Privacy, in plain words.

The account

Conberate requires you to sign in — with an email and password, through Google, or with Apple. Your email address is stored so the account can be identified and so I can reach you about it. OAuth providers pass only the identity details needed to resolve that account; Conberate never receives your Google or Apple password.

An account is required because the app syncs. That is a real trade, and I'd rather name it than bury it: your days exist somewhere other than one disk, and the price is that they exist on a server.

What syncs, and what never leaves your computer

Your tasks and scheduled blocks, quick-capture notes, weekly goals, focus profiles, product settings, and onboarding state sync to the server so they're available on every computer you sign in on.

Window layout, permission and browser-capability results, encryption keys, recovery backups, and privacy-safe diagnostics are local by design. They are device state, not product data, and are never synced with the account.

Everything is written to your computer before it is sent anywhere. The app works fully offline; sync catches up when you reconnect.

What is not collected

The app ships with no analytics on how you work, and no crash reporting. Nothing measures what you plan, what you write, or how long you focus. There is no advertising, no profiling, and no third party your content is handed to. It is not sold, not shared, and not read.

The one thing the app does send is a small anonymous ping: a random identifier generated on your computer, the app version, and whether this is an install or active ping. Install is sent once; active is sent at most once per day. That is the entire payload. It is not linked to your account or your email, it carries nothing from your days, and it exists so I can answer two questions no honest maker can skip: how many people installed this, and how many still use it a week later.

During first-time setup, the ping also records which setup step you reached. This shows where setup loses people without identifying who they are. It uses the same random identifier and is never linked to your account.

The sync server counts how many records your account stores and how much space they use. It does not inspect their contents. These totals are used only to operate and size the service.

If crash reporting is ever added, it will be opt-in, it will carry no content from your days, and this page will say so before it ships.

The platform interest vote

The download page carries a vote for another platform. Casting one stores a random vote id kept in your browser — so a second visit updates your vote instead of counting twice — along with which language you were reading. No IP address, no fingerprint, nothing that identifies you.

Leaving an email there is optional, and a vote counts without one. If you do leave one, it is stored for a single purpose: to tell you once, on the day that version actually exists. It is never added to a mailing list, never linked to a Conberate account, and never used for anything else. Ask and it's deleted.

Getting your data out

Settings includes a portable JSON export of your account and synced records. The file is written only to the location you choose on your computer.

Settings separates clearing one Mac's encrypted cache, replacing the synced dataset, and deleting the account. Account deletion revokes sessions, cancels recurring billing, detaches lifetime access, removes synced product data, and then releases the identity. The receipt remains available while provider or server retries finish.

If your plan ends, the days you synced stay on the server for twelve months. Warning emails are sent thirty days and seven days before deletion. Starting a plan again stops the countdown. Deletion removes only the server copy; data on your Mac remains untouched.

Paying for Conberate

Payments are handled by Lemon Squeezy, acting as merchant of record. It is the legal seller and collects applicable tax. Your card details go directly to Lemon Squeezy and never reach Conberate. Conberate receives your email address, billing country, purchase, and purchase date.

Lifetime access can be purchased before an account exists. That checkout carries no account id or email ownership hint; Lemon Squeezy issues a license key, and Conberate validates it when you redeem it into one verified account. The raw key is neither logged nor stored. Billing email may differ from account email.

Monthly and yearly checkout requires a verified account. Conberate sends an immutable account identifier — not an email ownership fallback — so subscription events stay attached to that account.

A one-time purchase can be fully refunded within 14 calendar days, with no reason required. A full refund or chargeback ends the access that purchase granted; a partial refund does not automatically do that. Lemon Squeezy handles refund requests as merchant of record.

Your rights

You can ask to access, correct, export, or erase the information held about you. Deleting the account removes synced content and pseudonymizes the minimum financial ledger retained for the approved legal schedule. A keyed, non-reversible trial marker remains while the trial program exists so deleting and recreating an identity cannot create repeated trials.

Changes to this policy

If this policy changes in a way that matters, it'll be noted in the app and the date above updated. What is collected will not be quietly widened.