Privacy
Last updated
This is the whole of it, written to be read rather than to be survived. If anything below turns out not to match what the app does, the app is the bug and we want to hear about it.
The short version
- Your tasks never leave your device. There is no account, no login, and no copy of your lists on any server of ours.
- What you type into the dump box is sent to an AI to be turned into tasks, and is not stored afterwards.
- Google Calendar is off unless you turn it on, and when it is on, the app can only touch a calendar it made itself.
- There is no tracking of any kind. No analytics, no advertising, no cookies, no third-party scripts on the page.
Your tasks and your profile
Everything on your lists — the tasks, their dates, the steps, the name and face on your profile — lives in your browser's local storage on the device you typed it on. It is not sent anywhere, not backed up, and not readable by us. That is also the trade-off: clear your browser data and it is gone, and there is nothing we can do to bring it back.
The dump box, and the AI that sorts it
When you press the button, the text you wrote is sent to our server and passed straight to Anthropic's API, which reads it and returns a structured list of tasks. That round trip is the feature; there is no way to have the sorting without it.
We do not keep the text. It is held in memory for the length of the request and not written to any database of ours. Anthropic processes it as our service provider, and does not train models on it. If the network is down or the AI is unreachable, the app falls back to a much simpler parser that runs entirely in your browser and sends nothing — you will see an "Offline mode" note when that happens.
Practically: treat the dump box the way you would treat any AI chat. It is a good place for "chase the landlord about the boiler" and a bad place for your passwords.
Google Calendar
This is off until you link it, and the app works fully without it.
When you link it, the app asks Google for one narrow permission:
calendar.app.created. That lets it create its own calendar,
named my.adhd, and manage events on that one calendar.
It cannot read, change or delete anything on the calendars you already had.
This is enforced by Google, not merely promised here.
For each task that has a date, the app writes an event to that calendar containing the task's title, its first step, its rough duration, its category and its energy level. When you tick the task off, delete it, or clear your lists, the event is deleted too. Nothing is ever read back out of your calendar, so the app never learns anything about the rest of your diary.
The access token Google issues is held in your browser's memory for the hour it is valid and is never written to disk. We never see it: the calls go from your browser straight to Google and do not pass through our servers. Unlinking forgets the connection and tells Google to revoke the token; the events already in your calendar are left alone, and you can delete the my.adhd calendar yourself at any time from Google Calendar. You can also revoke the app's access from your Google account permissions page.
Feedback
If you send a note from the feedback screen, we store the text of it. We do not store your name, your email, or anything that identifies you, because the app has never asked you for any of those.
We do store a one-way, salted hash of your IP address alongside it, for one reason: the box takes one note per person per day, and something has to count. The hash cannot be turned back into an address, it is never shown to anyone, and it is not used to link your notes to each other or to anything else. Notes are stored with Supabase, our database provider.
Hosting and logs
The site is hosted on Vercel, which keeps ordinary server logs — IP address, timestamp, which page was requested — as every web host does. We do not add anything to those logs, do not analyse them, and cannot use them to identify you.
What we do not do
- No analytics. Not Google Analytics, not a privacy-friendly alternative, not a page-view counter. There is genuinely nothing.
- No advertising, and no data sold, rented or shared with anyone for it.
- No cookies. The app stores things in your browser, but nothing is sent to a server, so no cookie banner is needed and none is shown.
- No third-party scripts on the page — except Google's own sign-in library, which is loaded only at the moment you press "Link Google Calendar", and never before.
- No profiling, no automated decisions about you, and no attempt to work out who you are.
Children
This is not built or intended for children under 13, and we do not knowingly collect anything from them. Since we do not collect identifying information from anyone, we have no way to detect age — which is a limitation, stated plainly rather than dressed up.
Your rights over your data
Most of the usual rights — access, correction, deletion, portability — are unusual here because we mostly do not hold anything to exercise them against. In practice:
- Your lists: yours already. "Clear everything" on the profile screen deletes them, as does clearing site data in your browser.
- Your calendar events: unlink on the profile screen, then delete the my.adhd calendar in Google if you want the events gone as well.
- A feedback note: we cannot find it by asking you who you are, because we do not know. Quote it back to us and we will delete it.
If you are in the UK, the EU, or anywhere with similar law, you also have the right to complain to your data protection authority.
Changes
If this changes in a way that affects what happens to what you type, the date at the top changes and the change is described here rather than quietly folded in.
Contact
Questions, corrections, or a note to delete: hello@myadhd.my.