Privacy policy

This policy covers the Two Tails app for iPhone and iPad, its sync server, and this website. In short: we store what your household puts into the app so it can sync, everyone in your household can see it, we do not track you or show ads, and you can delete your account in the app.

This policy and our core health data protections apply to everyone who uses Two Tails, wherever they live. The first App Store release is planned for the United States only. Availability does not limit these protections. Read our consumer health data privacy policy and the health data rights and state notices below.

Who we are

Two Tails is made and run by Gregory Lum, an individual developer in the State of Washington, USA. "We" and "us" in this policy mean him. He decides how your data is used and is responsible for it (the "controller" in privacy law). Contact: greg@greglum.com.

What we store

Your account

• A random account id. It is not your name or email address.
• If you sign in with email: your email address. Your password is checked by Amazon Cognito; we never see it.
• If you sign in with Apple or Google: the account identifier that Apple or Google gives the app. Google sign-in asks Google only for the openid and email scopes. Google's sign-in token includes your email address; our server checks that Google has verified it and does not keep it. The app does not ask Apple for your name or email.
• If you sign in with Apple: a token from Apple that we keep only so we can revoke the app's access to your Apple ID when you delete your account.
• Sign-in tokens for your session, kept in your device's Keychain.

Your household

• The household's name, its members' account ids, when each joined or left, and invite codes. Invite codes expire after 7 days.
• The first name and avatar color each member chooses, which the rest of the household sees. They are removed when that member leaves, is removed, or deletes their account. Profile photos are not uploaded: avatars are initials on a color.
• Checklists and items: names, titles, notes, links, due dates, repeat schedules, and when items were completed or skipped.
• Store sections: whether a list is a shopping list, and the section your household chose for an item name when someone moved it (for example, foil in Baking). A choice is deleted when no item on a shopping list uses that name any more.
• Fitness: exercise names, and the workouts and sets you log (who logged the workout, start and end times, notes, reps, weight, duration, distance).
• For a class you mark attended from Google Calendar: a workout with the event's start and end times, its title (in the workout notes), and its Google event id. See Google Calendar.
• Apple Health data, only if you connect it. See Apple Health.
• Oura health data and profile, only if you connect it. See Oura.
• A history of changes, so every device in the household can catch up. It never holds Apple Health values: it points to the current record instead.

Notifications

• Your daily summary and the item alerts you turn on are scheduled on your phone. Our server does not know your summary time, your time zone, or which items alert you.
• When you are signed in, your phone sends us its push token, a code from Apple that lets us send notifications to that phone, linked to your account id. We keep it until you sign out, delete your account, or don't open the app for 7 days. Signing out removes it, and the app keeps trying if your phone is offline at the time.
• When you remind another member about an item, we keep your account id, the item's id, and when you sent it, for 1 day. That record is how the undo works and how repeated taps are held back.

What a notification shows on a locked phone: a reminder from your household says only "A household member reminded you about an item in Lists". It never includes the item's name, so the name does not pass through Apple's notification service. The daily summary shows only how many tasks are due and overdue. An item alert does not name the item unless you turn on Show item names in the app's notification settings. Notification permission is optional and the app works without it.

On your device

The app keeps a full copy of your household's lists and workouts on your phone so it works offline. It also keeps your settings there: your weight unit, first name, avatar color, and appearance, whether Voice capture (beta) is on, which item titles were already offered a repeat, your notification choices and the push token it last registered, whether Apple Health sharing is on and when it last imported, and, while an email sign-up waits for its code, the email address you typed. The repeat-offer history is removed when you sign out, leave, delete your account, or lose household access. If you connect Google Calendar, it also keeps a copy of the chosen calendar's events and your Google tokens on that device.

Voice capture, Siri, and Shortcuts

Voice capture uses the microphone only while you record. Apple's speech recognition turns your speech into text on your phone. No audio is kept. Speech recognition sends no audio or transcript to us or to Apple. If you then choose Draft with AI, the text you choose is sent to Amazon Bedrock as described under AI drafts. iOS may first download Apple's speech model for your language. Voice capture is a beta and is off by default. After Stop, you review the text in a draft. It becomes an item only when you tap Save, then syncs like any other item.

Siri and Shortcuts actions run in the app on your phone and change your data the same way the app does. Apple handles what you say to Siri under its own privacy policy; we receive only the item, list, workout, or reminder the action creates or changes. These actions ask you to unlock your phone first, so a locked phone never reads out your lists.

What we do not collect

No audio recordings, last name, location, contacts, photos, advertising identifier, browsing history, usage analytics, or crash reports. From Apple Health, nothing beyond the four types listed under Apple Health.

Who can see your data

Everything in a household is shared with every member of that household. The app shows this before you join:

Everyone in this household can see all fitness and health data that any member brings into Two Tails.

That includes the workouts and sets you log. There are no private records inside a household. Only invite people you are comfortable sharing this with.

People outside your household cannot see your data. Our server checks membership on every request and refuses anyone who is not a member.

If you leave a household or another member removes you, your access ends at once and the app deletes that household's data from your phone. The lists and items you added stay with the household; we do not store who wrote them. Workouts you logged stay too. The Apple Health data you brought in does not: when you leave or are removed, our server removes your imported workouts, heart rate, active energy and step totals from the household, by the same rules as Stop sharing Apple Health, and other members' phones remove them as they sync. Other members see them labeled "Member" and a short code from your account id, not your name.

Apple Health

Connecting Apple Health is optional. Each member connects on their own iPhone, after the app explains that the whole household will see the data. Two Tails asks Apple Health for read access to exactly four types:

• Workouts: the activity type, start and end times, and the app or device that recorded each one.
• Steps: your daily step total for the last 7 days, as Apple Health adds it up.
• Active energy: the energy each workout burned.
• Heart rate: each workout's average heart rate.

The app reads workouts from the 30 days before you connect, then new ones. Two Tails never writes anything to Apple Health.

What it reads syncs to our server, and every member of your household can see it, including people who join later. Apple Health data is used only to show it to your household. We never use it for advertising or marketing, never sell it, and never share it with anyone outside your household. It is not stored in iCloud Drive or CloudKit.

To stop, tap "Stop sharing Apple Health" in the Fitness tab. Two Tails stops reading and removes the workouts and step totals it imported from your household, on our server and on every member's device as they sync. Workouts you logged by hand stay, along with any imported workout you added sets or notes to, which then counts as one you logged. Nothing in Apple Health changes. Stopping on one device does not stop your other devices; stop on each. To take away the app's access itself, open Settings, then Health, then Data Access & Devices. Deleted values can stay in database backups for up to 35 days (see How long we keep data).

Google Calendar

Connecting Google Calendar is optional. Each member connects their own Google account on their own device and picks one calendar. Two Tails then asks Google for two permissions:

• calendar.calendarlist.readonly, to list your calendars so you can pick one.
• calendar.events, to show, create, and edit events. Two Tails does not delete calendar events. The app only uses it on the one calendar you picked.

The app talks to Google directly from your device. Your Google tokens stay in that device's Keychain, set to stay on that device only, and the events are cached on that device. Our server never receives your Google tokens or calendar events. When you tap Suggest times and consent to cloud AI, the app computes free time windows on your phone and sends only their start and end times to our server and Amazon Bedrock. Event titles and details are not sent for suggested times. Free windows can reveal when time is available.

A separate use: when you mark a class attended, the app saves it as a workout. That workout holds the event's start and end times, its title, and its Google event id, and like every workout it syncs to our server and every member of your household can see it.

To stop, tap Disconnect in the app's Calendar tab, which revokes the app's access and deletes the tokens and cached events from the device, or remove Two Tails from your Google Account's third-party access settings. Deleting your Two Tails account removes your class workouts from our server and also disconnects Google Calendar on this device, revoking its grant and removing its tokens and cached events.

Two Tails' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This includes free time windows derived from Google Calendar: they are transferred only with your consent to provide the visible Suggest times feature, never for advertising or model training. No person reads those windows except when needed for security or to comply with the law.

Oura

Oura is in development. Connecting is optional. The app first asks you to agree that every current and future household member can see your imported health data and profile. Oura then asks permission on its own page.

The snapshot covers up to 30 days of readiness, sleep and activity scores; main-sleep average heart rate variability; temperature deviation; average blood oxygen; and stress/recovery time, where available. From Oura's profile response we retain only age and biological sex. Email, height, weight and other profile fields are discarded, never stored or shown. Oura workouts and step totals are not stored or shown.

Snapshots are encrypted on our server for household display. The app refreshes when opened or manually, without background imports. Device copies stay in memory. Access and refresh tokens are encrypted on the server, hidden from household members.

Disconnect Oura in Fitness hides and removes your snapshots from the active database before revoking access. If Oura is unavailable, the app reports that cleanup needs another try; cancelled tokens remain only for retry. Account deletion also removes your snapshots across households and revokes access. Other devices discard displayed values when they next reload; screenshots or copies cannot be recalled.

Leaving a household stops new imports. Its remaining members keep the shared snapshot until expiry, disconnect or account deletion. Rejoining requires fresh sharing consent. Closing the household deletes its snapshots. Daily values expire 30 days after their source date; profiles 30 days after import. Expired rows are hidden; automatic database deletion may take longer. Oura snapshots have no point-in-time backups. Token backups can remain for 35 days.

Revoking access directly in Oura is detected on a later refresh, not immediately. Once detected, Two Tails hides and removes the snapshot and asks you to reconnect. Unfinished authorization expires after 10 minutes. Oura data is used only for household display, never advertising, marketing, sale or AI training.

AI drafts and answers

Cloud AI is optional and off until you agree to the in-app consent sheet. You can turn it off under Account, Household, AI drafts. Each feature sends its input to our server and then to an Anthropic Claude model on Amazon Bedrock, operated by Amazon Web Services (AWS) in the United States.

• Note drafts and quick add: the text you choose. A note draft adds your optional translation language; quick add adds today's date and your time zone.
• Ask: your question and up to 20 matching list items, including items other household members added, with their titles, list names, and due or done dates.
• Today's summary: when Apple Intelligence is unavailable on your phone, today's due items are sent when you open Today, once per phone, household, and day, and again only when you tap Refresh summary (at most three refreshes).
• Meal plans: your request and the names of open items on that grocery list. Those names may include medicine you added.
• Prep lists: the event title, first and last day, today's date, and your optional note. The server refuses titles with common health care words; this word list is not a guarantee.
• Routine drafts: your routine text and today's date.
• Suggest times: only free time windows computed on your phone, as start and end times. Calendar event titles, event details, and the item's title are not sent.

Ask and Today's summary send no notes, calendar events, workouts, classes, Apple Health data, or Oura data. Items or lists whose names include common health or fitness words are left out. This is a word list, so an item named only by a medicine's name could still be sent. Answers cite their source items and are checked by our server and your phone. They change nothing in your lists. Drafts change your lists or calendar only after you review and confirm them.

• Fitness records: no workouts, sets, or Apple Health records are sent to AI. Our server removes those fields from every request before a feature reads it. Imported Oura snapshots are not sent to AI. Text you choose to send can mention health.
• No storage or training: our server does not store or log input text or replies. Amazon Bedrock does not store them, share them with Anthropic, or use them to train models. Enabling AI requires confirming Bedrock's no-retention setting in each processing region.
• What we keep: usage totals for household and person budgets, and per-request token counts, cost, and latency without text for 30 days. An App Attest public key tied to your account verifies the app and expires 90 days after last use.

How we use it, and why we may

Only to run the app: to sign you in, to sync your household's data between devices, to deliver reminders you or your household ask for, to show and edit the calendar you connected, to make the AI drafts you ask for, and to keep the service secure and working. We do not use it for advertising, profiling, or training AI models, and we do not sell it or share it with anyone for their own use. This applies with extra force to Apple Health data: see Apple Health.

If privacy law where you live asks for a legal basis: we use your account and household data because we need it to provide the app you asked for; we use Apple Health, Oura, Google Calendar, and notifications only with your permission, which you can withdraw at any time as described above; and we keep error logs because we have a legitimate interest in keeping the service running.

If we ever want to use your data for a new purpose, or collect a new kind of health data, we will ask you in the app first.

No tracking, no ads, no sale

The app contains no ads, analytics, or third-party tracking code, and does not track you across other apps or websites. We do not sell personal data or share it for targeted advertising. This website sets no cookies, loads nothing from other sites, and keeps no visitor logs.

Companies that process data for us

These companies handle data only to provide their service to Two Tails, under their own data processing terms. We share nothing with any other company.

We may disclose data if the law requires it, for example under a valid court order. We will tell you first unless the law forbids it.

Where your data is stored

Our server and database run on AWS in the United States. If you use Two Tails from another country, your data is sent to and stored in the United States, where privacy law may differ from yours. AWS's data processing terms include the European Commission's standard contractual clauses for such transfers.

Deleting your account

You can delete your account in the app at any time. Deletion is complete and cannot be undone. When you delete your account we:

1. Revoke your Oura connection, if present, and remove its stored tokens and all imported Oura snapshots.
2. Revoke the app's access to your Apple ID, if you signed in with Apple.
3. Delete your workouts, sets, and imported Apple Health data from every household you are in or were in, and remove you from those households.
4. Delete your sign-in records and your Amazon Cognito account, including your email address.
5. Delete the push tokens of your phones.

Deletion also removes your App Attest keys and daily AI usage totals; your household's monthly total stays with the household.

Shared checklists and items you added stay with the household, because they belong to everyone in it. We do not store who wrote them. If you signed in with Google, the app disconnects Google sign-in on your device; our server holds no Google token to revoke. Google Calendar is separate: see Google Calendar. A session that was already open can last up to 15 minutes, but it can no longer reach any household data.

When the last member leaves a household, the household and all its records are deleted.

If you can't use the app, email us and we will delete the account for you (see Your rights).

How long we keep data

• Account and household data: while your account exists, or until you delete it as above.
• Database backups, except Oura snapshots: deleted data can stay in point-in-time backups for up to 35 days, then it is gone.
• Server error logs: kept for 30 days. They may record that a request failed.
• Records used to stop duplicate uploads: 30 days.
• Deleted lists, items and workouts: their content is kept for 30 days after you delete them, so you can undo, then removed; only an id and the deletion date stay so every device agrees it is deleted.
• Invite codes: the account id of the member who made one is removed when it is used, when they leave, or when it expires; the code is deleted a day after it expires.
• Push tokens: until you sign out or delete your account, and at most 7 days after you last opened the app.
• Reminders you send to a household member: 1 day.
• After you delete your account: a marker with your random account id and the times the account was deleted, so that sign-in tokens issued before the deletion are refused. It holds no name, email, or content, and is kept for 90 days after deletion, then removed.
• AI draft usage totals: a month after the month ends for households, 3 days for each person's daily total. Per-request token and cost logs: 30 days. App Attest device keys: 90 days after last use. The text you send for a draft: not kept.

Your rights

Wherever you live, you can:

• See your data: it is in the app, and Export my data in the app's Account screen saves the household data on this device as a JSON file, including other members' lists, workouts, and health records, and your settings. The calendar cache, sign-in tokens and Oura snapshots are not included. Request your server-held Oura profile and daily snapshots by email. To get a copy of everything our server holds about you, email us.
• Correct it: edit or delete lists, items, workouts, and sets in the app. For anything you can't change there, email us.
• Delete it: delete your account in the app, or email us.
• Withdraw permission: stop sharing Apple Health, disconnect Oura, disconnect Google Calendar, or turn off notifications, as described above.
• Object: email us if you want us to stop a particular use of your data.

Email greg@greglum.com from the address on your account, or tell us how you signed in, so we can confirm the account is yours. We answer within 45 days and do not charge. If we say no, we explain why, and you can ask us to look again by replying with "Appeal" in the subject. We answer appeals in writing within 45 days, with our reasons. You can also complain to your local data protection or consumer protection authority.

Health data protections for everyone

Our health data protections cover every user, regardless of residence, citizenship, or where they use the app. They cover Apple Health and Oura imports, workouts you log, and classes you save as workouts. Health information you put in lists, notes, or AI inputs is also personal data covered by this policy; see AI drafts for what those features send.

Health connections are optional. We explain household sharing before you join and before you connect Apple Health or Oura. Every household member, including people who join later, can see the health records shared with that household. We do not sell health data or use it for advertising, marketing, profiling, or model training.

Every user can ask us to confirm whether we hold their health data, get a copy and a list of recipients, correct it, withdraw consent to collection and sharing, or request deletion. Use the controls described under Apple Health, Oura, Google Calendar, and Deleting your account, or email us using Your rights. Disconnecting a source does not always delete records already saved; the connected-service sections explain what stays. These choices do not take away any additional rights local law gives you.

State health data notices

Washington

If you live in Washington or your consumer health data is collected there, our separate consumer health data privacy policy describes the data, sources, purposes, recipients, and rights under Washington's My Health My Data Act. Its link also appears on our homepage.

Nevada

If you live in Nevada or your consumer health data is collected there, this policy also provides the notice under Nevada's consumer health data law (NRS 603A.400–603A.550). The data we store, Apple Health, Oura, Google Calendar, and AI drafts sections describe the categories, sources, and processing. The household sharing and processors sections name the recipients and purposes. We have no affiliates and allow no third-party tracking of health data across websites or services.

You can ask us to confirm collection, sharing, or sale; identify the third parties who received your health data; stop collection and sharing; or delete your health data. We do not sell it. Review and correct data in the app, or email us for anything you cannot change there. Use the request and appeal process under Your rights. For a verified Nevada health data deletion request, we delete the requested data from our active systems and notify recipients within 30 days; database backups expire within 35 days of deletion. If we deny an appeal, we provide contact information for the Nevada Attorney General. See Changes to this policy for how we announce changes; the effective date is the date at the top of this page.

Connecticut

Connecticut residents can use the access, correction, deletion, copy, consent withdrawal, and appeal process under Your rights. We do not sell personal data, use it for targeted advertising, or profile people for decisions with legal or similarly significant effects. If we deny an appeal, you can complain to the Connecticut Attorney General. Other states may give you additional rights; contact us to exercise them.

Children

Two Tails is a household app for adults and is not directed at children under 13. We do not knowingly collect personal data from a child under 13. If you believe a child under 13 has an account, email us and we will delete it.

Security

All traffic between the app and our server is encrypted with HTTPS. Data is encrypted at rest in AWS. Sign-in tokens are kept in your device's Keychain, set to stay on that device only. No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.

Changes to this policy

If we change this policy, we will update this page and the date at the top before the change takes effect. If a change lets us use data you already gave us in a new way, we will ask you in the app first.

Questions

Email Gregory Lum at greg@greglum.com. See also the support page.