1. Overview
Cadelyst LLC ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, your rights regarding your data, and how we comply with applicable privacy laws. We keep this policy simple and honest — your data exists to make the app work for you, not to be monetized.
This policy applies to users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18.
2. Information We Collect
Information you provide directly:
- Account information including name, email address, and password (stored encrypted)
- Profile data such as wake time, sleep time, and lifestyle preferences collected during onboarding
- Goals including the text, categories, and deadlines of your personal goals
- Daily tasks you plan and complete each day
- Journal entries including your written reflections, intentions, and notes
- Schedule data including your daily time-block plans
- Brain Dump items including tasks and notes you capture outside your daily structure
- AI coach conversations including messages you send to and receive from the AI coach
- Calendar data including your win/loss records and day notes
- Profile photo (optional) if you choose to upload one
- Payment information, handled entirely by Stripe — we never see or store your full card number
Information collected automatically:
- Usage data including which features you use, frequency of use, and AI message count for enforcing usage limits
- Device information including browser type, operating system, and time zone for notification scheduling
- IP address, logged temporarily for security purposes
- Error and crash data, consisting of anonymous technical logs to improve app stability
3. How We Use Your Information
We use your information solely to operate and improve the Service. Specifically, we use it to:
- Provide the app experience by displaying your goals, tasks, journal, and calendar
- Power the AI coach by sending your goals, task history, and recent journal entries to Anthropic's API as context to generate relevant coaching responses
- Send notifications including wake-up reminders, bedtime prompts, and goal deadline alerts at times you set
- Manage billing and your subscription
- Enforce usage limits by tracking your monthly AI message count
- Detect and prevent misuse by automatically screening messages sent to the AI coach, and retaining records of requests that violate these Terms or our Acceptable Use policy for safety, abuse-prevention, and legal purposes
- Improve the Service by analyzing anonymous usage patterns
- Communicate with you by sending service updates, security notices, and support responses
We do not use your data for advertising, sell your data to third parties, or use your journal entries or goals for any purpose other than delivering the Service to you.
4. AI Coach and Third-Party Data Processing
The AI coaching feature is powered by Anthropic, PBC. When you send a message to the coach, a request is made to Anthropic's API. This request includes your message, your goals, recent task history, and a system prompt. This data is transmitted to Anthropic's servers for processing.
Anthropic processes this data in its capacity as a service provider to Cadelyst and is prohibited by contract from using your data for Anthropic's own commercial purposes. Anthropic does not receive your full journal archive, payment information, or account credentials. Only the context necessary for a useful coaching response is included in each request. We encourage you to review Anthropic's privacy policy at anthropic.com/privacy.
Cadelyst's Terms of Service represent that user data is not used to train AI models without your consent. We maintain contractual commitments with Anthropic supporting this representation and will update this policy if those commitments change.
5. Data Storage and Security
Your data is stored on secure servers in the United States. We implement industry-standard security measures including:
- Encryption in transit (TLS/HTTPS) for all data transmitted between your device and our servers
- Encryption at rest for stored personal data and journal entries
- Hashed and salted password storage
- Access controls limiting which personnel can access user data
No method of transmission or storage is 100% secure. In the event of a data breach that compromises your personal information, we will notify you without unreasonable delay and in accordance with the requirements of applicable state law, including Michigan's Identity Theft Protection Act (MCL 445.63) and other applicable state breach notification statutes.
6. Data Retention
We retain your data for as long as your account is active. When you cancel your subscription, your active account data is retained for ninety (90) days before permanent deletion, allowing you to reactivate if you change your mind. You may request immediate deletion at any time by contacting Hello@Cadelyst.com.
Encrypted backup copies of your data may be retained for up to 180 days before deletion, even after your active account data has been permanently deleted. Anonymous, aggregated usage statistics containing no personal data may be retained indefinitely for product improvement purposes.
7. Your Rights
Depending on your location, you may have the following rights:
- The right to access a copy of the personal data we hold about you
- The right to request correction of inaccurate personal data
- The right to request deletion of your account and all associated personal data
- The right to request your data in a machine-readable format (JSON export)
- The right to object to certain processing of your data
- The right to withdraw consent for optional data processing at any time
To exercise any of these rights, email Hello@Cadelyst.com. We will respond within 30 days. Additional rights that may apply to residents of specific states are described in Section 11.
8. Third-Party Services
Cadelyst uses the following third-party services, each acting as a service provider to Cadelyst rather than as an independent recipient of your data. Each provider processes your data solely to provide services to us and is prohibited by contract from using your data for their own commercial purposes. Their respective privacy policies also apply to their processing:
- Stripe, Inc. (payment processing) — stripe.com/privacy
- Anthropic, PBC (AI model API for the coaching feature) — anthropic.com/privacy
- Vercel, Inc. (hosting and infrastructure) — vercel.com/legal/privacy-policy
- Supabase, Inc. (database and authentication) — supabase.com/privacy
We do not use advertising networks, analytics resellers, or social media tracking pixels.
9. Age Restrictions
The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If we learn that an account was created by a user under the age of 18, we will terminate that account and delete all associated personal information promptly. If you believe a user under 18 has provided us with personal information, please contact Hello@Cadelyst.com.
10. Cookies and Local Storage
Cadelyst uses browser local storage to remember your preferences (theme, notification settings) and keep you logged in between sessions. We do not use third-party tracking cookies or advertising cookies.
DO NOT TRACK: We honor Do Not Track browser signals by not deploying third-party tracking technologies. Because we do not use cross-site tracking technologies, Do Not Track signals have no practical effect on our current data collection practices. If we ever add third-party tracking technologies in the future, we will update this policy and provide users with appropriate opt-out choices before doing so.
You can clear local storage via your browser settings, though this will log you out of the app.
11. State Privacy Rights
Residents of certain states have additional rights under their state's applicable privacy law. Cadelyst does not sell your personal information to third parties and does not share your personal information for targeted advertising or cross-context behavioral advertising purposes. Because we do not engage in those activities, no opt-out from a sale or share is necessary.
California Residents: The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), provides California residents with the right to know what personal information is collected and how it is used; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information (not applicable here, as we do not sell or share for advertising); the right to limit use of sensitive personal information (we do not use sensitive information beyond what is necessary to provide the Service); and the right not to receive discriminatory treatment for exercising these rights.
Virginia Residents: The Virginia Consumer Data Protection Act (VCDPA) provides the right to access, correct, delete, and obtain a copy of personal data, and the right to opt out of the sale of personal data and targeted advertising (neither of which Cadelyst engages in).
Colorado Residents: The Colorado Privacy Act (CPA) provides similar rights to access, correct, delete, and obtain a portable copy of personal data, as well as the right to opt out of the sale of personal data and targeted advertising.
Connecticut Residents: The Connecticut Data Privacy Act (CTDPA) provides rights to access, correct, delete, and obtain a copy of personal data, and the right to opt out of the sale of personal data and targeted advertising.
Texas Residents: The Texas Data Privacy and Security Act (TDPSA) provides the right to access, correct, delete, and obtain a copy of personal data, and the right to opt out of the sale of personal data and targeted advertising.
To exercise any of the rights described in this section, please email Hello@Cadelyst.com. We will respond within forty-five (45) days. We will not discriminate against you for exercising your privacy rights.
12. Changes to This Policy
We may update this Privacy Policy periodically. When we do, we will update the effective date at the top of this document and notify you via in-app notice or email for material changes at least thirty (30) days before such changes take effect. Your continued use of the Service after any change constitutes acceptance of the updated policy.
13. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact: Cadelyst Privacy Team · Hello@Cadelyst.com. We take privacy seriously and will respond to all inquiries within 5 business days.