‍ ‍

PRIVACY POLICY

‍ ‍

Effective Date: Upon first availability of the App
Last Updated: June 23, 2026

‍ ‍

GarbageApps LLC ("we," "us," or "our") operates the Apical mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App. Please read this Privacy Policy carefully. By using the App, you agree to the collection and use of information in accordance with this policy.

‍ ‍

If you do not agree with the terms of this Privacy Policy, please do not access or use the App.

‍ ‍

1. INFORMATION WE COLLECT

‍ ‍

We may collect information about you in a variety of ways. The information we may collect via the App includes:

‍ ‍

1.1 Personal Information

‍ ‍

When you create an account, we may collect personally identifiable information, such as your name and email address. You may sign in using one of the following methods:

‍ ‍

• Apple Sign In: We receive only the information you authorize Apple to share, which may include your name and email address (or a private relay email address if you choose to hide your email).

• Email/Password Registration: We collect the email address and password you provide. Passwords are securely hashed and stored; we do not store plaintext passwords.

‍ ‍

1.2 Email Account Credentials

‍ ‍

If you connect email accounts for the Inbox feature, we collect and store email account credentials to retrieve and send emails on your behalf. This includes:

‍ ‍

• Google OAuth: If you connect a Gmail account, you authenticate through Google's OAuth 2.0 flow. We receive an access token and refresh token from Google. We do not receive or store your Google password. Tokens are stored in the iOS Keychain on your device by default, and — if you enable background mail refresh or new-mail push notifications — your refresh token is additionally stored in encrypted form on our backend (see Section 4.10).

• Microsoft OAuth: If you connect an Outlook, Hotmail, or Live account, you authenticate through Microsoft's OAuth 2.0 flow. We receive an access token and refresh token from Microsoft. We do not receive or store your Microsoft password. Tokens are stored in the iOS Keychain on your device by default, and — if you enable background mail refresh or new-mail push notifications — your refresh token is additionally stored in encrypted form on our backend (see Section 4.10).

• IMAP/SMTP Password Authentication: If you connect an email account using password-based authentication (e.g., iCloud, Yahoo, AOL, or custom IMAP providers), we store your email address and password only in the iOS Keychain on your device. IMAP/SMTP connections are made directly from your device to the email provider over encrypted (TLS/SSL) connections.

‍ ‍

Email credentials are used solely for retrieving, displaying, and sending emails within the App. We do not use email credentials for any other purpose, and we do not read or analyze email content for advertising, profiling, or data mining. By default, OAuth tokens and IMAP/SMTP passwords are stored only in the iOS Keychain on your device. If you enable background mail refresh or new-mail push notifications for a Gmail or Outlook account, your OAuth refresh token is additionally stored on our backend in encrypted form (AWS KMS envelope encryption: a unique per-row data encryption key encrypts the token with AES-256-GCM, and that key is itself wrapped by a KMS master key) so we can fetch new mail while the App is closed (see Section 4.10). You can turn this off at any time, and disconnecting the account or deleting your account removes the stored token. IMAP/SMTP passwords are never sent to our backend.

‍ ‍

1.3 Health and Wellness Data

‍ ‍

If you choose to connect Apple HealthKit, we read certain health metrics for display and analysis within the App and, with your separate permission, write back certain values you log yourself (your water intake and body weight) so they stay in sync with Apple Health. The metrics we may read include:

‍ ‍

• Step count

• Active energy burned (calories)

• Exercise minutes

• Body weight measurements

• Heart rate data (if available)

• Sleep analysis data (if available)

‍ ‍

IMPORTANT: Health data read from or written to HealthKit is stored exclusively on your device. We do not transmit, sell, share, or upload HealthKit data to any external server, cloud service, third-party analytics provider, or advertising network. HealthKit data is never used for advertising or marketing purposes. This is in strict compliance with Apple's HealthKit guidelines.

‍ ‍

Wellness data you enter manually in the App (for example, body weight, water intake, nutrition, and workouts you log yourself) is user-generated content rather than HealthKit data. It is stored on your device and, if you enable optional cloud sync (a Live Well feature), synced to your account as described in Sections 1.6 and 3 — but it is never used for advertising and is never combined with or sold alongside HealthKit data.

‍ ‍

1.4 Calendar Data

‍ ‍

If you grant calendar access, the App reads events from your device calendars (via EventKit) to display them alongside your tasks and appointments in the Planner. The App may also write events to your device calendars when you create or sync appointments. Calendar data accessed from EventKit:

‍ ‍

• Is used solely for display and synchronization within the App

• Is not transmitted to our servers or any third party

• Remains under the control of your device's calendar system

‍ ‍

You may revoke calendar permissions at any time through your device's Settings > Privacy & Security > Calendars.

‍ ‍

Separately, if you connect a Google account in the Inbox feature, you may grant the App access to your Google Calendar through the Google Calendar API (the calendar.events scope). This lets the App display your Google Calendar events alongside your tasks and create, update, or remove events when you schedule or reschedule appointments in the App. Google Calendar data is exchanged directly between your device and Google's servers using your OAuth token; it is used only to provide these in-app calendar features and is never sold, used for advertising, or used to train AI models. You can revoke this access at any time at https://myaccount.google.com/permissions or by disconnecting the account in the App.

‍ ‍

1.5 Location Data

‍ ‍

With your permission, we collect your device location to provide weather forecasts and location-based features. Location data is:

‍ ‍

• Used to query weather forecasts from Apple Weather (WeatherKit), with Open-Meteo as a fallback, and to retrieve weather alerts from the U.S. National Weather Service if you enable them

• Used for location search suggestions via Apple MapKit (processed on-device and through Apple's servers)

• Used to trigger geofenced reminders for tasks, appointments, and shopping lists when you set a location reminder

• Not stored permanently on our servers, except that if you turn on weather alerts, the single weather location you select is stored on our backend so we can monitor it for severe-weather alerts and notify you when the App is closed (see Section 1.7); it is removed when you turn weather alerts off or sign out

• Not used by Apical itself for advertising or tracking. On the free tier only, our advertising provider (Google AdMob) may derive coarse (approximate) location to show relevant ads, subject to your App Tracking Transparency choice — see Section 4.11. Precise location (used only for weather and geofenced reminders) is never shared for advertising

• Not shared with third parties beyond the weather, mapping, and (free-tier) advertising services described in this Policy

‍ ‍

You may revoke location permissions at any time through your device's Settings.

‍ ‍

1.6 User-Generated Content

‍ ‍

We store content you create within the App, including but not limited to:

‍ ‍

• Tasks, appointments, and calendar events

• Notes, documents, and handwritten canvas drawings (PencilKit data)

• Email drafts and composed messages

• Meal templates, meal plans (multi-day scheduled meal plans), and nutrition logs

• Workout templates, workout plans (multi-week scheduled training plans), and fitness logs (including exercise sets, reps, weights, and personal records)

• Shopping lists and list items

• AI chat conversations

• Profile pictures

• Widget configurations and home dashboard layouts

• Collaboration share codes and shared content

‍ ‍

This content is stored locally on your device by default. If you opt in to cloud sync, your data is also stored securely on our cloud infrastructure (see Section 3).

‍ ‍

1.7 Notification Data

‍ ‍

If you enable notifications, we schedule local notifications on your device for task reminders, appointment alerts, and other time-sensitive events. Local notification scheduling is handled entirely on-device using iOS local notification APIs (UserNotifications framework).

‍ ‍

Separately, if you opt in to new-mail push notifications for a connected email account, we register your device's Apple Push Notification service (APNs) token with our backend so we can notify you when new mail arrives while the App is closed. The APNs token is stored on our backend solely to deliver these notifications and is removed when you disable push, sign out, or delete your account. Push delivery is performed by Apple's APNs; to make the alert useful, the notification may include the message's sender, subject, and a short body preview (an excerpt of roughly the first 200 characters — Gmail's message "snippet" or Microsoft Graph's "bodyPreview" — never the full message body or attachments). This limited message content is transmitted through Apple's APNs and, like any notification, will rest in your device's Notification Center until you clear it. We do not log this content on our servers. You may disable email push at any time in the App's settings.

‍ ‍

Likewise, if you opt in to news notifications, we register your device's APNs token with our backend and store the news topics and categories you choose to follow, so that our server can match newly published articles to your interests and deliver them as push notifications even when the App is closed. We store only your followed topics and categories and your device token for this purpose. To make the alert useful, the notification may include the news source, the article's headline, and a short article preview, and is delivered through Apple's APNs (resting in Notification Center until cleared). This information is removed when you turn off news notifications, sign out, or delete your account. You may disable news notifications at any time in the App's settings.

‍ ‍

If you use the App on Android, these same push notifications (with the same sender, subject, and short preview, or the same news headline and preview) are delivered through Google Firebase Cloud Messaging (FCM) instead of Apple's APNs, and your FCM device token is stored and removed on the same terms as the APNs token described above.

‍ ‍

Separately, if you turn on weather alerts, we store the weather location you have selected — its approximate latitude and longitude plus a place label (for example "Home") — on our backend, tied to your account, so that a server process can monitor it for you. About every 15 minutes our server checks the U.S. National Weather Service active alerts for that point and sends you a push notification (through Apple's APNs on iOS, or Google Firebase Cloud Messaging on Android) when a new severe-weather alert appears, so the alert reaches you even when the App is closed. We store only this one monitored location and your device token for this purpose; the stored location is removed when you turn weather alerts off, sign out, or delete your account. It is never sold or shared, and never used for advertising or tracking. You may turn weather alerts off at any time in the App's settings.

‍ ‍

1.8 Usage Data

‍ ‍

We may collect anonymous, aggregated usage statistics to improve the App experience, including:

‍ ‍

• App feature usage frequency

• Crash reports and diagnostics

• Device type and operating system version

• App performance metrics

‍ ‍

Usage data is collected in a manner that does not personally identify you.

‍ ‍

On the free tier, certain advertising-related signals — including a device advertising identifier and ad-interaction data — may be shared with our advertising provider (Google AdMob) to serve and measure ads, as described in Section 4.11. Live Well and Power subscribers see no ads, and no advertising data is collected from them.

‍ ‍

1.9 Camera and Nutrition Label Scanning

‍ ‍

The App offers an optional nutrition label scanner that uses your device's camera together with on-device Apple Vision text recognition (OCR) to read nutrition facts and barcodes for food logging. When you use this feature:

‍ ‍

• The camera is activated only while the scanner is open

• Frames are processed locally on your device using Apple's Vision framework (VNRecognizeTextRequest)

• Camera images, video frames, and recognized text are NOT transmitted to our servers, AI services, or any third party

• Captured frames are not saved to your photo library or stored persistently; only the parsed nutrition values you confirm are saved to your meal log

• The camera is also used to scan QR codes when you accept a collaboration invite by QR code; the code's contents are read on-device and are not transmitted to us

• You may revoke camera permission at any time through your device's Settings > Privacy & Security > Camera

‍ ‍

1.10 Device Information

‍ ‍

We may automatically collect certain information about your device, including:

‍ ‍

• Device model and manufacturer

• Operating system and version

• Unique device identifiers (anonymized)

• Language and locale settings

• Time zone

‍ ‍

2. HOW WE USE YOUR INFORMATION

‍ ‍

We use the information we collect or receive to:

‍ ‍

• Provide, operate, and maintain the App and its features

• Personalize your experience and deliver content relevant to your interests

• Display health and wellness data from HealthKit within the App

• Retrieve, display, and send emails on your behalf using your connected email accounts

• Synchronize calendar events between the App and your device calendars

• Provide weather forecasts based on your location

• Provide location search suggestions for events and tasks

• Process and deliver AI-powered features and responses

• Send you local notifications and reminders you have opted into

• Enable collaboration features allowing you to share tasks, notes, and calendars with other users via share codes

• Facilitate data backup, export, and restore functionality

• Improve the App's functionality, performance, and user experience

• Monitor and analyze usage trends and preferences

• Detect, prevent, and address technical issues

• Comply with legal obligations

‍ ‍

We do NOT use your information to:

‍ ‍

• Sell your personal data to third parties

• Use your tasks, notes, emails, calendar, health, or other personal content to target advertising or build advertising profiles (the free-tier banner ads from Google AdMob rely only on a device advertising identifier and coarse location — see Section 4.11)

• Share HealthKit data with any third party

• Read or analyze your email content for advertising or profiling

‍ ‍

3. DATA STORAGE AND SECURITY

‍ ‍

3.1 Local Storage

‍ ‍

By default, all personal data, user-generated content, health data, and preferences are stored locally on your device using iOS secure storage mechanisms, including:

‍ ‍

• UserDefaults for preferences and settings

• Device-level file encryption (Data Protection)

• iOS Keychain for sensitive credentials (email passwords, OAuth tokens, authentication tokens)

‍ ‍

3.2 Cloud Sync (Optional)

‍ ‍

If you choose to enable cloud sync, your user-generated content (tasks, notes, appointments, meal logs, workout logs, shopping lists, collaboration data, and other app data) is securely transmitted to and stored on Amazon Web Services (AWS), a third-party cloud infrastructure provider. Cloud sync requires authentication and is protected by:

‍ ‍

• TLS/SSL encryption for all data in transit

• Row-level security policies designed so that only you can access your data

• Authenticated access requiring your credentials

‍ ‍

Cloud sync is entirely optional. You may use the App without enabling it. Health data from HealthKit is NEVER synced to the cloud, in compliance with Apple's HealthKit guidelines.

‍ ‍

You may delete all cloud-stored data at any time through Settings > Data & Storage > Delete Cloud Data.

‍ ‍

3.3 Data Backup and Export

‍ ‍

The App provides data backup and export features that allow you to create local backup files of your app data. Backup files are created on your device and can be saved to locations you choose (e.g., Files app, iCloud Drive). We do not automatically upload backup files to any external server.

‍ ‍

3.4 Security Measures

‍ ‍

We implement industry-standard security measures to protect your information, including:

‍ ‍

• iOS device-level encryption (Data Protection)

• iOS Keychain for secure credential storage (email passwords, OAuth tokens)

• Secure authentication through Apple Sign In, Google OAuth, Microsoft OAuth, or email/password

• TLS/SSL encryption for all network communications (including IMAP, SMTP, and API connections)

• Row-level security for cloud-stored data

• Content filtering for AI interactions

‍ ‍

While we strive to use commercially acceptable means to protect your personal information, no method of electronic storage is 100% secure, and we cannot guarantee its absolute security.

‍ ‍

3.5 Data Retention

‍ ‍

Local data is retained on your device for as long as you use the App. Cloud-synced data is retained on AWS servers for as long as your account is active. You may delete your data at any time through the App's settings. When you reset the App, all locally stored data is permanently removed from your device, including Keychain-stored credentials. When you delete your account (Settings > Delete Account), we permanently and irreversibly erase your server-side data as well: your synced content, any cached email, stored OAuth refresh tokens, push tokens, device-security fingerprints, subscription records, and your sign-in identity are all deleted. You may also separately delete only your cloud-synced content (without closing your account) through the Data & Storage settings.

‍ ‍

4. THIRD-PARTY SERVICES

‍ ‍

The App may use the following third-party services:

‍ ‍

4.1 Apple Services

‍ ‍

• Apple Sign In: For authentication. Governed by Apple's Privacy Policy (https://www.apple.com/privacy/).

• Apple HealthKit: For reading health data and writing back the water intake and body weight you log, with your explicit permission. Data remains on your device per Apple's HealthKit guidelines.

• Apple EventKit: For reading and writing calendar events on your device. Calendar data is managed by the iOS calendar system.

• Apple MapKit: For location search and autocomplete suggestions when adding locations to tasks or events. Location queries are processed through Apple's servers per Apple's Privacy Policy.

• Apple PencilKit: For handwriting and drawing canvas features. Handwriting data is stored locally on your device and is not transmitted externally.

• Apple Vision Framework: For on-device text recognition (OCR) used by the nutrition label scanner. All processing occurs locally on your device; images and recognized text are not transmitted externally.

• Apple AVFoundation (Camera): For accessing the camera during nutrition label scanning. Camera frames are processed locally and never uploaded.

• Apple Speech Recognition & Microphone: For optional voice dictation of text you enter (such as tasks, notes, and emails) when you choose to use it. Audio is handled by Apple's speech recognition — on-device where supported, otherwise processed by Apple's servers — under Apple's Privacy Policy; dictation audio is never sent to our servers.

• Apple App Store / StoreKit: For processing in-app purchases. Payment information is handled entirely by Apple.

‍ ‍

4.2 Google Services

‍ ‍

If you choose to connect a Google account in the Inbox feature, the App requests the following Google API scopes through Google's OAuth 2.0 protocol. We receive an access token and a refresh token; we never receive your Google password. Tokens are stored in the iOS Keychain on your device by default, and — if you enable background mail refresh or new-mail push notifications — your refresh token is additionally stored in encrypted form on our backend (see Section 4.10).

‍ ‍

• Sign-in (openid, userinfo.email, userinfo.profile): to identify the connected account and display its email address and basic profile within the App.

• Gmail API (gmail.modify): to read, compose, send, and organize (label, archive, mark read/unread, move, and trash) messages in the connected mailbox so the App can function as a full email client. We do not permanently delete your mail, and we do not read or analyze message content for advertising, profiling, or AI training.

• Google Calendar API (calendar.events, calendar.calendarlist.readonly): to view, create, update, and remove events on your Google calendars, and to see the list of calendars in your account, so appointments from all of your calendars stay in sync with the Planner.

‍ ‍

Gmail and Google Calendar data are exchanged directly between your device and Google's servers and are used solely to provide the email and calendar features you request. You can review or revoke the App's access at any time at https://myaccount.google.com/permissions. Google's privacy practices are governed by Google's Privacy Policy (https://policies.google.com/privacy).

‍ ‍

Limited Use: Apical's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically, information obtained through Gmail and Google Calendar scopes is used only to provide or improve the user-facing features you request; is not transferred to others except as necessary to provide those features, with your consent, or as required by law; is not used for advertising; and is not read by humans except with your explicit consent, for security or compliance purposes, or as required by law.

‍ ‍

4.3 Microsoft Services

‍ ‍

• Microsoft OAuth 2.0: If you choose to connect a Microsoft email account (Outlook, Hotmail, Live), authentication is handled via Microsoft's OAuth 2.0 protocol. We receive access and refresh tokens to retrieve and send emails on your behalf. We do not receive your Microsoft password. Microsoft's privacy practices are governed by Microsoft's Privacy Statement (https://privacy.microsoft.com/privacystatement).

‍ ‍

4.4 Email Protocols (IMAP/SMTP)

‍ ‍

• For non-OAuth email accounts (iCloud, Yahoo, AOL, custom providers), the App connects to email servers using IMAP (for receiving) and SMTP (for sending) protocols over encrypted TLS/SSL connections. Your email credentials are transmitted securely to authenticate with the respective email servers.

‍ ‍

4.5 Weather Data

‍ ‍

• Apple Weather (WeatherKit) (default): Weather forecasts are provided by Apple Weather (WeatherKit); your approximate location is sent to Apple to return the forecast, governed by Apple's Privacy Policy. Data sources are listed at https://weatherkit.apple.com/legal-attribution.html.

• Open-Meteo (fallback): If Apple Weather is unavailable, we use the Open-Meteo API. Your approximate location coordinates are sent to Open-Meteo to query weather conditions. Open-Meteo is a free, open-source weather API; no personally identifiable information beyond approximate location is transmitted.

• RainViewer: The precipitation-radar overlay uses public, non-personalized map tiles from RainViewer.

• U.S. National Weather Service: If you turn on weather alerts, your approximate location is sent to the U.S. National Weather Service (api.weather.gov) to retrieve active weather alerts for your area.

‍ ‍

4.6 Food Database (Open Food Facts)

‍ ‍

• Open Food Facts: When you scan a product barcode or search the food database, the barcode number or your search term is sent to Open Food Facts (world.openfoodfacts.org) to look up nutrition information. No personal information or account data is sent. Food data is provided by Open Food Facts contributors under the Open Database License (ODbL).

‍ ‍

4.7 Recipe Import

‍ ‍

• When you paste a recipe link to add its ingredients to a shopping list, the App fetches that web page to read its ingredient list. Only the link you provide is requested; no personal information is sent.

‍ ‍

4.8 News Content

‍ ‍

• RSS Feeds: The App retrieves news content from publicly available RSS feeds. No personal information is transmitted to RSS feed providers. Article previews and, in some cases, article text are retrieved from the publisher's website or RSS feed to display in the in-app reader.

• News Notifications: If you enable news notifications, the topics and categories you choose to follow are sent to and stored on our backend so that our server can match newly published articles and deliver them to you as push notifications while the App is closed (see Section 1.7). Your followed topics and categories are used only for this purpose and are not shared with RSS providers or any other third party.

‍ ‍

4.9 AI Features (Anthropic / Claude)

‍ ‍

Apical's AI assistant is powered by Anthropic's Claude models, accessed through the Anthropic API (api.anthropic.com), and is reached through our secure backend. Messages you send to the assistant are transmitted to Anthropic to generate a response. Anthropic does not use data sent through its API to train its models, consistent with Anthropic's commercial API terms. Your routine use of the App — composing email, creating tasks and notes, and automatic categorization — is processed on your device and is NOT sent to any AI service. AI is invoked only in the specific cases below, and only the data described is transmitted:

‍ ‍

• AI Help Chat: When you send a message to the in-app AI assistant, your message (and the recent messages in that conversation, for context) is transmitted to Anthropic through our backend to generate a reply. Please do not include sensitive personal information in chat messages. We do not use your chat content to train AI models.

• Profile name screening: To keep display names child-safe, a name you enter may be checked by Anthropic's Claude. Only the proposed name is sent; it is evaluated and not retained for training.

• Holiday theme graphics: When you select a non-default holiday theme, the App may request a decorative icon and wallpaper from an AI image-generation service. Only a fixed motif string from a built-in library (for example, "carved jack-o-lantern") is transmitted — no user-authored content, identifiers, or personal data. Generated images are cached locally and reused. If the theme is left at the default, no such request is made.

• Aggregated product insights: We may generate internal, aggregated trend summaries to improve the App. These operate on de-identified, aggregated usage signals and do not include your email, notes, tasks, or calendar content.

‍ ‍

We do NOT send your emails, notes, tasks, calendar events, or health data to any AI service except where you yourself include such text in an AI Help Chat message.

‍ ‍

4.10 Cloud Backend (Amazon Web Services)

‍ ‍

• If you opt in to cloud sync, your app data is stored on Amazon Web Services (AWS) infrastructure (RDS PostgreSQL, behind API Gateway). Data is protected by row-level security (so only you can access your rows) and encrypted in transit and at rest. AWS's privacy practices are governed by their privacy notice (https://aws.amazon.com/privacy/).

• Authentication is handled by Amazon Cognito (an AWS service). If you sign in with email/password, Cognito securely stores the hashed password; we never see your plaintext password. If you use Apple Sign In, the Apple identity token is validated against Apple's public keys and we provision a Cognito user keyed to the Apple-issued sub identifier with the email Apple provides (which may be a private relay address).

• Direct email access: In normal foreground use, the App communicates directly with Google's, Microsoft's, or your IMAP/SMTP provider's servers from your device using your credentials, and that email content does not pass through our backend.

• Server-side email refresh and push (optional): If you enable background mail refresh or new-mail push notifications, our backend stores your OAuth refresh token in encrypted form (AWS KMS envelope encryption: a unique per-row data encryption key encrypts the token with AES-256-GCM, and that data key is itself wrapped by a KMS master key) so it can fetch new messages on a schedule and notify you when the App is closed. To build the notification, our backend reads the newest message's sender, subject, and a short body preview (Gmail's "snippet" or Microsoft Graph's "bodyPreview" — never the full message body or raw message data) and includes that limited content in the push so the alert is useful. In that case, message metadata and the content needed for the notification and offline display may be temporarily cached on our backend in encrypted form; the notification content is not written to our logs. This server-side processing is used solely to operate the email and notification features — never for advertising, profiling, or analysis of your message content. If you do not enable background refresh or push, your refresh tokens and email content remain on your device.

• Server-side weather-alert monitoring (optional): If you turn on weather alerts, our backend stores the weather location you selected (approximate latitude/longitude and a place label) tied to your account, and a scheduled server process checks the U.S. National Weather Service active alerts for that point about every 15 minutes so it can push you a notification when a new severe alert appears while the App is closed. We store only this single monitored location; it is used solely to deliver weather-alert notifications — never for advertising, profiling, or tracking — and is removed when you turn weather alerts off, sign out, or delete your account.

• Transactional email (Resend): We use Resend to send you service emails such as sign-up verification, password reset, a new-device sign-in alert, a welcome message, and subscription receipts/reminders. These are operational rather than marketing; opt-out-eligible emails include an unsubscribe link.

• Device security signal: To alert you to a sign-in from a new device, we store a one-way hashed fingerprint derived from your device's user-agent and a coarse network (IP) prefix. We do not store your full IP address for this purpose.

• Subscriptions: When you purchase or change a subscription, Apple notifies our backend (App Store Server Notifications) so we can record your subscription tier, status, and renewal date and send receipts. Payment details are handled entirely by Apple; we never receive your card information.

‍ ‍

4.11 Advertising (Google AdMob)

‍ ‍

• The free tier of the App displays banner advertisements served by Google AdMob (a Google service). Live Well and Power subscribers do not see ads, and no advertising data is collected from them.

• To serve ads, the Google Mobile Ads SDK may collect a device advertising identifier (IDFA), coarse (approximate) location, device information, and data about your interaction with ads. This data is processed by Google as an independent party under Google's Privacy Policy (https://policies.google.com/privacy) and its advertising terms.

• App Tracking Transparency: On the free tier, iOS asks for your permission to track. If you allow tracking, AdMob may use your advertising identifier to show personalized ads. If you decline — or on devices with no advertising identifier — AdMob serves only non-personalized (contextual) ads. You can change this anytime in Settings > Privacy & Security > Tracking.

• We never send your name, email address, account identifier, health or fitness data, message content, notes, or other user-authored content to AdMob or any advertising network.

‍ ‍

Except for the advertising described in Section 4.11 (free tier only), we do not share, sell, or rent your personal information to third parties for their own marketing or advertising purposes.

‍ ‍

5. COLLABORATION FEATURES

‍ ‍

The App offers collaboration features that allow you to share tasks, notes, and calendars with other Apical users:

‍ ‍

• Share Codes: You may generate unique share codes to invite collaborators. Share codes are transmitted through our cloud infrastructure (AWS) to enable collaboration.

• Shared Content: When you share tasks, notes, or calendars with collaborators, the shared content is stored on our cloud infrastructure and accessible to authorized collaborators.

• Collaborator Information: When you collaborate, your display name and user identifier may be visible to other collaborators you have explicitly invited.

‍ ‍

Collaboration is entirely optional and requires an active cloud sync account. You may revoke collaborator access or delete shared content at any time.

‍ ‍

6. YOUR PRIVACY RIGHTS

‍ ‍

Depending on your jurisdiction, you may have certain rights regarding your personal information:

‍ ‍

6.1 General Rights

‍ ‍

• Access: You may request details about the information we hold about you.

• Correction: You may update or correct inaccurate information through the App's settings.

• Deletion: You may delete all your local data at any time through Settings > Reset App Data, or by deleting your account through Settings > Delete Account. Cloud-stored data can be deleted through Settings > Data & Storage. Email account credentials can be removed by disconnecting email accounts in Settings.

• Portability: You may export your data through the App's data export and backup features.

• Withdrawal of Consent: You may withdraw consent for data collection at any time by adjusting your device permissions (location, calendar, health, notifications) or deleting your account.

‍ ‍

6.2 California Residents (CCPA/CPRA)

‍ ‍

If you are a California resident, you have the right to:

‍ ‍

• Know what personal information we collect, use, and disclose

• Request deletion of your personal information

• Opt out of the sale or sharing of your personal information (we do not sell or share personal information)

• Non-discrimination for exercising your privacy rights

‍ ‍

To exercise these rights, contact us at support@garbageapps.com.

‍ ‍

6.3 European Economic Area, United Kingdom, and Switzerland (GDPR)

‍ ‍

If you are located in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR), including:

‍ ‍

• Right of access to your personal data

• Right to rectification of inaccurate data

• Right to erasure ("right to be forgotten")

• Right to restrict processing

• Right to data portability

• Right to object to processing

• Right to lodge a complaint with a supervisory authority

‍ ‍

Our legal bases for processing your data include: your consent, performance of our contract with you (Terms of Service), and our legitimate interests in improving the App.

‍ ‍

To exercise any of these rights, contact us at support@garbageapps.com.

‍ ‍

7. CHILDREN'S PRIVACY

‍ ‍

The App is not directed to children under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personally identifiable information from children under 13. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to remove that information from our systems.

‍ ‍

If you are a parent or guardian and you believe your child has provided us with personal information, please contact us at support@garbageapps.com so we can take appropriate action.

‍ ‍

8. DO NOT TRACK SIGNALS

‍ ‍

The App does not track users across third-party websites or apps for its own purposes and does not respond to Do Not Track (DNT) signals. Free-tier advertising through Google AdMob is governed by your App Tracking Transparency choice (see Section 4.11).

‍ ‍

9. INTERNATIONAL DATA TRANSFERS

‍ ‍

Your information is primarily stored locally on your device. In limited circumstances (such as weather forecast retrieval, holiday theme image generation, AI Help Chat, transactional email, or optional cloud sync to AWS), data may be transmitted to servers located outside your country of residence. In foreground use, email is fetched and sent directly from your device to Google, Microsoft, or your IMAP/SMTP provider; if you opt in to background refresh or push notifications, our backend may fetch and briefly cache your mail on your behalf (see Section 4.10). In all such cases, we use appropriate safeguards to help protect your data in accordance with applicable laws.

‍ ‍

10. CHANGES TO THIS PRIVACY POLICY

‍ ‍

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy within the App and updating the "Last Updated" date. Your continued use of the App after any changes constitutes your acceptance of the updated Privacy Policy.

‍ ‍

We encourage you to review this Privacy Policy periodically for any changes.

‍ ‍

11. CONTACT US

‍ ‍

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

‍ ‍

Email: support@garbageapps.com

‍ ‍

Website: https://www.garbageapps.com/apicalplanandlivewell

‍ ‍

You may also submit a data subject access request or privacy inquiry to the email address above. We will respond to your request within 30 days (or within the timeframe required by applicable law).

‍ ‍

‍ ‍