Privacy Policy

What we collect

Account information. When you sign up, we collect your email address and a password (stored as a one-way bcrypt hash — we never see or store your actual password) or, if you sign in with Google or Apple, the name and email address that provider shares with us. Optional profile fields you fill in — display name, username, birth date, country, avatar, daily goal, use-case preferences — are stored too. Sign-in codes and other account emails are sent through our email provider, Resend.

Guest accounts ("Try it first"). You can start without signing up. Liro then creates an anonymous guest account on our server: it has an internal id and no email address, name or password. Your tasks sync to it like any account. If you later link Sign in with Apple (or another sign-in), the same account simply gains that email address — nothing is copied or moved. A guest account is never deleted on its own: delete it from Settings → Profile → Delete account, exactly like a full account. AI features are not available to guest accounts.

Tasks and content you create. Everything you type or speak into Liro — task titles, notes, subtasks, tags, spaces, due dates — is stored so it can sync across your devices and stay available offline.

Plans you make. When you use Plan for now, we store the plan on our server, linked to your account: its title, steps, actions and your reflection. Deleting a plan removes it from the server; deleting your account removes all your plans.

AI processing — only after you say yes. AI features need a signed-in account with Liro Pro (the free trial counts); guest accounts never reach an AI provider. Before Liro sends anything to an AI provider, it shows a consent screen that names the providers and what they receive. Until you agree, the app makes no AI requests at all, and you can turn AI processing on or off later in Settings → Capture → AI processing. With your consent:

- *Voice.* When you capture a task by voice, the recording is uploaded securely and sent to Groq (United States), which turns it into text. We delete the audio right after transcription, unless you turn on "Keep my recordings" (off by default). - *Task text and photos.* The transcript, or a photo you turn into a task, is sent to Google Gemini (or, if it is unavailable, to Groq's language models) to pull out the task, a date, time and category. - *Planning chat.* When you plan with Liro, your messages and the tasks needed to answer them are sent to Google Gemini (with Groq as backup) to suggest a plan.

*About Google Gemini.* We use the Google Gemini API on Google's paid terms. Under those terms Google does not use what we send it to train or improve its models or products. Groq likewise does not keep or train on what we send. If you would rather nothing you write reaches Gemini, leave AI processing off; typed tasks still work without it. More detail is on our AI notice.

Location, only when you attach it to a task. Liro does not track your location in the background. If you attach a place to a task (e.g. "pick up milk" reminding you near a store), we store that location's name and coordinates for that task. Spoken place names are resolved using Google Places and OpenStreetMap.

Google Calendar, if you choose to connect it. If you connect Google Calendar, Liro reads your events so they appear alongside your plan, and — only if you switch on calendar writing — adds or updates events you create in Liro. This is opt-in, it is the only Google service Liro can reach, and you can disconnect it at any time in Settings. What we read, what we keep, and how it is protected is spelled out in "How we protect your Google Calendar data" below.

Apple Calendar, on your device. If you connect Apple Calendar, Liro reads your events on your iPhone to show busy time in your Plan. Those events stay on the device and are not sent to us. Two options are off by default and only run if you turn them on: *Import events as tasks* creates a task on our server for each event in the next 30 days (its title, start time and length, and an event id so it isn't imported twice), stored like any task you write; *Liro calendar* writes your timed tasks into a separate "Liro" calendar on your device, and turning it off removes that calendar. You can revoke calendar access at any time in iOS Settings.

Purchase and subscription status. If you subscribe to Liro Pro, Apple's App Store (StoreKit) handles the payment and RevenueCat, our subscription provider, tells us your subscription status. We never receive your card or payment details.

One free trial per device. To stop the free Pro trial being claimed over and over, the app sends a random install id kept in your iPhone's Keychain and an Apple DeviceCheck token. We store only a one-way (SHA-256) hash of the install id, linked to the account that took the trial, and Apple's DeviceCheck keeps a single yes/no flag for the device. Neither identifies you or is used for anything else.

Product analytics. We use PostHog to see which screens and features are used, so we know what to fix and improve. Events are tied to your internal Liro user id — never your email or name — and do not include the content of your tasks or recordings. Session replay is switched off, and we don't use this data for advertising. This includes the settings you choose (such as theme, app style, language or notification options) and counts and durations (such as how long a focus session ran), never their content. You can switch it off any time in Settings → Share usage analytics.

Liro's world and your progress. To run the companion features, we store records tied to your account: an acorn ledger (which completed task earned how many acorns, and when), your progress on daily quests, weekly missions and milestones, your focus expeditions (how many minutes you focused and which postcard place Liro brought back), neighbour visits, and the rooms and wardrobe items you own. We use them only to run those features — never for advertising or profiling — and they are deleted with your account. The Focus Live Activity on your Lock Screen and Dynamic Island is drawn on your device from data already there; nothing extra is sent to us for it. None of this involves any new third party.

Crash and performance data. We use Sentry to catch crashes and errors so we can fix them. This includes device/OS information and a stack trace of what went wrong — not the content of your tasks.

Knowingly collecting data from children. Liro is a productivity tool built for adults. You must be at least 13 to use it, and at least the age of digital consent where you live (up to 16 in some EU countries) unless a parent or guardian agrees for you. We don't knowingly collect personal data from children under 13, the threshold set by the US Children's Online Privacy Protection Act ("COPPA"). App Store and Google Play may classify the app as 4+ for content, but that's a content rating, not a license to collect data from children. If you believe a child under 13 has created an account, email us at the address below and we'll delete the account and any associated data.

What we don't do

We don't sell your data. We don't run behavioral advertising. We don't use your tasks or voice recordings to train AI models ourselves (see the note on Google Gemini above: on Google's paid terms, Google doesn't train on it either). We don't track you across other apps or websites.

Where it's stored

Your account and task data live in a managed Postgres database hosted by Supabase in the United States (AWS us-west-2, Oregon). Voice recordings and avatar images, when kept, are stored in Supabase Storage. Supabase encrypts data at rest and in transit.

How we protect your Google Calendar data

Connecting Google Calendar is optional. When you do connect it, Liro asks for exactly one permission — `https://www.googleapis.com/auth/calendar.events` — and nothing else. Liro cannot read your Gmail, your contacts, your Drive, or any other Google service, because it never asks for access to them.

We keep three fields, and no more. For events in a window around today we store the event's title, its start time, and its Google event id (so the same event doesn't import twice). We do not copy or store event descriptions, attendee names or email addresses, locations, attachments, conferencing links, or calendars other than your primary one.

Encrypted in transit and at rest. Every connection between the app, our API, and Google runs over TLS. Your Google access and refresh tokens are additionally encrypted by us with AES-256-GCM before they are written to the database, so they stay unreadable to anyone holding a copy of the raw database — our database provider included. The database and file storage are themselves encrypted at rest by Supabase.

Almost nobody can reach it, and no human reads it. Your calendar data is processed by automated systems only. No employee, contractor, or subprocessor reads it, and it is never reviewed manually. Administrative access to the production database is limited to the single developer who runs the service, protected by two-factor authentication, and used for keeping the service running — not for reading user content.

Erased when you disconnect. Disconnecting Google Calendar in Settings revokes the token with Google and erases our stored copy in the same step, so the authorization stops existing on both sides rather than merely going unused. Deleting your account does the same before it removes everything else. You can also revoke Liro's access yourself at any time from your Google Account permissions page.

Never sold, never used to train AI. We do not sell Google user data, transfer it to advertisers or data brokers, use it for advertising or profiling, or use it to train, retrain, or improve any AI or machine-learning model — ours or anyone else's. Voice transcription never receives calendar data.

If something goes wrong. If we ever discover a breach affecting your data, we notify affected users and the relevant supervisory authority without undue delay and within 72 hours of becoming aware of it, as the GDPR requires.

Limited Use. Liro's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Third parties we rely on

Supabase also hosts our API. Vercel hosts this website. Resend sends account and opt-in emails. Groq (voice transcription, and backup for the AI features below), Google Gemini (turning transcripts and task photos into tasks, and the planning chat), Supabase (database, file storage and sign-in), Google Places / OpenStreetMap (location lookup), RevenueCat and Apple's App Store (subscriptions), Apple DeviceCheck (one trial per device), PostHog (product analytics), Sentry (crash reporting), Google / Apple (sign-in), and Google Calendar (only if you connect it). Groq and Gemini receive data only after you consent to AI processing. Each only receives the minimum data needed to do its job, described above. We never pass your Google Calendar data to any of the others. The full list, with what each receives and where, is on our sub-processors page.

Your controls

From Settings → Profile, you can export or clear your task data at any time, or permanently delete your account (guest accounts included) and everything tied to it — this removes your tasks, recordings, and profile from our systems. Deleted tasks first go to Recently Deleted, where you can restore them or remove them for good straight away. You can switch AI processing off at any time in Settings → Capture → AI processing. If you'd rather email us, reach out using the address below and we'll do it for you. Export everything includes your plans. Deleting your account also removes all your plans.

Decisions made by software

Liro's AI suggests dates, categories and plans; you can always change or delete them. No decision with a legal or similarly significant effect on you is made by automated means.

This website

wisprtasks.xyz sets no advertising or tracking cookies, so it shows no cookie banner. We count visits with Vercel Web Analytics, which works without cookies and does not identify you, and Vercel Speed Insights measures page speed. Your language choice is kept in your browser's local storage. If you join the launch list, your email address goes to Resend so we can send launch news; every email has an unsubscribe link.

Why we're allowed to hold it

European law asks us to name the legal ground for each thing we do with your data, so here it is in plain terms.

To run the app you signed up for. Your account details, tasks, voice recordings, the places you attach and your subscription status are processed because you asked us to run Liro for you — a contract, in legal terms. Without them there is no app.

Because you said yes. AI processing (Groq and Google Gemini), connecting Google Calendar, importing Apple Calendar events, and receiving product emails happen only on your explicit consent. You can take that consent back whenever you like by disconnecting the account in Settings or unsubscribing from the email, and doing so doesn't undo anything that was lawful while you'd given it.

Because it keeps the service working. Crash and error reports, product analytics, and the one-trial-per-device check rest on our legitimate interest in fixing what breaks, improving the app and preventing abuse of the free trial. They never carry your task content. You can object to it, though in practice that means deleting the account, since we can't run the app blind.

How long we keep it

Your account, tasks and plans stay until you delete them — guest accounts too. Nothing expires on its own.

Recently Deleted. A task you delete waits in Recently Deleted for 30 days (or the period you pick in Settings), then is erased automatically. You can restore it or erase it sooner.

Voice recordings are deleted immediately after transcription, unless you turned on "save my recordings" — then they live as long as the account does.

Google Calendar access ends the moment you disconnect: we revoke the token with Google and erase our stored copy, so we can no longer read anything. Events already imported stay in your task list as ordinary tasks of yours — delete them individually, or delete your account to remove everything at once.

Crash reports age out within 90 days, enforced by Sentry.

Analytics events are kept by PostHog under its retention settings; ask us and we'll delete yours.

Trial device hash is kept so the one-trial rule keeps working after reinstall; it holds no personal content.

Backups roll on a 30-day window. Deleted rows leave the live database at once and finish ageing out of backups within those 30 days.

Billing records are kept by Apple and RevenueCat under their own tax and accounting duties. Those are not ours to delete.

Your rights in Europe

Liro is run from Colombia, and the providers that store and process your data sit in the United States and Europe, so your data does cross borders. Each provider operates under its own transfer safeguards — standard contractual clauses or a recognised adequacy framework — and we don't send your data anywhere beyond the providers named above.

If the GDPR or the UK GDPR applies to you, you can ask us to show you what we hold, correct it, delete it, hand it over in a portable format, restrict what we do with it, or stop processing that rests on legitimate interest. Most of that you can do yourself in Settings, immediately and without asking anyone. For the rest, write to privacy@wisprtasks.xyz and we'll answer within a month.

We have not appointed a data protection officer, because our processing does not require one; privacy@wisprtasks.xyz reaches the person responsible directly.

You can also complain to the data protection authority of the country where you live or work, or where you think something went wrong. You don't have to come to us first.

Your rights in California

If the California Consumer Privacy Act applies to you: in the last 12 months we collected identifiers (email, user id, device id), customer records (name), commercial information (subscription status), internet activity (in-app usage events), approximate and precise location (only places you attach to a task), audio (voice recordings), user content, and inferences such as your use-case preferences. We use them only for the purposes above. We do not sell or share your personal information for cross-context behavioral advertising, and we don't use sensitive information beyond what is needed to provide the service. You may ask to know, correct or delete your information, and we will not treat you differently for asking. Write to privacy@wisprtasks.xyz; an authorized agent may ask for you with your written permission, and we may need to confirm it's you.

Changes to this policy

If this policy changes in a material way, we'll update the date at the top of this page and, for significant changes, notify you in the app.

Contact

Questions about your data? Reach the team at privacy@wisprtasks.xyz (general help: support@wisprtasks.xyz) — Off The Shelf Studio reads everything sent here. The person responsible for your data — the data controller — is Danilo Santiago Vanegas Saenz, an independent developer in Colombia trading as Off The Shelf Studio.