Privacy policy

Your phone's identity

The app makes a random secret and keeps it in your iPhone's Keychain. The server stores its hash, creation and last-contact times, and a push token if your phone registers for notifications. Your phone record also holds your plan and when paid access ends. A hash is a one-way check value; these records are not anonymous just because they use hashes or random identifiers.

Purchases

Apple bills Clive Pro. The app sends Apple's signed transaction to our server for verification. Your phone record holds the subscription's original transaction identifier, plan and expiry. One Apple purchase identifier can link up to 10 phone records. Apple supplies signed entitlement information separately for family members; we use the identifier in that signed information rather than collecting a family roster. A separate subscription-state record keeps that purchase identifier, expiry, refund state and signing time. It survives app-data deletion to prevent refunded purchases being reused; it has no app user identifier. We do not collect card details.

Alarms and reminders

We store the words, date, time, time zone, repeat, sound and timer length where applicable, who requested it, upcoming times and status. We also store reports from the phone about setting, failing or removing alarms, including error text and report times. Personal details you put in an alarm's words become part of that record.

Connected assistants

We store an assistant's registration name and return addresses, which phone allowed it, its connection site, permission state, daily limit and approval or removal times. Pairing codes, authorization codes, and access and refresh tokens are stored as hashes, with expiry and use or revocation state. Authorization records also hold the assistant's return address and sign-in check value.

Notifications and requests

Notification records contain the alarm identifier, notification kind, Apple's message identifier and response, and send time. Request logs record method, path without the query string, status and duration. Recent request counts per IP address are held in memory to limit abuse.

Deletion and departure records

A deletion receipt keeps two hashes: the deletion operation token and the original phone secret, plus a creation time for expiry. It contains no alarm words or user identifier. Leaving the in-app queue or deleting app data also leaves a hash of the old phone secret and its creation time. This blocks delayed registration requests: for 7 days after leaving the queue, and for one year after deleting app data. The departure record contains no email, alarm words or queue position.

If you choose to hear when Clive opens, we store your email address, campaign code, request and confirmation times, and whether you left. This does not create an app account or reserve a place. We use it for confirmation and the opening email you requested.

Resend receives your address and email content to deliver these messages. The delivery queue holds encrypted link data, retry information and delivery state. Opening a confirmation or leave link alone changes nothing; press the button on the page. Leaving stops opening mail. A new request needs a fresh mailbox confirmation before opening mail is allowed again.

The interest list is separate from app data. Deleting app data does not remove your email entry. Use the email's leave link to stop mail, or contact us to request deletion of your address and related mail records. Do not email your phone secret.

There is currently no limit on how many people can use Clive. If access is limited later, an in-app waiting request uses a hash of a phone secret, a queue order and the time the app last checked in, without email or alarms. You cannot start a new subscription while waiting. Choose Leave the waiting list in the app to give up that place. If the reply is lost, the app keeps your saved identity; tap Retry leaving to retry the same leave request, including after restart. If admission finishes first, leaving does not delete the admitted account.

A departure hash from leaving the queue stays for 7 days to stop old requests putting you back. Joining again in the app requires an explicit new request with a fresh secret; it does not restore the old place. After the hash expires, the server can no longer recognize that old credential as departed. A waiting request is deleted if the app has not checked in for 3 days; opening the app again asks for a new place at the back of the line.

Before first use, a separate screen asks for your express agreement to collect the app information described here and store and process it in the United States for the requested service. This happens before Clive sends app data. Declining leaves the app disconnected; you can read the notices and reconsider later. The consent record is saved on this phone with the notice version, time and language; reading this policy alone does not give consent. To withdraw and remove active app data, use the deletion controls described below, or contact our privacy contact. This does not cancel an Apple subscription or erase processing already lawfully completed.

The app keeps its connection secret in Keychain, preferences, alarm and reminder records, local history and pending recovery progress. iOS schedules the alarms and reminders. Local history is trimmed to 30 days when its file is updated.

Speech is transcribed on the phone. The app processes microphone audio in memory rather than saving or uploading recordings; you can type instead. The alarm you pin, including its words and timing, goes to our server. On supported phones, Apple's on-device model may tidy the words.

Siri and Shortcuts requests to set alarms or reminders in Clive are handled by Apple under Apple's privacy terms.

The alarm app uses a random phone identity rather than asking for your name, email address or phone number. The optional email interest list is separate. We receive the requests sent to Clive's tools, not your whole assistant conversation. We do not sell data.

• Fly.io runs our server.
• Supabase hosts our database.
• Resend delivers optional interest-list emails.
• Apple processes payments and delivers push notifications. Sync nudges and arming notices contain no alarm words. If Clive cannot confirm an alarm was set, a fallback notification sends its words as the title through Apple, with an alarm identifier. It may appear on your lock screen.

Fly.io, Supabase and Resend act as our service providers. Their data processing terms allow them to use this data only to provide their services to us, on our instructions, and require them to keep it confidential and secure, giving it the same protection this policy describes.

Your assistant provider handles your conversations under its own policy. Apple and the other service providers also have their own operational records and policies.

Tortoise Software LLC, Missouri, United States, is responsible for this processing. Our privacy contact is responsible for privacy enquiries and complaints, including our Chief Privacy Officer, Brazilian encarregado, Quebec privacy officer and grievance-contact duties: privacy@bytortoise.com.

You may ask what personal data we hold, obtain a copy, correct it, or ask for deletion. Where applicable law provides them, you may also ask for portability or restricted processing, object to processing, withdraw consent for future processing, and challenge our response. Withdrawing consent does not undo processing already lawfully done. You may complain to the privacy regulator or seek another remedy available where you live.

Tell us which request you want to make. We verify control of the relevant record using the least information needed; we do not ask for your phone secret by email. If we cannot identify or safely verify a record, we explain the problem and the next step. We explain any lawful refusal or retention exception. We do not charge for a request unless the law permits it.

Providing app data is voluntary, but without a phone identity and the alarm's details we cannot provide remote alarms; without a signed purchase we cannot verify Pro. You can decline optional mail or microphone access and type instead. Assistant requests supply alarm information on your behalf. Please do not enter health, religion, financial, identity-document or other sensitive details, or another person's private information, in alarm words.

We use phone, alarm and connection information to perform the service you request; purchase information to verify paid access; and limited security records to prevent abuse and protect the service. Where these legal bases apply, these are performance of our contract, our legitimate interests in security (balanced against your rights), and compliance with legal duties. Optional interest-list mail relies on your separate, confirmed request. Where local law requires express consent for collection or overseas processing, that consent must be obtained before the relevant processing. The first-use screen collects the app-processing choice separately; optional interest-list mail still needs its own confirmation.

We do not make decisions with legal or similarly significant effects about you solely by automated profiling. We do not track you across third-party websites or services and do not change that practice in response to a browser's Do Not Track setting.

Our application server and database are in the United States. Requests are transmitted over encrypted connections. Access to stored data is limited by service credentials and database permissions. The United States has sector-specific and state privacy laws, rather than a single general federal privacy law; its protections may differ from those in your country.

Fly.io and Supabase

Receive the app records described above over the network when you register, set or sync alarms, connect an assistant, buy or restore Pro, or delete app data. They run the US server and database. Active records follow the retention and deletion rules below. Supabase keeps daily database backups for 7 days, and Fly.io keeps server logs for 7 days.

Resend

Receives your email address and message content over the network when we send requested interest-list confirmation or opening mail. It delivers that mail. Clive's mail records follow the rules below.

Apple

Handles purchases under its own terms and receives push tokens, notification payloads and delivery requests when we send a notification. A fallback can include alarm words. Apple also handles device speech, Siri and Shortcuts as described above. Apple's operational retention and processing locations are governed by Apple's own terms and policies; our app-data deletion does not erase Apple's records.

You can refuse remote processing by not registering or sending alarm details, stop requested mail with the leave link, and request deletion as described below. Refusal or withdrawal can prevent the corresponding feature from working. We assess privacy incidents and notify affected people and the relevant authority when required, within the applicable legal period.

The purposes, information, recipients, retention periods, request procedure and US processing described above apply to each market below. Local rights apply alongside this policy. These supplements do not mean every listed storefront is open.

Switzerland, Armenia, Georgia, Kosovo, Ukraine, Kyrgyzstan and Tajikistan

You may request access, correction and deletion and object where your local law provides that right. Complaints may be taken to the Swiss FDPIC, Armenia's Personal Data Protection Agency, Georgia's competent supervisory body, Kosovo's Information and Privacy Agency, Ukraine's Parliament Commissioner for Human Rights or your other competent local authority. Any required explicit US-transfer consent is separate from reading this policy.

Canada, Bermuda, Barbados and Cayman Islands

You may seek access, correction and a review of how we handle your information. You can contact Canada's federal or applicable provincial privacy commissioner, Bermuda's Privacy Commissioner, Barbados's Data Protection Commissioner or the Cayman Islands Ombudsman. Quebec users may withdraw consent and ask about decisions and disclosures affecting their information.

Spanish-speaking markets

Brazil

Under the LGPD you may request confirmation of processing, access, correction, information about sharing, portability where regulated, anonymisation, blocking or deletion of unnecessary or unlawful data, consent withdrawal, information about refusing consent, and review of automated decisions where applicable. You may petition ANPD. Contract performance supports requested alarms and purchase checks; consent supports requested mail; legitimate interests support proportionate security. Direct collection in the US is distinguished from later disclosures to processors. Our privacy contact acts as encarregado, at privacy@bytortoise.com.

Japan and Mexico

These storefronts are not included at launch. We will complete the applicable notices and local requirements before offering Clive there.

South Korea

The collection items, purposes and retention rules are listed above. You may request access, correction, deletion or suspension and complain to the Personal Information Protection Commission. The recipient-by-recipient US-processing description above identifies the information, purpose and network timing; refusal can prevent the corresponding feature. The service is not directed to children under 14; processing that requires a legal guardian's consent must not start without it. Chief Privacy Officer: our privacy contact, privacy@bytortoise.com.

Taiwan, Macao and Mongolia

Providing information is voluntary. Without the required information the service cannot operate. Taiwan users may request access, copies, correction, cessation of collection, processing or use, and deletion. Macao users may seek access and correction and contact DSPDP where applicable. Mongolia requires express digital or written permission before applicable processing and overseas transfer; reading or using this policy is not that permission. Do not enter sensitive data in alarm words.

India and Sri Lanka

You may contact us with privacy grievances and requests for access, correction, erasure or withdrawal under applicable law. In India, applicable SPDI grievances must be addressed within one month of receipt. The DPDP Act and Rules have staged commencement; this policy does not claim that every DPDP right or duty is already in force. Sri Lanka's applicable rights and controller duties also depend on commencement provisions. Grievance contact: our privacy contact, privacy@bytortoise.com.

Singapore, Thailand, Philippines and Brunei

You may seek access and correction, and deletion, portability, objection, restriction or consent withdrawal where local law provides them. You may complain to Singapore's PDPC, Thailand's PDPC, the Philippine NPC or Brunei's competent privacy authority. We assess incidents and give legally required notices: Singapore and Brunei requirements can run from the assessment; Thailand and Philippine rules can require notice within 72 hours. Any lawful exception is assessed under the applicable rule.

New Zealand

Your own assistant can supply alarm information on your behalf. You may request access and correction; we respond within 20 working days, subject to lawful extensions. You may complain to New Zealand's Privacy Commissioner. We notify notifiable serious-harm breaches as soon as practicable.

Gulf and Middle East

For the United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Oman, Jordan, Lebanon and Israel, you may contact us for access, correction, deletion, objection and consent withdrawal as provided by local law. Information is processed in the United States by the recipients described above. Do not enter health, religion or other sensitive information, or children's private information. Where consent is required, it must be obtained before processing or overseas disclosure. Israel users may ask to inspect and correct information and contact the Privacy Protection Authority.

Kenya, Nigeria, Malawi, Seychelles, The Gambia and the Congos

You may seek access, correction, deletion, objection or withdrawal where local law provides those rights. You can complain to Kenya's ODPC, Nigeria's NDPC, Malawi's competent data protection authority, Seychelles' Information Commission, The Gambia's competent authority, or the competent authority in your Congo jurisdiction when operational. US processing requires the local lawful transfer route; security measures alone do not prove every transfer lawful.

The server's regular cleanup removes canceled alarms after 30 days, or finished alarms 30 days after their last update, with linked delivery records. It removes notification logs after 30 days, pairing and authorization codes and tokens seven days after expiry, and the phone record with its linked app data after 180 days without contact. Unpaired assistant registrations are deleted after about an hour.

The daily cleanup deletes purchase records and linked purchase identifiers 3 years after the subscription ends. A later renewal extends that period. These are verified Apple subscription-state records, not a separate record of your subscription consent; Apple holds that consent.

We retain deletion receipts, and the departure hashes left by deleting app data, for 1 year from creation, then delete them in the daily cleanup. A retry does not extend that year. Departure hashes left by leaving the in-app queue are deleted after 7 days. Waiting requests are deleted 3 days after the app last checked in. For about its first 24 hours, a new account also has a tracking record (its account ID and admission time). The record is then deleted, and if the app does not connect to Clive within those 24 hours, the account is deleted with its records. After expiry, a receipt cannot confirm an old deletion, and the server can no longer block an old registration using its departure hash. The app does not treat a missing receipt as proof of deletion. Hashes created before this expiry mechanism was added are conservatively retained for one year from that update because their original creation times were not recorded.

The daily cleanup deletes each confirmed-interest entry 90 days after the opening email was successfully sent to it, with linked mail records and leave-link hashes. Preparing an opening campaign or an unsuccessful send does not start the 90 days. Any remaining confirmed entries, including late confirmations, failed deliveries and re-confirmations, are deleted 90 days after the opening campaign finishes. The campaign finishes when the daily cleanup first confirms that all its deliveries are sent, failed, canceled or expired. A paused campaign with deliverable mail still pending is unfinished. Re-confirming does not restart this campaign-wide clock.

Cleanup of unconfirmed and withdrawn interest is an operator action. Unconfirmed entries become eligible after their confirmation links expire; withdrawn entries become eligible after 30 days unless a fresh confirmation is pending. Never-attempted confirmation mail can remain queued without expiry. Fly.io keeps server request logs for 7 days, and Supabase keeps daily database backups for 7 days. App deletion does not reach backups; deleted records leave them when those backups expire.

Clive > Settings > Hold to delete. This deletes your active phone record, alarms and reminders, paired assistants, pairing and authorization records, push token, delivery reports and notification records from the active database. It cannot be undone. An assistant's separate registration is removed by regular cleanup once no phone remains paired with it.

Before asking the server to delete, the app saves the operation token and original phone credential in its Keychain recovery journal. If the reply is lost or confirmation was not saved, it checks the retained receipt using those saved values. A matching receipt confirms deletion; otherwise the app may retry only the original request. An error or missing receipt alone is never treated as proof of deletion.

After saving server confirmation, Clive cancels its alarms and reminders on this iPhone, checks none remain scheduled, and clears local alarm records, history, older app files and the saved connection. It reports completion only after cleanup succeeds. Failed cleanup keeps progress for Retry cleanup, including after restart. An older unfinished deletion without a receipt token cannot be confirmed this way; the app stays paused and asks you to contact support.

Subscription-state records, deletion receipt hashes and departure hashes remain. Deletion does not reach database backups, which expire after 7 days, your separately held interest-list entry or conversations with an assistant provider. These retained security records do not restore deleted alarms.

Deleting app data does not cancel Clive Pro. Use iPhone Settings > your name > Subscriptions to manage or cancel it. You can also open Clive > Settings > Plan while subscribed to open Apple's subscription sheet. Restoring a purchase does not restore deleted alarms.

Uninstalling alone does not immediately delete the active server record. Reinstalling on the same phone may reuse its Keychain identity. For deletion help, contact privacy@bytortoise.com. Because we do not collect your name or email in the alarm app, an email alone may not identify the record. Do not send your phone secret.

Clive is not directed to children under 13. If a child under 13 has used it, contact privacy@bytortoise.com so we can help delete their data.