • Never your tasks, messages, goals, name, email, IP address, or any record of what you do in the app.
  • Android's built-in crash reporting (Google Play) may also collect crash data per your device settings — that's part of Android, not something Rhythmos adds.

2. AI data usage

Rhythmos uses AI to help you manage tasks and schedules. AI features send what you're working on in that feature, plus what the feature needs to do its job. Here are the main examples.

What is sent:

  • The text you type into AI-powered inputs (task descriptions, questions)
  • Task titles and descriptions relevant to the AI request (for example, for task breakdown)
  • Goal descriptions, when asking AI for goal-related suggestions
  • A goal and the tasks linked to it (their titles, descriptions, and lengths), when you ask AI how much each task counts toward the goal
  • Your life vision (your perfect day, legacy, and vision statement) and your ranked core values, when you ask AI to suggest goals from them
  • Your focus goal (its title, life area, and why it matters) and how far along it is, for the gentle read on your progress on the Goals tab. Rhythmos asks for that read on its own when you open the tab, then again after you finish one of the goal's steps.
  • A photo, when you ask AI to turn it into tasks
  • A review you wrote (daily, weekly, or quarterly), including the energy and focus ratings you gave, when you ask AI about it. Rhythmos also sends your overall rating, the titles and life areas of your active goals, and your life-area ratings if the review has them.
  • A worry you wrote down, when AI suggests next steps or other ways to see it, and a brain dump of worries, when AI splits it into separate ones
  • A message you paste into the communication tools, when you ask for help reading it or replying
  • Today's tasks (their titles, times, lengths, and labels), when you ask AI to find time or organize your day
  • A batch of inbox tasks (their titles, descriptions, and due dates) and the names of your projects, when you ask AI to organize your inbox
  • Task titles and labels, when you ask AI to estimate how long they'll take
  • A task's title and details, plus which kinds of first steps have and haven't worked for you before, when you ask AI to help you get started on it
  • A plan you paste in to import, plus your time zone so its dates come out right, when you ask AI to turn it into tasks
  • If you turn on Reply Assist: the text of a notification from a messaging app you picked, plus the sender's name, when you ask for help replying

What is not sent:

  • Your name, email, or any personal identifiers
  • Your location
  • Your full task history
  • Your settings or preferences
  • Your gamification data
  • Your calendar events
  • Notifications from apps you haven't picked for Reply Assist. Rhythmos skips those before reading them.

How it is sent:

  • All AI requests go through a Supabase Edge Function proxy (server-side)
  • Your device never communicates directly with AI providers
  • The API key is held server-side, never on your device
  • Requests are encrypted in transit (HTTPS / TLS)
  • We do not cache AI responses. The proxy keeps no copy of your requests or replies — it stores nothing about the content of an AI call.
  • A per-day and per-month count of your AI calls is kept to enforce fair-use limits — a number, not your content.

AI provider data handling:

  • Anthropic (Claude) processes the request and returns a response
  • Anthropic does not train its models on data sent through the API
  • Anthropic may retain API data for a limited period for trust & safety, per their terms — a window we don't control
  • See Anthropic's privacy policy for their full terms

3. Data storage and security

  • Device storage: AsyncStorage data is sandboxed by Android — other apps cannot read it.
  • Secure storage: Sensitive values (tokens) use expo-secure-store, backed by Android Keystore (hardware encryption where available).
  • Cloud storage: Supabase uses row-level security (RLS) — only your authenticated session can access your data.
  • Server-side code: Rhythmos runs no traditional servers of its own, but it does operate small server-side functions on Supabase (hosted infrastructure, SOC 2 compliant) — including the AI proxy that forwards requests to Anthropic and the subscription webhook. Your AI requests pass through that proxy.
  • Calendar access: The calendar tool Rhythmos uses needs Android's permission to edit calendars as well as read them, so the app asks for both. Rhythmos only reads the calendars you pick. It never adds, changes, or deletes anything in your calendar.

4. Data sharing

We don't sell or trade your data. A few service providers process it on our behalf, each doing one specific job:

  • Anthropic (AI): When you use an AI feature, and when some Premium features use AI without you asking (see section 5). It gets only what you're working on in that feature, plus what the feature needs to do its job; section 2 lists the main examples.
  • Supabase (your account and sync): Holds your account and your tasks, and syncs the other data described in section 1 while you're signed in.
  • RevenueCat (subscriptions): Linked to your Rhythmos account ID as soon as you sign in, never to your email. If you subscribe, it processes the purchase and stores subscription status (plan, trial, expiry). Payment itself is handled by Google Play.
  • Sentry (crash reports): Only if you opt into crash reporting. It receives the crash and error reports described in section 1, never personal content.
  • Expo (updates): The app checks Expo's servers for over-the-air updates on launch; that sees your IP, app version, and platform — no account data.
  • Todoist (optional import): Only if you choose to import your tasks from Todoist. The app sends your Todoist token to Todoist to fetch your tasks, then saves them as tasks in your Rhythmos account. The token is kept in secure storage on your phone.

We will never sell your data, share it for advertising, or hand it to data brokers.

5. Your rights

  • Export: Settings → "Save a backup file" (or "Export readable copy") writes your local data to a file. Your tasks aren't in it, because they live in your account; email us and we'll export them. Server-side records (such as subscription status) are available on request.
  • Delete: Settings → "Clear All App Data" removes all local data. It doesn't delete your tasks, which live in your account; email us to delete them.
  • Cloud deletion: Signing out removes your cloud session. Contact us to delete cloud data entirely.
  • AI opt-out: There's no single switch that turns AI off. Most AI features run only when you use them. Some Premium features also use AI without you asking, like the progress read for your focus goal and the suggestions when you work through a worry. Nothing of yours goes to the AI while you're signed out, or until you tap "Got it" on the "About AI Features" notice.

6. Children's privacy

Rhythmos is not directed at children under 13. We do not knowingly collect data from children.

7. Changes to this policy

If we change this policy, we will update the "Last updated" date at the top. For significant changes, we'll also email you at the address on your Rhythmos account.

8. Contact

For privacy questions or data deletion requests:

This privacy policy is written in plain language because we believe you should actually be able to understand it.