Privacy Policy

What we collect

Tamiro collects only what the app needs to function.

• Account info. Your email address and username, provided when you sign up.
• Task data. Task names, durations, timestamps, and completion status. This is what drives your XP and skill progression.
• Session reflections. How a session felt, and a short note if you choose to add one. Only you can see them, and your note is never sent as analytics.
• Progress data. XP, skill levels, streak count, credits, and inventory items.
• Scheduled sessions. Who you invite to a Focus Together session, the time and length you pick, and whether it's accepted.
• Notification data. Your push token and time zone, only stored if you opt in to push notifications.

We don't collect your location, your contact list, or anything unrelated to the app.

How we use your data

• To run Tamiro and give you your XP, loot, and skill progress.
• To send session reminders and Focus Together invites if you have notifications turned on.
• To improve the app. We look at how people use Tamiro in aggregate, never at what you personally typed into your tasks or notes.
• With friends — if you add someone, they can see your weekly leaderboard ranking and active-days count, when you're currently focusing (PRO+ friends also see the skill and how long), and any Focus Together sessions you schedule with them, including whether you've started. You can see the same about them.

We don't sell your data. We don't use it for ads, and we don't track you across other apps or websites.

Third-party services

• Clerk. Handles sign-up and login. Stores your email address and authentication details.
• Railway. We host the backend and database on Railway. Your data stays on EU-compliant servers.
• Vercel. The frontend is served through Vercel.
• RevenueCat. Processes subscription purchases and receipts. Receives your account ID and purchase history, never your payment card details — those stay with Apple.
• PostHog. Product analytics, hosted in the EU. Receives your account ID together with events like session length, skill, and subscription tier — task names and other text you write are never sent as analytics events. PostHog is also used for error tracking: when something goes wrong, the error message and a code-level stack trace are sent, which are technical by nature and not filtered the way analytics events are.
• Expo. Delivers push notifications. Receives your device's push token and the notification text, which can include a friend's username.

Each provider operates under their own privacy policy and processes data only on our instructions.

Why we're allowed to process it

• To provide the service. Running your account, sessions, and progress is necessary to deliver what you signed up for (GDPR Art. 6(1)(b)).
• Legitimate interest. Aggregate analytics that tell us which features are used, so we can improve the app (GDPR Art. 6(1)(f)).
• Consent. Push notifications, which you turn on yourself and can turn off at any time (GDPR Art. 6(1)(a)).

Your rights (GDPR)

If you're in the EU or EEA, you have the following rights:

• Access. Ask for a copy of all personal data we hold on you.
• Rectification. Ask us to correct anything that's wrong.
• Erasure. Delete your account and everything in it. You can do this from Settings at any time.
• Portability. Receive your data in a portable format.
• Restriction. Ask us to pause processing while a dispute is being resolved.
• Objection. Object to processing based on legitimate interests.

Data retention

We keep your data for as long as your account is active. Delete your account and everything goes with it: task history, session reflections, XP, subscription info, all of it. Once it's gone, it's gone.

Encrypted database backups may hold deleted data for up to 30 days before they roll over. Analytics events are retained for 12 months.

Security

All data is transmitted over HTTPS. Login is handled by a dedicated authentication service, so no passwords are ever stored by us directly.

Questions or data requests? Contact us