Privacy Policy

Effective Date: October 3, 2026
Last Updated: October 22, 2026

This policy explains what The Hour Box collects about you, why, who else handles it, how long it is kept, and the rights you have. It is a separate document from the Terms & Conditions.

1. What we collect

• Your account: your email address, and your name and profile picture link if you sign in with Google or Apple. Passwords are stored only as a salted hash by our authentication provider.
• Your planner: the tasks, lists, notes, settings and repeating schedules you create.
• Google Calendar, only if you connect it: an access and a refresh token, and the calendar events needed to keep tasks and events in sync. The Hour Box only changes events it created.
• When you accepted the Terms and which version, for accounts created with email.
• Subscription records: which plan you have, its dates and status, and an identifier from the store or payment provider. We never see or store your card or UPI details.
• Technical logs (errors, requests, and subscription events) kept by our host. The subscription analytics we record contain no name, email or account id.
• Security logs kept by The Hour Box itself: when sign-in, two-factor or other protected requests are refused or look abusive, we record the time, your IP address, your browser and device description (user agent), the page requested and the account involved, so we can block abuse and investigate incidents. Error logs may include your account id.
• Account activity: when you last signed in, and counts such as how many tasks you added, completed or left open in a week, how many days you closed, and which features (for example recurring tasks or Calendar sync) you use. These counts never include the titles or notes of your tasks. We also keep one daily total of accounts (all, new, active, subscribers and trials), which contains no personal data.
• Email: one welcome message when you sign up, and a weekly summary on Monday mornings (tasks done, focus sessions, days closed, and the titles of up to three tasks waiting longest). Turn the weekly summary off in Settings or with the link in any summary; we record which messages were sent so none goes twice.
• Phone notifications, only if you turn them on in the phone app: a device token that Firebase Cloud Messaging (Google) gives the app, your time zone, and your reminder settings, so we can send you task reminders. Switching them off in Settings, or signing out, deletes the token from our servers.
• Support and privacy requests you make, with your account id, and a log of what our administrators do in the admin console, including the administrator’s email address.

2. Google user data

If you sign in with Google or connect Google Calendar, The Hour Box receives some data from your Google Account. This section says exactly what, and what is done with it.

• Google sign-in (your name, email address and profile picture): used to create and sign in to your account with The Hour Box, and to run and secure the service (for example, authorized administrators can see who signed up and when).
• Google Calendar, only if you choose to connect it, with permission to view and edit events. The Hour Box reads the title, start and end time, and your own attendance answer of the events on your calendars, so it can show them next to your planned tasks. It creates an event for each task you put on the planner, and updates or removes those events when you change, complete or delete the task. It changes or deletes one of your other events only when you ask it to, for example by marking it done or deleting it from The Hour Box. It does not ask Google for event descriptions, locations, guest lists or attachments, and never sends invitations.
• Your calendar events are not stored on our servers: they are fetched when the planner needs them and kept only in your browser while you use it. What we store is the access and refresh token that lets The Hour Box reach your calendar (encrypted), and, for each task, the id of the event it created.
• Data from Google is used only to provide these features to you. It is not sold, not used for advertising, not used to build or train AI or machine-learning models, and not shared with anyone except the hosting and database providers listed below that run the service. Nobody at The Hour Box reads it, unless you ask us to for support, it is needed for security or abuse investigation, or the law requires it.
• The Hour Box’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• You can disconnect Google Calendar at any time from the sync menu, which deletes the stored tokens, and you can also remove The Hour Box’s access from your Google Account settings.

3. Why we use it

To run the planner, sync it across your devices, provide the features you subscribed to, process and restore purchases, keep the service secure and prevent fraud, and meet legal obligations. We don’t sell your personal data and we don’t use it for advertising.

We also use the activity counts above, in totals and for individual accounts, to understand how the service is used, give support and spot abuse. Only authorized administrators who have signed in with two-factor authentication can see them. Staff do not open the titles or notes of your tasks unless you ask us for support, security or abuse handling requires it, or the law requires it. Each such access needs a written reason, expires within an hour, and is recorded in a log.

4. Who handles it

• Supabase: database and sign-in.
• Vercel: hosting and logs.
• Google: sign-in, and Calendar if you connect it.
• Resend, which delivers our emails: it receives your email address, your first name and the message itself.
• Google Firebase Cloud Messaging (and Apple’s push service on iPhone), only if you turn on phone notifications: it delivers each reminder to your phone. It receives your device token and the text of the reminder, which includes the title of the task.
• Cloudflare: a bot check (Turnstile) on sign-up, sign-in and password reset. Cloudflare receives your IP address and basic browser details to tell people from automated programs.
• Apple: Sign in with Apple, and App Store purchases.
• Google Play: Play purchases.
• Razorpay: payments for web subscriptions.
• Your browser’s speech service, only if you use voice capture: in most browsers (for example Chrome, Safari) the audio you speak is sent to the browser maker for transcription. The Hour Box receives only the resulting text and never the audio.

The data you keep in The Hour Box is stored in a database hosted in India (Mumbai). Vercel and the other providers above may process it in other countries; where they do, we rely on their own safeguards for transfers.

These providers process data on our behalf or under their own terms and privacy policies. We share personal data when needed to provide the service, when the law requires it, or with your consent.

5. Children

If you are under the age of digital consent where you live, you may use The Hour Box only with the consent of a parent or legal guardian. For children under applicable Indian data-protection law, we apply the requirements that govern children’s personal data, including parental consent.

6. How long we keep it

Your data is kept while your account exists and is removed when you delete it, apart from records we must keep for legal, security, fraud-prevention, dispute-resolution, or financial and tax purposes, and short-lived backups and logs.

7. Your rights

Depending on where you live, you may have the right to:

• access the information we hold about you;
• request correction;
• request deletion;
• withdraw consent where processing is based on consent;
• request information about how your data is processed;
• data portability;
• object to or restrict certain processing; and
• complain to a data-protection authority.

The scope of these rights depends on applicable law. In India this includes the rights under the Digital Personal Data Protection framework; in the United Kingdom, UK data-protection law; in the United States, applicable federal and state privacy law. To use any of them, write to the privacy contact below.

8. Your choices in the app

• Disconnect Google Calendar any time from the sync menu; this deletes the stored tokens.
• Delete your planner data, Calendar connection and web subscription from the Premium screen (“Delete my data from The Hour Box”). To close your login as well, contact us.
• Cancel an App Store or Google Play subscription in that store’s subscription settings. Deleting the app or your data does not cancel it.

9. Security

Data is encrypted in transit, and access to each person’s data is restricted by per-user security rules in the database. No system is perfectly secure, so please keep your sign-in details safe.

10. Changes

If this policy changes in a way that matters, we’ll update the dates above and tell you in the app.

11. Contact

The Hour Box
Legal Entity: [INSERT LEGAL ENTITY NAME]
Registered Address: [INSERT REGISTERED ADDRESS]
Privacy Contact: thehourbox@gmail.com
Support: thehourbox@gmail.com