Privacy policy
Last updated 2026-11-04. This instance is run by Jack Hale. Contact: ours.astride300@passmail.net.
Ours is built so that the people running it cannot read what you and your partner plan. Your plans, lists, comments and check-ins are encrypted on your devices before they leave them, with keys only your devices hold. This page lists everything the server does see.
What we cannot see
- The content of anything you write: titles, notes, places, times of plans, list items, comments, check-in answers, names you give each other.
- Your encryption keys and your 12-word recovery phrase. We store your key backup only in a form sealed with that phrase. If you let a passkey unlock your keys, we also store a copy sealed with a key only that passkey can produce, after your face, fingerprint or device passcode.
- The contents of calendars you import from a file.
What we store, and why
| Data | Why | How long |
|---|---|---|
| Your email address | Sign-in links and important account notices | Until you delete your account |
| Passkey public keys, and which provider made each (for example iCloud Keychain or a password manager) | Passkey sign-in (no biometrics ever reach us), and telling your passkeys apart | Until you remove the passkey |
| Devices and sessions (a device name you choose, sign-in times; session tokens stored only as hashes) | Keeping you signed in, letting you see and remove devices | Sessions end after 90 days unused |
| Which accounts share a space | Syncing between you and your partner | Until you leave the space |
| Encrypted records | Sync and backup. We can see how many there are, roughly how big (rounded up to 64 bytes), when and by whom they changed, whether one is private, and whether it was deleted | Until deleted by you |
| Encrypted key backup | Restoring on a new device with your recovery phrase | Until you delete your account |
| Passkey unlock copies, only if you turn this on, with the key versions each holds; and when a device fetches one | Unlocking your keys on a new device with a passkey; sealed with a key only that passkey can produce | Until you turn it off, remove the passkey, change your keys or delete your account |
| When you last changed your keys | Keeping passkeys from before the change from unlocking | Until you delete your account |
| Invite links (encrypted key material) | Pairing and linking devices | 24 hours, erased once used |
| Notification settings: this device's push address, and your quiet hours and time zone if you set them | Sending notifications, and holding your partner's until quiet hours end | Until you turn notifications off or remove the device |
| Reminder times (the text is encrypted) | Sending a reminder while your phone is asleep | Deleted once sent |
| Rate-limit counters (salted hashes, never your IP or email) | Stopping abuse | One day |
| Last activity date | Removing abandoned accounts | We email you at 12 months of inactivity and delete the account at 13 months |
Optional features that reveal more
- Camera. Only if you choose "Scan a code" to link a new device, and only while it's open. The picture is read on your device to find the code and is never stored or sent.
- Calendar subscription links. If you subscribe to an outside calendar by link, our server fetches it for you, so it sees that link and that calendar's contents while passing them on. They are not stored or logged. Importing a file instead keeps everything on your device.
- Reminders and notifications. To send a reminder while your device is asleep, the server must know when it fires and which device to wake, and it sees when you and your partner notify each other. The text stays encrypted; not even the push service can read it.
- Calendar feed for other apps. If you turn this on, your busy times (start and end only) are stored unencrypted so your calendar app can read them. Turning it off deletes them.
What we never do
- No analytics, trackers or advertising. Fonts and code are served from this site; the only outside script is the optional bot check on the sign-in page.
- No selling or sharing of data. There are no investors to answer to; the software is free.
- Request logs record only the route, status and timing, never IP addresses, request bodies or tokens. The hosting platform's own request logs are switched off.
Who else handles data
- Cloudflare hosts the server and database (data stored in the United States). Like any network, it sees IP addresses in transit.
- Our email provider (Resend) sees your email address and when we send you a link.
- Your browser's push service (Apple, Google or Mozilla) carries encrypted notifications and sees when they are sent.
- GitHub Pages serves the app's files and sees the usual web request details.
- Cloudflare Turnstile, if this instance uses it, checks the sign-in page for bots. It runs only on that page and sees what a web request shows (your IP address and browser); it does not use cookies to track you.
Your choices and rights
- Export everything you can see, at any time, from Privacy in the app.
- Delete your account from Privacy in the app. It takes effect immediately: your account, devices, private records and key backup are deleted, and shared records you created stay with your partner, with your name removed. Backups of the database roll off within 30 days.
- Ask us what we hold about you, or to correct or delete it, at the contact above. Because we cannot read your content, the table above is the complete answer.
- If you are in the UK or EU you can complain to your data protection authority.
Age
Ours is for people aged 16 and over.
Changes
We will tell you in the app before a change to this policy takes effect. Every version is kept in the public source history.
Ours is free, open-source software (AGPL-3.0-or-later). Source code