Privacy, written for people.

Account and workspace

This policy applies to lim, also identified as Ferrari/Daily Habits during development, bundle ID com.generativesynesthesia.dailyhabits. Generative Synesthesia is the developer brand. The developer identified for this app in App Store Connect is responsible for the service.

Apple or Google sign-in supplies an account identifier and, when available, name and email. A secure, short-lived link can recover a previously established channel account. Sign-in does not automatically connect Google Calendar. Tasks, routines, preferences, conversations, assistant memory, authorized notes, reminders and action records are stored in Supabase under your account. The app also keeps local data for display and recovery.

Lim processes an installation identifier, notification token and authorization state to deliver requested reminders and keep them associated with the correct installation. Apple App Attest supplies an app-integrity key and assertions used to protect AI requests from abuse; the private key remains in the device Secure Enclave. Security controls also process request IP addresses, timestamps, rate-limit counters and limited technical failure records. These records do not intentionally include message, note, task, audio, photo or calendar content.

Sharing with service providers

Lim requires each listed recipient, including Supabase, OpenAI, Mixpanel and RevenueCat, to provide the same or equivalent data protection described in this policy and required by Apple's App Review Guidelines within its role. Sharing is limited to the purposes below. International processing follows applicable provider terms and transfer safeguards.

Supabase — Data: account identifiers/content, authorized calendar credentials/context, sent audio/images and security records. Purpose: hosting, authentication, storage and server processing. Location: Lim's project is hosted in the United States (us-east-2); support may operate internationally. Retention: account content until deletion; unsent audio 24 hours, optional feedback 180 days, limited financial/security records up to 35 days after deletion unless legally required longer. Controls: disconnect integrations, withdraw AI authorization or delete the Lim account in the app; these are separate actions.

OpenAI — Data: messages and relevant tasks, authorized notes, memories/preferences, selected calendar names and event titles/times/time zones, sent audio and images submitted for AI analysis. Purpose: requested replies, organization, follow-through, transcription and analysis. Location: remote international processing, including the United States. Retention: text/image/embedding abuse logs normally up to 30 days, with legal/security exceptions; transcription has no documented application-state or abuse-monitoring retention. Lim's saved history follows this policy. Controls: separate AI authorization before the first request, including before sign-in; withdraw it in Privacy & Data to block new account AI requests after server confirmation.

Mixpanel — Data: optional app-open/screen-flow events, random installation reference and technical delivery/session identifiers. Purpose: improving navigation and onboarding. Location: United States. Retention: up to five years unless deleted earlier; older events are not linked to account deletion. Controls: disabled by default; enable/disable Allow usage analytics in Settings → Privacy → Privacy & Data, separately from AI and Terms. For access/deletion of older events, contact privacy support with the in-app installation reference.

RevenueCat — Data: Lim account identifier, products, transactions/receipts, dates and subscription status. Purpose: verify access, restore purchases and prevent fraud. Location: international processing, including the United States. Retention: provider purchase-restoration, security and legal duties; account deletion does not automatically erase purchase records. Controls: manage/cancel with Apple; use Lim account deletion and privacy support for eligible records.

Apple — Data: sign-in identifier/name/email when used, App Store transactions/receipts, notification tokens/delivery data and App Attest integrity assertions. Optional Apple Calendar is read on the device; selected context reaches Lim/OpenAI only when enabled and needed. Purpose: sign-in, purchases, notifications, integrity and calendar features. Location/retention: Apple's regions, settings and legal duties; external purchases/events may remain after Lim deletion. Controls: iOS permissions, Apple account connections/subscriptions and Lim account deletion.

Google — Data: sign-in identifier/name/email when used; only with a separate Calendar connection, credentials, selected calendars and event data. Purpose: authentication and requested calendar features. Location/retention: international provider processing under Google's rules; Lim removes saved credentials/cache on disconnection, while Google events and required records remain under Google's retention. Controls: disconnect Calendar in Lim or revoke in Google Account connections. Sign-in does not connect Calendar.

Meta/WhatsApp — Earlier test links only; the first iOS release offers no new WhatsApp connection controls. Data: linked identifier/number and messages exchanged with Lim. Purpose: conversations in the older integration. Location/retention: international processing under Meta/WhatsApp terms; delivered messages remain until deleted in that service, Lim history until deleted in Lim. Controls: privacy support can disconnect old links; delete delivered messages in WhatsApp.

Microsoft — Data: profile/account identifiers, read-only email data and authorization/session credentials, only when you connect Outlook/Hotmail/Microsoft 365. Purpose: authorized mailbox access and ongoing synchronization. Location/retention: Microsoft's international service infrastructure and applicable provider retention; Lim removes its stored connector data on disconnect or account deletion. Controls: disconnect in Lim or revoke the application's delegated access in your Microsoft account.

Your initial plan, before sign-in

When you ask Lim to prepare an initial plan before signing in, your task description, selected intention, time zone and language are sent through our server to the configured AI provider. The service uses the current time to interpret dates and returns a draft for you to review. This request does not itself create an account, save tasks to an account or activate reminders.

Audio submitted in this initial-plan flow is sent to OpenAI for transcription. The pre-account service does not create a stored chat recording or conversation message from that audio. Voice messages in the signed-in chat are stored with your account history as described below.

To prevent abuse, these services process installation identifiers and request IP addresses and store hashed identifiers with request-limit counters. We do not include task text, audio or provider responses in our application error logs. Processing and retention by the AI providers follow the applicable service terms.

Optional onboarding feedback

If you select Another reason in the onboarding questions and continue, we save the selected question and option together with any explanation you choose to provide, to understand users’ needs and improve the app. Writing an explanation is optional. The app can keep a pending submission on the device and send it when a connection is available.

This feedback is stored separately in Supabase with a random session identifier, a submission identifier, language, question-copy version, submission date and whether it came from onboarding or a development preview. We do not automatically attach your name, email address or Lim account identifier to this record. Free text may contain personal information you choose to write; the feedback is not anonymous. Project administrators can access it for product research. A daily retention job deletes records older than 180 days.

Deleting your Lim account data does not automatically delete this pre-account feedback because it is not linked to the account. For privacy requests concerning feedback, use the contact below; we may need information that helps locate the submission. The separate abuse-prevention controls described above also apply.

Conversations, notes, memory and AI

Messages, replies, sent voice recordings, transcriptions and action history are saved in your cloud account. Lim processes your request with recent conversation and relevant account information, such as tasks, preferences, saved memories, notes you allow the assistant to use, and connected calendar details. It can retrieve older conversation excerpts and authorized notes when relevant. Conversation history from earlier testing remains until you delete it or your Lim account.

Saved memories are preferences or information used to personalize future replies. In Settings → Privacy → Privacy & Data → What Lim knows about me, you can review, edit or delete them. Deleting a saved memory stops its use as an active memory, but does not erase the messages or notes where you originally shared the information. Minimal change and deletion records may remain to prevent duplicate or stale updates.

Google Calendar, only when connected

A separate Google authorization allows lim to read your calendar list and read or change events. You choose up to ten calendars and an optional destination for new events. The server stores encrypted authorization tokens, account email, calendar identifiers and titles, event identifiers, titles, times, time zones, availability and synchronization records. Routine synchronization covers the previous seven days and next ninety days; specific assistant queries can request other limited date windows.

The connection continues working when the iPhone is closed. Calendar titles and relevant event details can be supplied to the configured AI provider to answer your requests and avoid scheduling conflicts. Raw authorization tokens, attendee lists, locations and event descriptions are not supplied as calendar context. Event content cannot authorize actions. lim creates, changes or deletes Google events only on your request; this integration does not invite participants or send invitation emails.

Google user data is used to provide the calendar and personal-assistant features you request, not for advertising or training generalized AI models. lim’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.

Disconnect in Settings → Connections → Google Calendar to remove lim’s saved credentials and calendar cache. Google events remain in Google Calendar. You may also revoke authorization in your Google Account connections. Conversation and action history may still contain details of your earlier calendar requests until you erase your lim data.

WhatsApp connections from earlier versions

Connecting WhatsApp links your WhatsApp identifier and number to your Lim account. Messages you send to Lim and its replies are handled by Meta/WhatsApp and our server, and become part of the same cloud conversation history. They are processed by the AI service in the same way as requests from the app. This connection does not give Lim access to your other WhatsApp chats or your address book.

WhatsApp connection and management are not available in the first iOS release. If you previously linked WhatsApp during testing, contact privacy support to manage or disconnect that link. Disconnecting stops future use of the link; existing Lim history and messages already delivered to WhatsApp remain until deleted in the respective service. Reminders use the app or the Google Calendar setup; WhatsApp reminder delivery is disabled in the current version.

Apple Calendar and other permissions

Apple Calendar is a separate, optional device integration. EventKit reads and changes require iOS permission and execution on the iPhone. If you enable calendar context for chat, event titles and timing are sent to the server and AI provider. Direct Timeline editing uses the Apple Calendar editor. Turning off Google Calendar does not turn off Apple Calendar, or vice versa.

For voice messages in the signed-in chat, microphone recordings are sent only when you choose to send them. Sent audio is stored privately in Supabase and sent to OpenAI for transcription; the transcript becomes part of the conversation. Unsent uploads are removed after 24 hours. Camera and photo access support optional completion evidence; optional AI photo review processes the submitted image. Notifications and alarms use the permissions and settings you enable.

AI, service providers and data sharing

OpenAI is the AI provider used by this release. Its API processes the content needed to answer requests, transcribe sent audio and find relevant information. OpenAI states that API data is not used to train models by default unless the API customer opts in to sharing. This notice describes those default terms; it does not promise zero provider retention.

For text, image and embedding requests, OpenAI may retain content in abuse-monitoring records, normally for up to 30 days, with longer retention possible for legal or security reasons. Lim requests that generated responses not be stored as API application state, but that does not remove all security logs or temporary processing caches. The transcription API documents no application-state or abuse-monitoring retention; audio and history saved by Lim follow our separate rules below.

Encrypted transport, storage and access controls protect the data, but OpenAI must process the content to provide the service. Provider security monitoring may involve authorized access. These safeguards do not make submitted content anonymous or prevent all provider access. Official references: https://developers.openai.com/api/docs/guides/your-data and https://openai.com/security-and-privacy/.

Before activating AI features, including the initial plan before sign-in, Lim asks your explicit permission to send the described content and relevant context to OpenAI through Supabase. The assistant depends on that processing and is not activated without your permission. Accepting the Terms of Service or purchasing a subscription does not replace this permission. Before sign-in, your choice is kept in the onboarding draft on the device. For a signed-in account, the server records the AI permission, its version and date; the app also keeps local agreement records.

To withdraw permission, open Settings → Privacy → Privacy & Data → Withdraw AI processing authorization. After the server confirms, the pause blocks new AI requests for your account, including scheduled AI follow-ups, and signs you out of this iPhone. If the connection fails, the app reports that confirmation is pending and keeps the pause request for retry. Scheduled AI may continue until the server confirms. A pause cannot recall content already sent to a provider or guarantee cancellation of processing already in progress.

Pausing AI does not erase your data, cancel your subscription, disconnect Google Calendar or delete existing tasks, calendar events or reminders that do not require new AI processing. Manage these separately in Connections, your agenda, account deletion controls and Apple subscription settings. Account, deletion and subscription controls remain accessible without activating the assistant.

Supabase stores the account and content described above and runs the assistant service. OpenAI processes messages and the relevant context needed for replies and requested actions; OpenAI also transcribes sent voice messages. AI requests are processed remotely, not solely on the iPhone. Lim requires its service providers to process personal data only for the contracted service, apply protections equivalent to those described in this policy and comply with applicable privacy and security requirements.

We disclose Google user data only to the service providers needed to deliver the features you request: Supabase hosts authentication, encrypted credentials, protected storage and server functions; the configured AI provider, OpenAI, may process selected calendar names, event titles and times that are relevant to answer a request or avoid a scheduling conflict. Raw Google authorization tokens, attendee lists, locations and event descriptions are not disclosed to the AI provider. Google processes authorization and Calendar API operations under its own terms.

These providers process data on our behalf to operate Lim. We do not sell Google user data, disclose it to advertising platforms or data brokers, or use it for personalized advertising, credit decisions, or training generalized AI models. We may disclose limited data when required by law or necessary to investigate security abuse. No other third-party sharing occurs unless we first obtain the user’s explicit consent.

Purchases and subscriptions

Apple processes App Store purchases. RevenueCat receives your Lim account identifier, subscription product, transaction and receipt information, purchase and expiration dates, and subscription status to verify access, restore purchases and prevent fraud. Lim does not receive your payment-card details. Deleting your Lim account does not cancel an App Store subscription or automatically erase records Apple or RevenueCat must retain. Manage or cancel the subscription in your Apple account settings.

Your controls and privacy requests

Device permissions can be reviewed in iOS Settings. Manage daily planning, quiet hours and notifications in Settings → Preferences, and calendar access in Settings → Connections. For a WhatsApp link established during testing, contact privacy support. Notes have their own controls for whether the assistant may use them. You can disconnect optional services without signing out of Lim.

Use the contact below to request access, correction, deletion or a copy of your data, withdraw consent where processing relies on it, or exercise other rights available under the law that applies to you. We may need to verify account ownership before acting. We use data to provide requested features, maintain security and reliability, and meet legal obligations. No separate advertising opt-out is needed for this version: we do not sell personal data, use it for targeted advertising, or track you across other companies’ apps and websites.

Retention, deletion and security

Signing out ends the app session and device activity but does not delete your Lim account. Settings → Privacy → Account, privacy & deletion → Delete Lim account permanently removes Lim tasks, notes, conversations, recordings, memories, connections, queued work and local Lim data. Deletion may finish asynchronously; Lim keeps the account closed while cleanup completes and confirms completion in the app. Events already saved in Apple or Google Calendar remain in those services. The shared Generative Synesthesia sign-in identity and data from other products remain available.

A minimal deletion receipt is retained to prevent erased Lim data from being restored. Limited financial and security records are retained for up to 35 days after deletion, unless a longer period is legally required. Unsent audio uploads are removed after 24 hours, optional onboarding feedback after 180 days, and account content remains until you delete the item or your Lim account. Provider records that must remain for purchase restoration, fraud prevention or legal compliance follow the provider’s applicable retention duties. The service uses encrypted transport, account isolation and restricted server credentials; Google refresh tokens are encrypted at rest. Providers may process data internationally. No system guarantees absolute security.

Contact and updates

The app is not directed to children under 13. For access, correction, portability, deletion, consent withdrawal or support, contact pull.notifications.app@gmail.com. During TestFlight testing you may also use Send Beta Feedback. Never send passwords, authorization codes or private content in a support report. Generative Synesthesia is the developer brand; the developer identified for Lim in the App Store listing is the service operator and data controller. This page is updated when the service changes.

Minimal product analytics with Mixpanel

Only if you enable Allow usage analytics in Settings → Privacy → Privacy & Data, Lim uses Mixpanel for app opens, onboarding start/completion and screen flow, and views of Timeline, Notes and Messages. A random installation reference and technical delivery/session identifiers link events on one installation, without linking to a Lim account or across devices.

Names, email addresses, onboarding answers, messages, voice, notes, task titles, calendar contents, free text, purchases and subscription outcomes are not sent to Mixpanel. Automatic interaction capture, profiles, session recording, advertising identifiers, advertising integrations, device details and IP-based location enrichment are disabled. Network infrastructure necessarily receives an IP address while delivering an event, but Lim does not store it as an event property or use it to derive location.

These analytics are disabled by default and require a separate, optional choice, independent of AI authorization, Terms and subscription. Before that choice the app does not initialize Mixpanel or send events. Earlier events are not replayed. You can disable future collection immediately in the same in-app control, without contacting support or losing access. For access/deletion of older events, contact pull.notifications.app@gmail.com with the installation reference shown in Lim.

Mixpanel processes these events in the United States as Lim's service provider under applicable data-processing and transfer safeguards. The current project default can retain event data for up to five years unless it is deleted earlier. Because these events are deliberately not linked to a Lim account, deleting the account does not automatically identify or delete them; a separate privacy request can be used.

Optional Gmail and Outlook email connections

Connecting Gmail or Outlook/Hotmail/Microsoft 365 is optional and requires separate provider authorization. Signing in or connecting a calendar does not connect a mailbox. Lim requests Gmail read-only access or delegated Microsoft Mail.Read and basic profile/session permissions. This version cannot send, reply, delete or modify mail.

Lim reads message headers, text and structured invitations from the last 30 days and follows new mail, including archived messages and folders. Spam, trash, sent mail and drafts are excluded. Attachments and external links are not analyzed. Relevant text is processed by OpenAI to identify bills, renewals, deadlines and meetings; findings are estimates when indicated and require your review before saving to Lim or exporting through an authorized calendar connection.

Supabase stores encrypted authorization credentials, your connected address, synchronization identifiers/cursors, processed-version records, extracted findings/evidence, preferences, cost records and action receipts under your account. Credentials are never sent to OpenAI. Disconnecting stops pending processing and removes connector credentials and extracted data; accepted tasks/events and generic chat history remain until separately deleted. Lim account deletion also removes connector data. You can revoke access in your Google or Microsoft account. Optional email alerts are independent of the daily summary; WhatsApp delivery requires its own connected account and opt-in and does not include message senders, amounts or email contents.

Lim's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements https://developers.google.com/terms/api-services-user-data-policy. Google user data is not used for advertising or to train generalized AI/ML models. Human access is limited to your explicit permission or necessary security/legal purposes allowed by that policy. Email data is shared only to provide the user-facing features and purposes described here, subject to the provider protections and retention described above.