Privacy Policy

1. The short version

EncoreLiving stores the information you put into it so it can show it back to you. We do not sell your personal information, and we do not use it to serve you advertising.

2. What we collect

• Account details. Your name, email address, and profile photo, provided by Google when you sign in.
• Content you add. Lists, contacts, mailing addresses, links, notes, saved articles, calendar tasks and reminders, and your general location if you set one for weather.
• Connected-account tokens. If you connect Google Calendar, we store the access and refresh tokens needed to read and write your calendar.

We do not ask for and do not want financial account numbers, government identification numbers, or passwords for other services.

3. Where it is stored

Your data is held in a hosted database (Supabase) and reached only through our own server, which is the sole component that connects to it. The application in your browser never talks to the database directly. Uploaded photos are stored as files in Cloudflare R2 rather than in the database itself — your browser uploads a photo's bytes directly to R2 using a short-lived, single-use upload link that our server issues, and the photo is then served back to you through Cloudflare's content delivery network.

4. How we protect it

We do not collect highly sensitive data in the first place: as noted above, we do not ask for financial account numbers, government identification numbers, or passwords for other services. For the account and content data we do hold, we use the following safeguards:

• Encryption in transit. All traffic between your browser, our server, and the services we rely on (Google, Supabase, our AI provider) is sent over HTTPS/TLS.
• Encryption at rest.Your data is stored in Supabase's hosted Postgres database, which encrypts data at rest; uploaded photos stored in Cloudflare R2 are encrypted at rest as well.
• No client-side database access. As described in section 3, the app running in your browser cannot query the database directly. Every read or write goes through our own server, authenticated with a private key that is never exposed to the browser.
• Server-side session and tokens. Your sign-in session is anhttpOnlycookie that browser-side scripts cannot read, and your Google access and refresh tokens are held only on our server — never sent to your browser or exposed to client-side code.
• Least-privilege access. Access to the production database and hosting infrastructure is limited to the people who operate the Service, and is used only to maintain and troubleshoot it.

5. Who we share it with

We share data only with the providers needed to run the Service:

• Google: for sign-in, and for calendar data if you connect Calendar.
• Supabase: database hosting, and file hosting for photos uploaded before we moved photo storage to Cloudflare R2.
• Cloudflare (R2 and its content delivery network): storage and delivery for newly uploaded photos.
• Our AI provider (Google Gemini): text you send to the assistant, and the context needed to answer it, are sent to the model to generate a reply.
• A weather provider: your general location (such as a city), never a precise address.

We do not sell your personal information or share it with advertisers.

6. Google sign-in and Google Calendar

EncoreLiving uses Google for signing in, and, only if you choose to connect it, for your calendar. Connecting is optional, and the rest of the Service works without it.

What we ask Google for, and why:

• Your basic profile: your Google ID, email address, name, and profile photo (the standard “openid”, “email”, and “profile” sign-in permissions). We use these to create your account, know which account is signing in, and show your name and photo in the app.
• Your Google Calendar: to show your events on the dashboard and calendar page; to create, edit, and delete the events you make in EncoreLiving on your calendar; and, if you turn holidays on, to subscribe your Google account to the public US holidays calendar. We ask for this only when you connect Calendar.

What we do with it. Google Calendar data is used only to provide those calendar features to you, inside your own account. We store the access and refresh tokens Google issues, and calendar entries we have synced, in our database (see section 3). Tokens are held server-side and are never sent to your browser. The refresh token is what lets the calendar keep syncing after the short-lived access token expires; without it you would have to sign in again roughly every hour.

What we never do with it. We do not sell Google user data, use it for advertising or ad targeting, use it to build profiles, transfer it to data brokers or information resellers, or allow humans to read it, except with your explicit consent, where narrowly necessary for security or to comply with applicable law, or as part of a limited internal operation (such as investigating a bug you report) where the data is aggregated or anonymized wherever possible. We do not use Google user data to train, fine-tune, or otherwise improve generalized artificial-intelligence or machine-learning models. Calendar contents reach our AI provider only when something you ask the assistant requires reading or changing your calendar, and then only the entries needed to answer that request.

EncoreLiving's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Taking it back.You can revoke EncoreLiving's access to your Google account at any time from myaccount.google.com/permissions, which immediately stops all calendar syncing. Ask us and we will delete the Google tokens and synced calendar data we hold for you; if you delete your EncoreLiving account they are deleted with it, subject to the backup period described in section 9.

7. The AI assistant

When you use the assistant, your message and relevant context from your account are sent to the AI provider so it can respond and carry out what you asked. Please avoid typing information into the assistant that you would not want processed by a third-party AI service.

8. Cookies

We use a single essential cookie to keep you signed in. We do not use advertising or third-party tracking cookies.

9. How long we keep it

We keep your data for as long as your account is active. If you ask us to delete your account, we remove your content and disconnect any linked services. Backups may retain copies for a limited period before rolling off.

10. Your choices

• Edit or delete any item you have added, at any time, from within the app.
• Revoke EncoreLiving's access to Google Calendar at any time from your Google Account's connected-apps page (see section 6).
• Request a copy of your data, or ask us to delete your account entirely.

Depending on where you live, you may have additional rights over your personal data, including access, correction, and deletion. Contact us to exercise them.

11. Other people's information

The Service lets you store details about family and friends, such as birthdays and mailing addresses. Please only add information you have a legitimate reason to keep, and treat it with the same care you would want for your own.

12. Changes and contact

We may update this policy. If a change is material, we will ask you to review it. See the Terms & Conditions for the terms governing use of the Service.