Privacy Policy
Last updated: October 21, 2026
1. Introduction
Amplify Productivity LLC, a Wyoming limited liability company ("Amplify," "we," "our," or "us"), respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application, desktop application, and related services (collectively, the "Service").
By using the Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Service.
2. Information We Collect
(a) Information You Provide
- Account information (email address, name, password)
- Profile information (nickname, display preferences, timezone)
- Onboarding responses (productivity goals, scheduling preferences, work hours)
- Productivity content you create (calendar events, habits, goals, tasks, journal entries, reminders)
- Screen-blocking block lists, schedules and focus sessions (desktop and iPhone apps)
- If you turn on Locked-in mode on your iPhone, the email address of an accountability partner, if you name one (on the web you can add or change it from the Locked-in card). We email that person, who may not use Amplify, through Resend: when you lock in, when you ask for your Screen Time passcode back, and if Screen Time access is switched off on your phone while you are locked in. Each message names you by your account email address and says what happened. We use the address for nothing else.
- Journal entries and check-ins (your notes, mood and energy ratings, and the daily lines you say you held)
- Your marks on past blocks (done, missed, what got in the way) and the standing rules you give the assistant
- AI chat messages and coaching conversations, and what you say to the voice assistant (processed as you speak; we do not keep the audio)
- Feedback you send from inside the app, including an optional screenshot
- Contact form submissions and support requests
- Messages you send the Ask Amplify chat on our public pages, with your IP address and, if you leave it, your email. Google Gemini writes the chat's replies; we keep the conversation so we can follow up
(b) Information Collected Automatically
- Device information (browser type, operating system, screen resolution; from the iPhone app, the iOS version, sent with Screen Time access events)
- Log data (IP address, access times, pages viewed, referring URL)
- Usage information (features used, interaction patterns, session duration)
- A/B testing variant assignments
- Performance and error data
- Desktop activity, only when the Amplify desktop app is installed and tracking is switched on: which application is in front and for how long, the domains of browser tabs you visit and how often, and search queries typed into your browser. This is what the daily score and drift nudges are computed from, and you can pause or switch it off in the desktop app. If you choose apps you work in, the desktop app also reads the title of those apps' front window, on your Mac, to tell which of your tasks you're on. The title never leaves your Mac; we store only which task, which app and when, plus the icons of the apps you use.
- From the Amplify browser extension (Safari, Chrome and other Chromium browsers): the extension shows the Amplify screen on sites you've blocked while blocking is on. If you pair it with the desktop app and turn on search queries there, it hands each search you make to the desktop app on your Mac, which records it as described above. It never records private windows, and the extension itself sends nothing to us.
- From the iPhone companion app: when a blocking schedule started, ended, or was skipped; when Screen Time access was switched off or back on, with the session and schedule it happened in and your iOS version; your marks on past blocks; once a minute while the app is open on screen, a beat with the name of the tab you are on; the assistant conversations you have in the app, which we save with your web chats; and the push token Apple gives your phone, so we can notify it. The apps you use and how long you use them, which Screen Time measures on your phone, never leave your phone.
(c) Information from Third Parties
- Google OAuth profile information (name, email, profile picture) when you sign in with Google
- Google Calendar data (events, calendars) if you enable calendar sync
- Outlook calendar data (events, calendars) and your Microsoft account's name and email address if you connect an Outlook or Microsoft 365 account. Amplify only reads it (see section 5).
- Apple Calendar data (events, calendars) from iCloud if you connect it with your Apple ID email and an app-specific password. Amplify only reads it (see section 5).
- Events from a calendar link (.ics or webcal) you paste in, such as a team's fixtures or a class timetable
- WHOOP data (recovery, sleep, strain, workouts) if you connect a WHOOP account
- Apple Health data (sleep, workouts, heart-rate variability, resting heart rate, steps, active energy) if you turn on Use Apple Health in the iPhone app. Amplify only reads it; it never writes to Apple Health.
- Stripe payment confirmation data (subscription status, billing period) — we never receive your full card number
3. How We Use Your Information
We use the information we collect to:
- Authenticate your identity and maintain your account
- Provide, maintain, and improve the Service
- Process payments and manage subscriptions via Stripe
- Sync your calendar data with Google Calendar, and read the Outlook, Apple and linked calendars you connect, so your plan works around them (if enabled)
- Power AI-based personalization, coaching, and natural-language features
- Store AI conversation memories to improve future interactions
- Send transactional emails (account verification, password resets, billing receipts, trial reminders)
- Conduct A/B testing to improve user experience
- Enforce rate limits and prevent abuse
- Respond to your comments, questions, and support requests
- Analyze usage patterns and diagnose technical issues
- Comply with legal obligations
4. AI-Powered Features
Amplify uses third-party AI services to power coaching, natural-language event creation, voice commands, automated scheduling, and personalized productivity insights. When you use AI features, data is sent to the following vendors on your behalf:
- Google Gemini (Google LLC) — powers most text requests and writes the assistant's replies in voice conversations. Your message and relevant account context (goals, projects, upcoming events) are sent to Google's Generative AI API; in voice conversations on the web they reach Gemini through Deepgram (below). Once a week, if you used Amplify that week, Gemini also receives a summary of your goals, habits and calendar to suggest one change for the week ahead.
- Anthropic Claude (Anthropic PBC) — handles weekly planning, goal restructuring and schedule setup requests in the web assistant, and answers a text request when Gemini returns an error. The same kinds of data are sent as above.
- Deepgram (Deepgram, Inc.) — transcribes your speech to text and converts the assistant's replies to speech. Audio goes to Deepgram's API directly from your browser or iPhone. In voice conversations on the web, Deepgram also receives the account context the assistant uses (described below) and passes it to Google Gemini to write each reply.
- OpenAI (OpenAI, L.L.C.) — powers the live voice mode, which is off unless it is turned on for your account. While a live voice session is open, your speech streams to OpenAI and the assistant's voice streams back; OpenAI also receives your name, a short summary of today's schedule, and the answers Gemini writes for it.
Bring your own key: if you add your own Gemini or Anthropic API key in Settings, requests to that vendor are made under your key and billed to you. Voice conversations on the web don't use your key: their replies come through Deepgram. The key is stored encrypted, is never included in your data export, and is deleted with your account.
What these vendors see:
- Your message or audio for the current request
- Relevant context from your account (goals, projects, upcoming events) needed to give useful answers
- If you connected WHOOP or turned on Apple Health, a short summary of your recent sleep, heart rate, steps and workouts
- If you use the reconstructed day on the Activity page, the apps you used that day and your most-visited site domains and searches from the desktop app (sent to Gemini)
Apple Health data is used only to plan and score your day in Amplify. It is never used for advertising or marketing and never sold. Beyond the database and hosting providers that store Amplify itself, it goes to the AI providers above only when you use the assistant, and to our email provider (Resend) when your Sunday email names the sleep or workout time that decided a block. The iPhone app asks for your permission, naming those providers, before it reads anything. Turn it off in the iPhone app's Account tab; Download My Data includes it and Delete Account removes it.
Health data: WHOOP and Apple Health data, and anything else you give us that says something about your health, is also covered by our Consumer Health Data Privacy Policy. It lists every category we collect, who receives it, and your rights under Washington's My Health My Data Act and the Nevada and Connecticut health-data laws. We give those rights to everyone, wherever you live.
What these vendors do NOT see:
- Your password or authentication tokens
- Your payment information
- Data belonging to other users
- Data unrelated to the current request
Retention at each vendor:
- Deepgram: every request we send opts out of Deepgram's Model Improvement Program, so Deepgram keeps your audio and text only as long as it takes to process them and does not use them to train its models.
- Google Gemini: retention is governed by Google's API terms. Google may use what it receives, including in voice conversations, to improve its products and train its AI models, and people at Google may review it.
- Anthropic Claude: retention is 30 days by default for abuse monitoring. Anthropic does not train on API data.
- OpenAI: retention follows OpenAI's API data policy. OpenAI does not train on API data.
What we don't do:
- We don't use your data to train AI models of our own. Anthropic, OpenAI and Deepgram don't train on it either; Google may, as described above.
- We don't sell your AI conversations or any data derived from them.
- We don't share your AI conversations with advertisers or data brokers.
Memory system: The AI may store conversation summaries and preferences to provide continuity across sessions. You can request deletion of AI memories at any time by contacting privacy@amplifyproductivity.com.
If you'd rather not use AI: You can disable AI features any time from Settings → AI → Disable AI features. The manual side of Amplify — creating goals, projects, tasks, events, habits — works fully without AI.
A note on third-party control: We select vendors whose terms align with our privacy commitments, but we don't control how Google, Anthropic, Deepgram, or OpenAI operate their services. If a vendor's terms change materially, we will update this page and notify you by email.
AI-generated content is for informational purposes only and does not constitute professional advice. For a complete list of third-party data processors, see our Data Processors page.
5. Calendar Connections
Every calendar connection is optional and you can remove it at any time from Account → Connected apps. Deleting your account removes all of them.
Google Calendar
If you choose to connect your Google Calendar, the following applies:
- We use Google OAuth 2.0 to request permission to read and write to your Google Calendar.
- OAuth access and refresh tokens are stored securely in our database to maintain the connection.
- We store your Google profile information (name, email, profile picture) for display purposes.
- Calendar events are synced between Amplify and your Google Calendar based on your sync settings.
- You can disconnect Google Calendar at any time from your account settings, which revokes our access and deletes stored tokens.
Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.
Outlook and Microsoft 365
- We use Microsoft's sign-in (OAuth 2.0) to ask for read-only access to your calendars and your basic profile (name and email address). We never ask for your email, contacts or files, and we never write to your Outlook calendar.
- Microsoft's access and refresh tokens are stored encrypted in our database to keep the connection.
- We import your events from about 30 days back to 90 days ahead (title, time, location, the start of the notes, whether it shows you as busy, and how many people are invited, never who) and refresh them about once an hour and while you have your calendar open.
- Disconnecting removes every imported event and the stored tokens. You can also remove Amplify from the apps that can access your Microsoft account in your Microsoft account's privacy settings.
Apple Calendar (iCloud)
- You connect with your Apple ID email address and an app-specific password you create at account.apple.com. Apple doesn't allow your real Apple ID password for this, and we never ask for it.
- The app-specific password is stored encrypted and used only to read your calendars from iCloud. We never write to them.
- We import your events from about 30 days back to 90 days ahead (title, time, location, notes, and how many people are invited, never who) and refresh them about once an hour.
- Disconnecting removes every imported event and the stored password. To cut off access on Apple's side too, delete the app-specific password at account.apple.com.
Calendar links
If you paste a calendar link (.ics or webcal), our servers fetch it about once an hour and import its events the same way. Links like these often contain a private key, so we store the link encrypted. Removing the link deletes it and its events.
6. Payment Information
Payment processing is handled entirely by Stripe. We do not receive, store, or process your credit card numbers, bank account details, or other sensitive payment credentials.
What we do store:
- Stripe customer ID and subscription ID
- Subscription status (active, cancelled, past due, trialing)
- Billing period dates (current period start and end)
- Plan type and pricing tier
- Payment event history (successful payments, failures, cancellations) for billing support
For information on how Stripe handles your payment data, see Stripe's Privacy Policy.
8. Data Sharing and Third Parties
We do not sell, rent, or trade your personal information. We share data only with the following service providers who process it on our behalf:
- Supabase — Database hosting, authentication, and real-time data services
- Stripe — Payment processing and subscription management
- Google (Gemini API) — AI-powered text and voice features
- Anthropic (Claude API) — Weekly planning, goal restructuring and schedule setup requests, and a fallback when Gemini returns an error
- Deepgram — Voice speech-to-text, text-to-speech, and the web voice conversation that relays your request to Gemini
- Google (Calendar API & OAuth) — Calendar synchronization and authentication
- OpenAI — Live voice mode, only when it is turned on for your account
- Microsoft (Microsoft Graph & sign-in) — Reading your Outlook calendars, only if you connect them
- Apple (iCloud) — Reading your Apple calendars, only if you connect them
- WHOOP — Wearable data (recovery, sleep, strain, workouts), only if you connect it
- Vercel — Application hosting and serverless function execution
- Resend — Transactional email delivery
- Apple — Push notifications to the iPhone companion app (device tokens only)
- Your browser's push service (Apple, Google or Mozilla) — Web push notifications, if you turn them on
- Google (Maps Distance Matrix API) — Travel-time estimates between event locations, when locations are set
A complete list with each vendor's purpose, what they see, and their retention policy is available on our Data Processors page.
Apps and agents you connect yourself: in Account → Devices & agents you can create a personal access token for an app or AI assistant you use, such as Claude. Whatever holds the token can read, and if you allow it, change, the parts of your Amplify data you picked for that token, and what that app does with it is governed by its own privacy policy, not ours. You can also connect another company's agent so it can post notes into your daily briefing; it can't read or change your data. You can revoke either at any time on the same page, and they are deleted with your account.
We may also disclose your information if required to:
- Comply with applicable law, regulation, or legal process
- Protect the rights, property, or safety of Amplify, our users, or the public
- Enforce our Terms of Service
- Detect, prevent, or address fraud, security, or technical issues
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice before your data becomes subject to a different privacy policy.
9. Data Retention
We retain your information for the following periods:
- Active account data (events, habits, tasks, preferences): Retained for the duration of your account.
- Billing and payment records: Retained for 7 years after your last transaction for tax and legal compliance.
- Server logs: Kept by our hosting provider for a limited period (see the Data Processors page), then deleted.
- Contact form submissions: Retained for up to 2 years.
- Account deletion: When you delete your account (Account → Your data), your account and every record tied to it are deleted immediately in one operation — every table in our record of processing (email privacy@amplifyproductivity.com for a copy). At the same time we revoke the Google Calendar and WHOOP access you granted, remove your Outlook, Apple Calendar and calendar-link connections with their stored tokens and passwords, delete your Stripe customer record (which cancels any subscription), and remove screenshots you uploaded. Nothing waits for a batch job.
- Database backups: Our database provider keeps automatic daily backups for up to 7 days. We also keep an encrypted copy of the database on storage we control, and delete each copy after 28 days. A deleted account is gone from the live database immediately, from the provider's backups once they roll over, at most 7 days later, and from our encrypted copies at most 28 days later. We keep no other copies.
- Records tied to your email address rather than your account — your waitlist sign-up, your beta application, questions you asked the assistant on our website, and contact-form messages — are deleted with your account too. Our email delivery log keeps the date and type of each email we sent you, with your address removed.
- Anonymized, aggregated data may be retained indefinitely for analytics.
10. Data Security
We implement industry-standard security measures to protect your data:
- Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (HTTPS).
- Encryption at rest: Data stored in our database is encrypted using AES-256 encryption via Supabase.
- Password security: Passwords are hashed using bcrypt and are never stored in plaintext.
- Row-Level Security (RLS): Database policies ensure users can only access their own data.
- Two-step verification (optional): you can require a 6-digit code from an authenticator app when you sign in with your email and password. Sign-ins with Google or Apple use that provider's own 2-step verification.
- Rate limiting: API endpoints are protected against abuse with rate limiting.
- Security headers: HTTP security headers are configured to prevent common web vulnerabilities.
While we strive to protect your information, no method of electronic transmission or storage is 100% secure. If we become aware of a security breach that affects your personal data, we will notify affected users and relevant authorities as required by applicable law.
11. International Data Transfers
Amplify is based in the United States. Our primary data infrastructure (Supabase, Vercel) is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and other appropriate transfer mechanisms to ensure adequate protection for your data. Our sub-processors maintain their own compliance with international data transfer requirements.
12. Your Privacy Rights
General Rights
Regardless of your location, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Withdraw consent for data processing
Additional Rights for EEA/UK Residents (GDPR)
If you are located in the EEA or UK, you additionally have the right to:
- Object to processing based on legitimate interests (Article 21)
- Restrict processing of your data (Article 18)
- Not be subject to automated decision-making with legal effects (Article 22)
- Lodge a complaint with your local data protection authority
Our legal bases for processing your data include:
- Contract performance: Processing necessary to provide the Service you requested
- Consent: Where you have given specific consent (e.g., AI features, Google Calendar sync)
- Legitimate interests: Analytics, security, and service improvement, balanced against your rights
- Legal obligation: Tax records, fraud prevention, and compliance requirements
California Residents (CCPA-Aligned)
If you are a California resident, you have the right to:
- Know what personal information we collect and how it is used
- Request deletion of your personal information
- Opt out of the sale of personal information — we do not sell your personal information
- Non-discrimination for exercising your privacy rights
Washington, Nevada and Connecticut: health data
Your rights over health data (access, deletion, withdrawing consent, appeal) are in our Consumer Health Data Privacy Policy.
Do it yourself, right now
Two of these rights are built into the product, no email needed:
- Access and portability — export everything: Account → Your data → Download My Data downloads one JSON file with every record we hold about you (the tables in our record of processing), with readable cross-references. Passwords, API tokens and OAuth secrets are never included.
- Erasure — delete your account: Account → Your data → Delete account deletes the account and all of its data immediately, revokes the Google Calendar and WHOOP access you granted, and deletes your Stripe customer record. It cannot be undone.
- Fresh start without leaving: Start Over, on the same Your data tab, can wipe your content (calendar, tasks, habits, goals, journal, blocking, activity) while keeping the account, its connections and billing.
For anything else — correction, restriction, objection, or a copy in another format — contact us at privacy@amplifyproductivity.com. We will respond to verified requests within 30 days (or 45 days if an extension is needed, with notice).
13. Children's Privacy
The Service is for people 18 and older and is not intended for children. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13, please contact us at privacy@amplifyproductivity.com.
14. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice by posting the updated policy on the Service, updating the "Last updated" date, and — where feasible — sending an email notification. Your continued use of the Service after the effective date of a revised policy constitutes acceptance of the changes.
15. Contact Us
If you have any questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us:
- Privacy inquiries: privacy@amplifyproductivity.com
- Data protection requests: privacy@amplifyproductivity.com
- Entity: Amplify Productivity LLC, Wyoming, United States