Privacy
The short version: we want as little of your data as possible, because reminder content is personal by nature and the cheapest way to protect it is not to collect it.
What we intend to collect
- Your account: an email address and a password hash, or, if you sign in with Google, the Google account identifier, name and email Google passes us; an optional display name; your language, time zone and notification preferences.
- Your tasks: the titles, notes, schedules and the tempo and intensity you set, the record of when a reminder fired and how you closed it, voice notes and attached images or PDFs, and, in shared spaces, comments, workspace and project names and the nicknames you give people. This is the product; it cannot work without it.
- Your devices: a push token per device, so reminders can actually reach you, and your Telegram chat id if you choose to link Telegram.
- Your calendar settings: if you turn on calendars, which calendars to show and their reminder rules (see Calendar).
- Feedback you send from the app, your referral code and invitations, and, if you buy a subscription through Google Play, the purchase token, product, state and expiry Play reports to us.
- The waitlist: if you enter your email on the landing page, that address and the date you gave it. It is used for one thing — telling you when Until launches — and for nothing else.
The waitlist
Until is still in development, so the only thing this website collects today is a waitlist address. It is not passed to an email marketing platform, not enriched, not used for ads and not shared. Ask us to remove you and the record is deleted; every message we send will also carry a way out.
What we do not want
- No advertising identifiers and no ad networks.
- No selling or renting your data to anyone, ever, in any form.
- No health records, no diagnoses, no clinical data. until. is a general-purpose reminder tool, not a medical device, and we do not want to hold medical information. What you type in a task title is up to you — we simply store it as text like any other task.
- No contact-list or location access for the current feature set. Calendar and microphone access are optional, asked for only when you use the feature, and explained below.
Voice notes
The app only uses your microphone when you choose to record a voice note on a task: Android asks for the microphone permission when you first press record, and recording stops the instant you stop or cancel it, after sixty seconds at most. A task holds up to three notes. The recording is stored as part of that task in a private Cloudflare R2 bucket in the EU jurisdiction and played back through links that expire after ten minutes. Deleting the task deletes the recording with it, as does deleting your account; reassigning the task to someone else deletes the recording too, since a voice note is addressed to whoever holds the task next.
Voice is also how you capture and command by speaking: the microphone button in the capture bar and in the AI assistant is speech recognition, not recording, and nothing is stored as audio. Speech is turned into text by your phone, on the device where possible. If your phone has no on-device recogniser for your language, Android’s speech service (usually Google’s) does the recognition and receives the audio under its own terms. Until never receives audio, only the resulting text. What you said is shown to you as a draft first and nothing is created until you tap.
Calendar
If you turn on calendars in Settings, Android asks for read-only calendar access. Your events are read on the phone and stay on the phone; they are never uploaded to us. What syncs to your account is only your calendar settings: the account and calendar names, whether each one is shown and its reminder rules, so another of your devices can show the same thing. The app never writes to your calendar.
AI assistant
The assistant is optional and stays off until you switch it on behind its own consent screen; switching it off withdraws that consent. It is powered by Anthropic PBC in the United States. With each message we send Anthropic your message and the recent turns of the conversation, a list of your open tasks (title, emoji, local times, tempo and intensity), your local date, time and UTC offset, and the names of your workspaces and projects. People appear only as the nicknames you gave them or as “Person 1”, “Person 2”. We do not send your own name, email address, task notes, time-zone name or any account identifiers.
Conversations are not written to our database: recent turns are kept in a cache for 15 minutes and unconfirmed drafts for 30 minutes, then expire. We store per-day usage counters (requests, tokens, cost) and a record of each change you confirmed. The assistant only proposes; nothing changes in your account until you confirm it. The one exception to “not written down”: if you report a reply, we keep that reply, the message of yours that led to it, and the reason and note you gave, until you delete your account. Reports are included in your data export.
The assistant works as a command mode, not a chat: you say or type one request and get one result, and the app shows no conversation history. What goes to Anthropic for each request is the text of that request (typed, or the text your phone produced from your speech), plus the context described above, and only if you have switched the assistant on. Audio is never sent to Anthropic or to us. If you use the assistant while it is off, the words are read by a simple parser on the phone and go nowhere.
Requests that are clearly not about tasks and reminders (a recipe, the weather, small talk) are checked on our server first, and where that check catches them they are refused without being sent to Anthropic. The check is deliberately cautious, so some off-topic requests still reach the model, which is instructed to decline them too.
Every assistant card has a “Report reply” action. A report stores the reply, the message of yours that led to it, the reason you chose and any note you wrote, and we keep it until you delete your account; it is part of your data export. Nothing else from an assistant conversation is stored beyond the short-lived cache described above.
Product analytics
Product analytics in the Android app are opt-in and off by default; the switch is in Settings → Help us improve. While it is off, the analytics library is not started and no identifier is created. Switched on, it sends a fixed list of usage events to PostHog, hosted in the EU, under your internal account id — never your email, your name or what your tasks say; there is no screen recording. Turning it off stops sending and resets the identifier. Deleting your account also asks PostHog to delete that data.
Who processes data for us
- netcup (EU): the server that runs Until and holds its database.
- Cloudflare: the network in front of the site and the server, DNS, forwarding of mail to our support address, cookieless visitor statistics for this website, and R2 storage for voice notes and attachments (EU jurisdiction) and for the nightly database backups.
- Google: Firebase Cloud Messaging delivers push notifications to Android (a notification carries the task title so your phone can show it); Google Sign-In, if you use it; Google Play Billing, if you buy a subscription.
- Anthropic (United States): the AI assistant, only if you switch it on.
- PostHog (EU): product analytics, only if you switch them on.
- Brevo: transactional email such as sign-in codes and invitations. It keeps delivery logs with your email address.
- Sentry (EU): server error reports, configured to leave out personal data.
- Telegram: only if you link it, to deliver reminders there.
Sharing a task
When you share a task by link or QR code, the recipient can see that one task and its open or closed state for as long as the link is valid. They cannot see your other tasks, your email address or anything else in your account. Links are short-lived by design.
Your control
- Delete a task and it goes, along with its reminder history.
- Delete your account and everything attached to it goes with it, immediately and for good. Nightly database backups are kept for 14 nights, so your data leaves the backups within 14 days. How to delete, including without the app, and the full list of what is kept: Delete your account.
- Download everything we hold about your account as one JSON file: in the Android app, Settings → Account → Your data → Download my data.
- Ask us what we hold about you and we will tell you.
Contact
Questions, corrections or requests: [email protected].
← Back to the landing page