Privacy Policy

Last updated: September 2026

1. Who we are

Tupp is a productivity application for iOS covering focus sessions, time tracking, daily checklists, habit tracking, and routine scheduling. When we say "Tupp", "we", "us", or "our" in this policy, we mean the developer of the Tupp app. If you have questions, contact us.

2. What data we collect

We collect only what is necessary to provide the service:

  • Account data — your name, email address, profile picture (if supplied), authentication-provider identifier, and optionally a phone number. You may sign in with Google, Apple, email and password, or phone verification.
  • Session data — the sessions you record, including start time, end time, duration, activity type, paused time, notes, and custom field values.
  • Profile and productivity data — profile names and colours; activities, routines, tasks and completions; habit logs; XP; and any notes or custom fields you choose to enter.
  • Activity data — the activities you create, including names, icons, and colours.
  • Location data — only if you enable location-based reminders. We store the coordinates of reminder places and may save a session-start location to suggest a reminder place. We do not collect continuous location history.
  • Device and service data — device push tokens, app/device information, IP address and country inferred at sign-up, and limited error-reporting data, used to deliver notifications, prevent abuse, and diagnose faults.
  • Billing data — if you subscribe, we store plan status and provider customer identifiers. Apple and RevenueCat handle personal in-app subscriptions; Stripe handles organization subscriptions. We do not store payment-card details.

We do not access your contacts or photo library. Location collection is optional and is described above.

3. How we use your data

  • To provide, operate, and improve the Tupp app
  • To sync your data across sessions and devices via our API
  • To manage your subscription and billing status
  • To respond to support requests and to provide optional AI assistance when you request it
  • To send important service communications and, where you have enabled them, reminders and re-engagement messages

We do not use your data to serve ads. We do not sell your data to anyone.

4. Third parties

We use a small number of trusted third-party services:

  • Google and Apple — used for authentication when you choose those sign-in methods.
  • RevenueCat and Apple — used to manage personal in-app subscriptions and verify purchase receipts.
  • Stripe — used for organization subscription billing.
  • Twilio — used to verify a phone number if you choose phone sign-in.
  • Sentry — used for error reporting; Google Places — used when you search for a place in location reminders; Anthropic — used only when you submit a request to the optional AI assistant.
  • Vercel Analytics and Google reCAPTCHA — used on our website for aggregate measurement and spam prevention.

5. Data storage and security

Your data is stored on secure servers. Personal and user-generated content — including your name, email address, sign-in identifiers, phone number, session names and notes, activity and task details, and room messages — is encrypted at rest in our database. We use HTTPS/TLS for data in transit, and authentication tokens are stored in your device's secure keychain. Account and productivity data are kept while your account is active. When you delete an account, we permanently remove your personal information — name, email, sign-in identifiers, and every note, name, or tag on your sessions, tasks, and habits — and revoke device and notification credentials, so the account can no longer be signed into. We retain an anonymous summary of your monthly usage (for example, total hours by activity), linked only to the disabled account record, with all identifying content stripped out, so you keep the benefit of your history without it identifying you. Expired security tokens and verification records are removed automatically. Raw website analytics events are retained for up to 90 days. Service providers may retain data under their own documented schedules.

6. Your rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your account and associated data
  • Request a copy of your data in a portable format
  • Object to or restrict how we process your data

You can delete your account or submit a manual data-export request in the app’s Settings. For access, correction, restriction, objection, or any other privacy request, contact us. contact us.

7. Children

Tupp is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you via the app or by email. The "Last updated" date at the top of this page reflects the most recent revision.

9. Contact

Questions about this policy? Contact us. Contact us.