Privacy Policy
Last updated: August 2026
The short version
TOWIU is private by default. Your planning data exists so the app can work for you — not for advertising, not for sale, not for profiling. Friends only ever see what you explicitly choose to share (free/busy by default).
What we store
Your account (email, name, sign-in identifiers) and the content you create: weekly plans, life map entries, actions, captures, calendar and availability data, friend connections, messages, check-ins, and assistant conversations. AI features additionally store usage counters (how many AI actions you used this month). All application data is stored in Convex, hosted in the EU region.
Processors we rely on
- Vercel — hosts the web application and serves requests.
- Convex (EU region) — stores and processes application data.
- Vercel AI Gateway — relays the text of AI requests (for example a capture you ask to be parsed) to a language model when you use an AI feature. Only the content needed for that request is sent.
- Stripe — payment processing, only when TOWIU Plus is enabled. We never see your card details.
- Postmark — transactional email, only when email delivery is enabled.
Google Calendar data and AI
If you connect Google Calendar, TOWIU uses its data only for the calendar sync and planning features you request. We import free/busy times by default. Titles and descriptions are imported only if you explicitly enable detail import. OAuth credentials remain server-side and are cleared or revoked when you disconnect the integration.
When you request AI-assisted scheduling, derived candidate time slots may be sent to Vercel AI Gateway. Titles and descriptions from the underlying Google Calendar events are not sent. Every model request explicitly requires zero data retention and prohibits using prompts for model training. The request fails if no eligible provider can satisfy those controls. Neither TOWIU nor a model provider uses Google user data for advertising, profiling, or training generalized AI models. TOWIU's use of Google data complies with the Google API Services User Data Policy, including the Limited Use requirements.
Protection and retention
Data is encrypted in transit. Server-side authorization checks restrict access to the owning account and content the user explicitly shares. Logs exclude messages, calendar titles, OAuth tokens, and other private content. Account data remains until deletion; connected calendar data and credentials are removed when the integration is disconnected or the account is deleted.
What we do not do
We do not sell your data, we do not show ads, and we do not share your content with other users beyond what you explicitly choose to share.
Your rights and controls
Export and deletion are built into the app: you can download your data from the data-export page and delete your account (including your data) from the account-deletion page at any time — no email required. For any other request under the GDPR (access, rectification, objection), write to hi@towiu.org.
A note on wellbeing features
Check-ins and the assistant are non-clinical planning aids. Their content is treated like the rest of your private data and is never used to profile you.
Contact
Privacy questions: hi@towiu.org