Privacy policy
Your journal is your business. This page explains what Timee stores, what for, and how you stay in control.
DRAFT by Victoria (legal): dashed boxes are placeholders still to fill (legal entity, address, server region, mailbox…). Fill them and remove this notice before publishing.
Summary
- Timee stores only what you type (tasks, calendar, notes, journal, sleep, people) on Supabase.
- We do not sell data, show ads, track behaviour, or collect location/contacts.
- Delete your account and export your data from Settings.
1. Who is responsible for your data
Timee is a personal journal and time-management app (to-dos, calendar, notes, journal, sleep, the "people" around you) operated by DBR Group ([full legal name, registration no., registered address — fill in before publishing]) ("DBR", "we"). For account and service-operation data DBR is the controller and processor. For content you type yourself (journal, notes, other people's names…) you decide what to enter; DBR stores and processes it only to show it back to you.
This policy is prepared under: Law on Personal Data Protection No. 91/2025/QH15 (effective 1 January 2026) and Decree 356/2025/ND-CP implementing it (which replaced Decree 13/2023/ND-CP), and Law on Cybersecurity No. 116/2025/QH15 (effective 1 July 2026).
2. Data we collect
We collect only what Timee needs to work. We do not collect location, contacts, the system calendar or advertising identifiers; we use no behavioural analytics and show no ads.
| Category | Details | Purpose |
|---|---|---|
| Account | Email, password (stored as a hash by the authentication provider; we cannot read it), creation date. | Sign-in, password recovery, email verification. |
| Tasks & calendar | To-dos and sub-tasks, due dates, reminders, recurrence, tags; calendar events; notes. | Show and remind you. |
| Journal & wellbeing | Daily journal, mood, tags, mentioned names (@), attached photos; dream journal; sleep/wake times, duration, sleep quality. | Store the journal and statistics for you. May be sensitive data (see §4). |
| "People" | Name, role, category, free-text note and last-contact date of people you choose to save. | Help you remember relationships. See §5. |
| Photos | Photos you take or pick from your library to attach to the journal (one at a time; compressed before upload). | Show photos in the journal. |
| Notifications | Reminders are local notifications on your device; we send no server push and store no push token. | Reminders. |
A cache copy of your data and appearance settings are stored on your device.
3. Purposes and legal basis
We process data to: (a) create and secure your account; (b) provide the features you choose; (c) sync across devices; (d) send verification/reset emails; (e) keep the service secure and prevent abuse; (f) comply with legal obligations. Our basis is your consent when you create an account and when you grant each device permission (camera, photo library, notifications), and necessity to deliver the service you ask for. We do not sell your data, use it for advertising, or use it to train AI models.
4. Sensitive data
Journal text, mood, dreams and sleep may reflect your private life and health. We process them only to store and show them back to you, and only when you enter them. By entering them you consent to this storage. You can delete them at any time (§9).
5. Data about other people that you enter
"People" and "@mentions" let you record names and notes about others. They do not have accounts and do not know they are recorded. You are responsible for entering only appropriate information, avoiding others' sensitive data (health, religion, politics, finances, identity documents…) and for personal use only. Timee does not use that data to contact, rate, sell or share it with anyone. If you are a person mentioned and want information about you removed, email hello@timee.dbr.business with enough detail for us to locate it.
6. Processors and sharing
We do not sell personal data. We share it only as needed to run the service or on a lawful request from a competent authority:
| Party | Role | Data |
|---|---|---|
| Supabase Inc. | Cloud infrastructure: authentication, database, photo storage; sends verification/reset emails. | All data in §2. |
| Expo / EAS (Expo Inc.) | App build and distribution tooling. | Does not receive your journal content. |
| Apple / Google | App stores and OS-level notification services. | Per their policies. |
Data is protected by per-account access rules (each person can read only their own data), encrypted connections, and photos are served through time-limited links.
7. Storage outside Vietnam
Supabase servers are located outside Vietnam [exact server region — confirm in Supabase dashboard]. Sending data abroad to provide the service is based on your consent and the rules on cross-border transfer of personal data, including a transfer impact assessment dossier under the Law on Personal Data Protection where required. The recipient commits to equivalent security under a data-processing agreement.
8. Retention
We keep data while your account exists. Deleted "People" entries stay in a trash for 30 days and are then permanently deleted (or you can delete them immediately). When you delete your account, data in the primary system is deleted immediately; infrastructure backups, if any, are overwritten on the provider's cycle [Supabase backup cycle — confirm].
9. Your rights and deleting your account
Under the Law on Personal Data Protection you have the right to: be informed; consent or refuse (and withdraw consent); access, view and correct your data; obtain a copy; request deletion; request restriction of processing; object to processing; and complain, report, bring a claim and seek compensation as provided by law.
To exercise these rights, write to hello@timee.dbr.business. We acknowledge your request and handle it within the statutory time limits; we may ask you to verify your identity to prevent impersonation. Withdrawing consent does not affect processing already carried out, but some features may stop working.
- Delete account: Explore tab → Settings → "Delete account" (with a confirmation prompt). All your tasks, calendar, notes, journal, dreams, sleep, people list, tags and photos are permanently deleted and cannot be recovered.
- Export: Explore → Settings → "Export data" (JSON file of text data; photos only as file paths). For copies of photos, email us.
- Cannot use the app: email hello@timee.dbr.business and we will delete on your behalf after verifying you.
10. Security and breach notification
We use encrypted connections (HTTPS), per-account access control, hashed passwords and restricted internal access. No system is perfectly secure; use a strong password and lock your device.
If a personal-data breach occurs that may harm your lawful rights and interests, we will notify the competent data protection authority within 72 hours of discovery, take remedial measures, and notify you where the law requires.
11. Children
Timee is not intended for people under 16. Under Vietnamese law a child is a person under 16 and processing a child's personal data requires the consent of a parent or guardian. If you are a parent/guardian and believe your child has given us data, contact us and we will delete it.
12. EU/EEA/UK users
If you use Timee from the European Economic Area (EEA) or the United Kingdom, the GDPR / UK GDPR may apply alongside Vietnamese law. Our legal bases are then consent (Art. 6(1)(a)) and performance of a contract (Art. 6(1)(b)); for special-category data (e.g. health) it is explicit consent (Art. 9(2)(a)). You additionally have the right to data portability and to lodge a complaint with your local supervisory authority. For transfers outside the EEA we rely on Standard Contractual Clauses (SCCs) or another valid mechanism offered by the recipient.
13. Changes to this policy
We may update this document when the product or the law changes. Material changes will be announced in the app or by email before they apply; the update date is shown at the top. Continuing to use the service after the effective date means you accept the new version, unless the law requires us to obtain your consent again.
14. Contact
DBR Group ([full legal name, registration no., registered address — fill in before publishing]) · Email: hello@timee.dbr.business. You may also complain to Vietnam's competent personal data protection authority (under the Ministry of Public Security).