Privacy Policy

The short version

We don't sell, share, or exploit your data. Your information exists solely to make the app work for you. That's it.

1. Data accessed via Google sign-in

ControlledChaos uses Google OAuth (via Clerk, our authentication provider) to let you sign in with your Google account. When you choose this sign-in method, we access the following Google account data:

• Email address — used to identify your account and send optional digest emails.
• Name — used to personalize the app interface.
• Profile picture — used as your avatar in the app.

We do not access your Google Calendar, Gmail, Google Drive, contacts, or any other Google service. Our Google OAuth scope is limited to basic profile information only (openid, email, profile).

2. How we use your data

Everything we access is used exclusively to operate the app on your behalf:

• Authenticate and identify your account — so you can sign in securely and your data stays yours.
• Personalize your dashboard — your name and avatar appear in the app interface.
• Send optional email digests — morning and evening summaries of your tasks, if you enable them. You can turn these off at any time in Settings.
• Power AI features (brain dump, task recommendations) — the content you type or speak is sent to Anthropic's Claude API to parse tasks and suggest priorities. Your Google account data is never included in these AI requests.

We do not use your data for advertising, behavioral tracking, or any purpose beyond operating ControlledChaos for you.

3. Data sharing

We do not sell, rent, or share your personal data with third parties for their own purposes. Full stop.

The only data transfers that occur are to infrastructure providers that process data strictly on our behalf to operate the service:

• Clerk — handles authentication, including Google OAuth. They manage your login session securely.
• Anthropic (Claude) — receives the content of your brain dumps and task context to generate AI responses. Your name, email, and Google profile are never sent.
• Groq (Whisper) — receives audio recordings for voice brain dumps. Audio is transcribed and immediately discarded — not retained.
• Cloudflare R2 — temporarily stores voice recordings during transcription. Files are deleted after processing.
• Neon — hosts our PostgreSQL database where your tasks, goals, and settings are stored.
• Resend — delivers email digests if you have them enabled.

Each provider receives only the minimum data necessary to perform their specific function. None of them receive your full profile or activity history.

4. Data storage & protection

Your data is stored in a hosted PostgreSQL database (Neon) with SSL-encrypted connections. Authentication is managed by Clerk, which uses industry-standard security practices including encrypted token storage and secure session management.

Data stored server-side includes: your tasks, brain dumps, goals, calendar events, and app preferences. This data is only accessible to your authenticated account.

ControlledChaos never asks for, tracks, or stores where you are. The only places it keeps are the ones attached to your calendar events (like “Room 204”), which you type in or Canvas sends.

5. Data retention & deletion

Your data is retained for as long as your account is active. We do not delete your tasks, goals, or history automatically — that would defeat the purpose of the app.

You can request complete deletion of your account and all associated data at any time. To do so, email us at nae@adhdesigns.dev with the subject line “Delete my account.” We will wipe your data within 30 days. There are no hidden backups — when it's gone, it's gone.

Voice recordings are deleted immediately after transcription. Session tokens expire according to Clerk's standard session lifecycle.

AI processing

When you submit a brain dump or request a task recommendation, your input is sent to Anthropic's Claude API for processing. This is handled according to Anthropic's privacy policy. Your data is not used to train AI models.

Voice brain dumps are transcribed using Groq's Whisper API. Audio is processed for transcription only and is not retained by Groq after processing.

What we don't do

• We don't sell your data. Ever.
• We don't share your data with advertisers.
• We don't use your data to train AI models.
• We don't track you across the web.
• We don't show you ads.
• We don't access your Google Calendar, Gmail, or any Google service beyond basic sign-in.

Cookies

We use only essential cookies required for authentication and session management (set by Clerk). No tracking cookies, no analytics cookies, no third-party advertising cookies.

Changes to this policy

If we change this policy in a meaningful way, we'll notify you through the app. We'll never quietly reduce your privacy protections.

Contact

Questions or concerns about this policy? Reach out at nae@adhdesigns.dev