Privacy Policy

1. Scope

This Privacy Policy applies to Ahd and the services used to operate it. It does not govern third-party services that you choose to connect, such as Google Calendar, Apple Health, Health Connect, or similar providers. Those providers have their own privacy terms.

2. Information we process

Account and profile information

Ahd may process your username, display name, account identifiers, timezone, authentication state, and settings needed to operate your account.

Your password is used for authentication. Ahd does not intentionally store your plaintext password. When Private Goals are enabled, the password is also used in your browser to derive a key-encryption key used to unlock your encrypted private vault.

Goals, plans, and activity

Depending on what you use, Ahd may process goals, progress logs, actions, milestones, recurring plans, plan sessions, plan check-ins, focus-session records, achievements, scoring inputs, and other information you enter into the application.

Buddy and shared information

If you connect a Buddy, Ahd processes the pairing relationship and the information you explicitly choose to make visible. Private Goals are not made visible to your Buddy. Progress-only and shared visibility settings determine what the Buddy experience may display.

Connected device data

If you connect a supported health, fitness, or device-usage source, Ahd may receive normalized daily values needed for goals you choose to automate. The app is designed to store the limited summaries needed for those goals rather than exposing raw device datasets to your Buddy.

Technical data

Ahd uses browser storage such as localStorage, IndexedDB, caches, and service-worker storage for session state, preferences, offline/PWA behavior, and trusted-device vault features. Standard hosting, authentication, and database providers may also process network and security logs such as timestamps, IP addresses, and request metadata as part of operating their services.

3. How Ahd uses information

Ahd uses information only as reasonably necessary to provide and secure the product, including to:

• authenticate users and keep accounts signed in;
• store and display goals, plans, progress, and focus activity;
• calculate deterministic Ahd scores, points, trends, and insights from your own activity;
• support Buddy accountability according to the visibility choices you make;
• sync optional connected sources and Google Calendar features that you enable;
• protect the service against abuse, data loss, and unauthorized access; and
• maintain, troubleshoot, and improve application reliability.

Ahd does not sell personal information and is not designed to use personal information for third-party targeted advertising.

4. Private Goals and client-side encryption

Private Goal content is designed to be encrypted in your browser before the protected payload is stored in the database. A randomly generated data-encryption key encrypts the private content, and a password-derived key is used to wrap that encryption key.

• The raw Private Goal encryption key is not intended to be stored in Supabase.
• Supabase stores encrypted payloads, vault metadata, and minimal marker information required for synchronization.
• Trusted-device support may keep a wrapped key on the device using browser security primitives; it does not intentionally persist the raw vault key.
• Logging out clears decrypted Private Goal state from the active session.

No security system is infallible. You are responsible for choosing a strong password and protecting access to your devices and account.

5. Google Calendar data

Google Calendar integration is optional. Ahd requests Google access only when you choose to connect it.

When connected, Ahd may use Google Calendar permissions to:

• list calendars that you can write to so you can choose a destination calendar;
• create recurring events for Ahd Plan sessions that you explicitly choose to sync;
• update those events when the corresponding Ahd Plan changes; and
• delete events created by Ahd when you remove a synced Plan from Google Calendar.

Ahd stores limited synchronization metadata such as the selected calendar identifier, calendar name, external Google event identifiers, and sync state so that updates do not create duplicate events.

In the current browser-based integration, Google OAuth access tokens are kept only for the active authorization session and are not intentionally persisted in Ahd's database or localStorage.

6. When information is shared

Ahd may share or make information available only in the following limited situations:

• Service providers. Infrastructure providers such as Supabase may process account, authentication, database, and security data to operate Ahd.
• Google. When you enable Google Calendar, Ahd sends the event details needed to create, update, or remove the Plan events you requested.
• Your Buddy. Information is shown according to the per-goal sharing choices you make. Private Goal content is excluded.
• Legal and safety requirements. Information may be disclosed when required by applicable law or when reasonably necessary to protect users, the service, or others.
• Business transfer. If responsibility for Ahd is transferred to another operator, relevant data may transfer with the service subject to applicable law and this policy or a replacement policy disclosed to users.

7. Data retention

Ahd retains account and application data for as long as reasonably necessary to provide the service, maintain security and integrity, comply with legal obligations, and resolve disputes. Some local browser data remains on your device until it is cleared by Ahd, the browser, or you.

Connected-service access can be revoked through the provider. Removing Google Calendar access prevents future API access, but it does not automatically delete the Ahd account or unrelated data already stored in Ahd.

8. Your choices

• You choose which goals are private, progress-only, or shared.
• You choose whether to connect a Buddy.
• You choose whether to connect supported health/device integrations.
• You choose whether individual Plans are added to Google Calendar.
• You can revoke Google Calendar access through your Google Account permissions.
• You may request access, correction, deletion, or other privacy rights available under applicable law through the support contact published with the Ahd service.

9. Security

Ahd uses technical controls including authenticated access, database row-level security, encrypted transport provided by its hosting stack, restricted API permissions, and additional client-side encryption for Private Goals. Security measures reduce risk but cannot guarantee absolute security.

10. Children

Ahd is not directed to children who are below the age at which they can lawfully consent to use an online service in their jurisdiction without appropriate parental or guardian involvement.

11. Changes to this policy

This policy may be updated as Ahd changes. The effective date at the top of this page will be updated when material changes are published.

12. Contact

For privacy questions or requests, use the support contact published with Ahd on the application's website, distribution page, or OAuth consent screen.