TimeKeeper Privacy Policy
Draft · pending legal reviewThis is not final wording. The operator will review and confirm it, then remove this notice. ⚠️ marks places that still need to be checked.
1. Who we are and where this applies
- Operator: glonest (Business Registration No. 389-01-03800) ("the operator", "we")
- Scope: the TimeKeeper iPhone app and the LifeForge website. The same policy applies to both.
- Service region: Republic of Korea
- Effective date: ⚠️ to be set once confirmed (draft written 2026-11-07)
2. Personal information we process and why
| Category | Items | Purpose |
|---|---|---|
| Required · Sign-in | Account identifier (Firebase user ID); the email address, name, and profile picture URL passed to us by Apple or Google (if you choose Apple "Hide My Email", the relay address Apple creates) | Signing in and identifying your account. We do not copy your email or name into app data |
| Required · Apple sign-in authorization | If you signed in with Apple, the sign-in token Apple gives us (stored encrypted on our server) | Asking Apple to revoke TimeKeeper's sign-in authorization when you delete your account |
| Required · Account sync | Records (the four-choice result, times, notes, dictated text, and the type and time of attachments), saved snippets, plans (time slots, timetables, goals, tasks), weekly status, one-line evening reflections, weekly coaching notes, monthly reviews and lessons learned, progress per goal, notification settings, your personal wiki, and a downsized copy of photos (about 1280 px on the long side, with location data in the photo removed) | Keeping this iPhone, your other devices, and the website in the same state, and restoring it on a new phone or after reinstalling |
| Required · Linking with the website | Weekly summaries (minutes completed per time of day, time-slot group names and colors, goal and task names and times, counts of each of the four record choices), a summary of free time for the next 4 weeks, time zone and last sync time, imported recipes and weekly progress | The website's analysis room, tailored recipe suggestions, and the plaza's "best fit for me" order |
| Required · Consent records | Consent version, when you agreed, whether you turned each of the 2 optional consents on and when you changed it, where you agreed (app or website) | Proving consent |
| Optional ① Usage pattern analysis | Age group (by decade), gender, region (province or metropolitan city); "prefer not to say" is available for each | Choosing "schedules that worked for people like me" from anonymous aggregates of 20 or more people |
| Optional ② Server AI | Section 4 | Polishing recommendation reasons, notification wording, and plans you told us by voice |
| Optional · Google Calendar connection | Busy time ranges from your Google Calendar (start and end times only) and the connection authorization (stored encrypted on our server) | Section 5 |
| What you post to the plaza | Recipes and reviews you choose to share (before posting, they pass rules that remove real names, places, companies, contact details, and exact times), and reports you make (what and why) | Sharing in the plaza, operator moderation |
- We do not use your information for advertising, sell it, or combine it with other services.
- Only you can read your synced content. No one else can see your data, and the operator does not open and read any individual's content ⚠️ disclosure of operator access controls
3. What we do not collect
- Location (including approximate location): Approximate location (about 1 km) attached to a record is used only for the verification check on this iPhone and is not uploaded to our server. Only a "location was attached" marker and its time go to your account (Section 6).
- Original photos (they stay on the iPhone), original audio (deleted after dictation), and any record of how you responded to notifications.
- We do not use analytics or advertising tools.
4. Server AI (optional consent) — what is sent to outside AI companies
Server AI is used only when you turn it on. It starts off, and once you turn it off nothing more is sent from that moment. If you decline, the app works the same and the time and date values of recommendations do not change. Only the wording comes from the on-device AI on this iPhone or from built-in rule sentences. The website does not call AI.
| What is sent | When |
|---|---|
| Names of on-screen choices and the reason sentence made by the rules (it may contain task and time-slot names) | When polishing recommendation reasons, record choices, and carry-over wording |
| The first 20 characters of a task name | When polishing the wording of slot-start notifications |
| A few lines of your personal wiki needed for the task and a description of the situation (sentences without numbers) | When writing recommendation reasons, notification times, one-line coaching, and timetable questions |
| One thing you told us by voice (or text), up to 120 characters | When you tell us something while wrapping up the weekly plan or recording past activity |
- Never sent: record notes, photos, location, original audio, your account email or name, Google Calendar data (busy times and any recommended plan they changed, Section 5). Wiki lines and spoken text are not sent if they look like a phone number, email address, or web address.
- Where it goes: through the TimeKeeper server (Firebase Cloud Functions, Seoul region) to OpenRouter, Inc. (USA) and the AI model providers behind it. The current default model is from the Qwen family (Alibaba Cloud) ⚠️ the model provider and its country may vary depending on the route OpenRouter selects
- What the TimeKeeper server keeps: it does not store the text sent; it keeps only the number of calls, their times, token counts, and cost. There are daily and monthly limits per user and a monthly limit for the whole service; beyond them, wording comes from rule sentences.
- Where to turn it on or off: in the iPhone app, Settings > AI or Settings > Privacy & Consent; on the website, My consent.
5. Google Calendar connection (optional)
- If you connect, we fetch only the busy time ranges (start and end times) from your Google Calendar and use them to place your schedule, and we write the events TimeKeeper placed (task name and time) only to a new "TimeKeeper" calendar created in your Google account. We do not fetch event titles, attendees, locations, or notes.
- When you disconnect, we revoke the authorization and delete our server records, and you can choose whether to keep the TimeKeeper calendar. When you delete your account, we also delete the TimeKeeper calendar and revoke the authorization.
- Limited Use: TimeKeeper's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (policy text ↗). Busy times received from Google Calendar are used only to calculate schedule placement and to show overlaps. Google Calendar data is never sent to server AI — when busy times change a recommended plan, its reason sentence is written only by the on-device AI on this iPhone or by built-in rule sentences. It is not used for advertising or to train AI models, and is not read by humans ⚠️ check the Limited Use disclosure wording
6. Location stays on this iPhone
- When a photo taken with the app camera or an approximate location (about 1 km) is attached to a record, that activity is judged a "verified activity". The check is done by the on-device AI on this iPhone (Apple Vision), and photos are not sent to server AI for it.
- Approximate location stays only on this iPhone. Because no coordinates go to your account, a record verified by location may appear as a plain "done" record on other devices.
7. Retention and deletion
- Required items: until you delete your account. When you delete it in the iPhone app under Settings > Account > Delete account or on the website under My consent > Delete account, we immediately delete the account document, synced content, photos, summaries, profile, and sign-in records on our server. If anything remains, the server finishes deleting it within a few hours.
- Apple sign-in token: when you delete your account, we ask Apple to revoke it and then delete it. If you stop using Sign in with Apple for TimeKeeper in your Apple account settings, we receive Apple's notification and delete the stored token.
- Google connection authorization: revoked and then deleted when you disconnect or delete your account.
- Deleted-account marker: after you delete your account, we keep only the account identifier, the time of deletion, and the revocation results, so that data is not created again under the same account identifier ⚠️ retention period
- Optional ①: when you turn the optional consent off, we immediately delete your age group, gender, and region. Aggregates already made keep only numbers from which no individual can be identified ⚠️
- Optional ②: the text sent does not remain on the operator's server. We keep only the number of calls, times, token counts, and cost per day, and delete them with your account. Retention by OpenRouter and the model providers follows their own policies ⚠️ retention period
- Consent records: kept until you delete your account, to prove consent ⚠️ retention period after withdrawal
- Plaza reports: kept in the moderation list (information about the reporter is removed when that person deletes their account) ⚠️ retention period
- Signing out does not delete your account. Data on this iPhone and content synced to your account remain.
- How we delete: server records are deleted so that they cannot be restored ⚠️ backup deletion cycle
8. Processors and transfers abroad
| Recipient | Country ⚠️ | What | Why | When and how | Retention |
|---|---|---|---|---|---|
| Google LLC (Firebase Authentication, Firestore, Cloud Storage, Cloud Functions, Hosting) | Google data centers in the USA and elsewhere (Functions in the Seoul region) ⚠️ storage location | Required items and optional ① items in Section 2 (including synced content and photos, and the encrypted Apple and Google tokens) | Sign-in, storage, sync | At sign-in and sync, over encrypted connections | Same as Section 7 |
| OpenRouter, Inc. and the AI model providers behind it (current default: Qwen family) | USA ⚠️ country of each model provider | Section 4 (only when optional ② is on) | Polishing AI wording | When wording is made, over encrypted connections | Section 7, optional ② |
| Google LLC (Google Calendar API) | USA and elsewhere | Section 5 (only when connected) | Reading busy times, writing to the TimeKeeper calendar | When connecting and syncing, over encrypted connections | Section 5 |
| Apple Inc. (Sign in with Apple) | USA ⚠️ | Apple sign-in token (only if you signed in with Apple) | Confirming sign-in, revoking it when you delete your account | At sign-in and account deletion, over encrypted connections | Apple's policy |
- If you do not want server AI data transferred abroad, simply leave optional ② off. If you do not connect Google Calendar, nothing is sent for it either. The Firebase transfer is needed for sign-in and sync, so if you refuse it you cannot use the app ⚠️ boundary between required and optional
- Apart from the table above, we do not give personal information to any other company (no provision to third parties).
9. Your rights and how to exercise them
- At any time you can view your information (consent details in the app under Settings > Privacy & Consent and on the website under My consent), correct it, turn optional consents off, and delete your account. Withdrawing required consent is done by deleting your account.
- Send any other request (access, copy, correction, deletion, suspension of processing) to the contact in Section 10. We reply within ⚠️ 10 days of receiving it.
10. Privacy officer and contact
- Privacy officer: glonest operations team (same contact as below) ⚠️ whether a name is required
- Contact: contact@glonest.kr (to be opened)
- Reporting and counseling on privacy violations (Korea): Personal Information Infringement Report Center (118, no area code), Personal Information Dispute Mediation Committee (1833-6972) ⚠️ check numbers
11. Children
Children under 14 need the consent of a legal guardian ⚠️ how age is checked
12. How we keep your information safe
- Server security rules allow only you to read and write your account's data. All communication is encrypted.
- The Apple sign-in token and the Google connection authorization are stored encrypted and are blocked from being read anywhere in the app or website ⚠️ management of operator access rights
- Server logs do not contain content such as record notes, notes, or audio, or email addresses.
- The website uses browser storage for the display theme, the reduce-motion setting, and keeping you signed in. We do not use visit-analytics or advertising cookies ⚠️ disclosure of automatic collection tools
13. Changes
When we change this policy, we announce it in the app and on this page starting 7 days before it takes effect ⚠️. When the consent text changes, the app and website ask for consent again. The current consent text is consent-v3.
| Date | Changes |
|---|---|
| 2026-11-04 | First draft (optional server AI consent, location not uploaded, Google Calendar Limited Use) |
| 2026-11-07 | Sign in with Apple and storing and revoking the Apple token, operator name (glonest), deleted-account marker, no provision to third parties, Google Calendar data not sent to server AI |
The glonest.kr website
This website (glonest.kr) has no sign-up, no input forms, and no visit-analytics tools.