Privacy Policy

Capybara does not sell, rent, trade or otherwise share your personal information with third parties. There are no advertising networks, no analytics or tracking services, and no data brokers in this app.

The only time information leaves the app is when you ask it to: for example when you connect Google Calendar (see "Google Calendar"), or when you download your own data.

Only what is needed to run your account:

• Account details: your email address, your name (if you give one), and either a password hash or the fact that you signed in with Google. Passwords are never stored in readable form.
• Your content: tasks, subtasks, lists, folders, tags, reminders, time blocks, saved filters, habits, focus sessions, countdowns and workspaces you create.
• Your settings: theme, calendar and notification preferences, time zone and language.
• Google Calendar data, only if you connect it (see below).

We do not collect your location, contacts, device identifiers, or browsing activity.

Signing in with Google, or connecting Google Calendar, is optional. If you do, Google asks you to approve access to your calendar and basic profile (name and email).

We use that access only to show your Google events next to your tasks and, if you choose two-way sync, to create, edit and delete events on your behalf. Synced calendar data is used solely to provide those features to you. It is never shared, sold or used for advertising, and never used to train AI or machine-learning models.

Signing in with Google does not store any Google access keys: we keep only the identifier Google gives us so we recognise you next time. If you connect Google Calendar, the access keys it needs are encrypted before they are stored. You can disconnect at any time in Settings, and you can also revoke access from your Google Account permissions page.

Capybara's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small number of strictly necessary items and no tracking cookies:

• A session cookie that keeps you signed in, and a security (CSRF) cookie that protects sign-in.
• Browser storage on your device for preferences (theme, view, calendar settings), your recent searches, and any changes you make while offline, which are held until they can be saved.
• A service worker and cache so the app can open quickly and work offline.

You can clear these at any time from your browser settings; you will simply be signed out and your device preferences reset.

Capybara uses the Inter and JetBrains Mono typefaces. They are downloaded once when the app is built and served from our own domain, so your browser does not contact Google to load fonts while you use the app.

The only email the app sends is a password-reset link, and only when you ask for one. The link works once and expires after 60 minutes. We do not send marketing email.

Passwords are hashed with bcrypt. Google Calendar access keys are encrypted at rest. Connections are made over HTTPS. Password-reset tokens are stored only as hashes.

No system is perfectly secure, so please choose a strong, unique password.

• Export: download all of your data as JSON or CSV at any time from Settings → Data.
• Import: bring a previous export or a simple CSV back in.
• Delete a task: it moves to Trash and is permanently removed after 30 days, or immediately if you choose "Delete permanently".
• Delete your account: Settings → General → Delete Account permanently removes your account and everything linked to it (tasks, lists, tags, settings, Google connection and synced data) and revokes the Google connection. This cannot be undone.

Because you can export and delete your own data yourself, you do not need to ask us to do so.

We keep your data for as long as your account exists. When you delete your account it is removed straight away from the live database. Copies in routine backups, if any are kept, are removed as those backups expire.

Capybara is not directed to children under 13, and we do not knowingly collect their information.

If we change what we collect or how we use it, we will update this page and the "Last updated" date. If a change is significant we will tell you in the app before it takes effect.