Privacy Policy

Last updated: October 6, 2026

1. Introduction

eudy ("eudy," "we," "us," or "our") is a weekly planning application operated by Lyra Technologies LLC, a New Jersey limited liability company. This Privacy Policy explains what information we collect when you use the eudy web app and any related applications (collectively, the "Service"), how we use and share it, and the choices you have.

By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

2. Information we collect

Information you provide. When you create an account, we collect your email address. If you sign in with Google, we receive your name and email address, along with a link to your Google profile picture that the Service does not display or use. If you sign in with Apple, we receive your email address and, on your first sign-in only and only if you choose to share it, your name; Apple does not provide a profile photo. If you use Apple's Hide My Email, the address we receive is a private relay address rather than your personal one, and we store it exactly as we would any other. The tasks, plans, schedules, reminders, settings, and other content you enter into the Service ("Your Content") are stored so the Service can function and sync across your devices.

Payment information. If you purchase premium features, payment is processed by our payment providers (see Section 6). We do not collect or store your full payment card number. We receive limited transaction information such as confirmation of payment and the entitlement you purchased. For purchases made in the iOS app, we also store the transaction identifiers Apple provides, linked to your account. We need that link so that if a purchase is later refunded or cancelled, we can identify the account it belongs to and adjust access accordingly; without it a refund could not be applied. Those identifiers contain no payment card details.

Information collected automatically. Our analytics come in two parts, and you control each one separately in Settings → Privacy (see "Cookies and similar technologies" below for how each starts). The first part is a user count: our analytics provider records that someone used the Service, whether they are new or returning, the general device type and platform, the version of the app, and the approximate region, using an anonymous identifier that is not connected to your account. The second part is usage information: which features are used, such as app interactions and feature or section metadata, and it is collected only if you turn it on. Our analytics are configured to record activity counts and feature/section metadata only; we do not transmit the text of Your Content to our analytics provider. Whatever is switched off for you is not collected. Separately, we keep an anonymous count of visits to the pages of our website that describe eudy, and of how often the app itself is opened, which is described under "Counting visits to our website pages" below.

Cookies and similar technologies. If you are in the European Economic Area, the United Kingdom, or Switzerland, analytics are off until you turn them on: the first time you use the Service we ask, and we set an analytics identifier (such as Google Analytics' _ga cookie) only if you choose "Allow." Elsewhere, the user count described above is on by default, and the first time you use the Service we tell you so and offer a one-tap way to turn it off; the identifier is set for that count and for nothing else until you choose otherwise. Usage information is off everywhere until you turn it on. You can change either choice at any time in Settings → Privacy; turning the user count off also turns usage information off, because they share the same identifier. We tell your region from the time zone your device reports, and if we cannot tell, we treat you as if consent is required. Some storage is strictly necessary for the Service to work (for example, keeping you signed in and saving your plans on your device) and is used regardless of your analytics choice.

Counting visits to our website pages. On the pages of eudy.app that describe eudy, such as the page our social posts link to, we count how many times each page is opened and, when your browser provides it, the website you arrived from. We use only the name of that website, for example "instagram.com," and never the full address you clicked, so anything attached to that address stays in your browser. Those two facts are added to a running daily total for each page and each source, and nothing else about the visit is kept. We do not set a cookie or store your IP address or browser details for this purpose, and, apart from the single marker described below for the app, we place nothing on your device. No identifier of any kind is created, so we cannot tell whether two visits came from the same person, and we cannot connect a visit to your account. The counting is done by our own servers and nothing is sent to Google Analytics or to any other company. The app itself is counted the same way: each time eudy opens, we add one to that day's total, together with whether you were signed in at the time, whether the app was running in a browser, installed to your home screen, or as the iPhone or Android app, when it ran in a browser whether that browser was on a computer or on a phone or tablet, and whether it was the first time eudy had opened on that device ever, that day, that week, and that month, from which we count how many devices were active in a day, a week, or a month. We tell a computer from a phone or tablet by the short description of itself that every browser sends with a request (its "user agent"): our server keeps only the words "computer" or "phone or tablet" and discards the description, which is never stored or logged. For the first-time facts, and only for them, the app keeps a small marker in its own storage on your device that records the last day, week, and month on which it was counted. That marker holds nothing that could identify you or the device (every device counted on the same day stores the same value), is never sent to us, and is not a cookie; it exists so that a device is counted once per day, week, and month rather than every time. Everything else said in this paragraph applies to the app count as well: no identifier, no IP address or browser details beyond that one word, nothing sent to any other company, and no way for us to tell two opens apart or to connect one to your account. Because these counts identify nobody, they are separate from the analytics choices described above, which cover the analytics that do use an identifier.

Local storage. The Service stores data on your device (for example, in your browser's local storage) so it can work offline and when you are signed out.

Push notifications. If you turn on reminders in a browser, or turn on notifications in the iPhone or Android app, we store a push messaging token for that device with your account so we can deliver the alarms and reminders you asked for. With the token we keep a random identifier for that installation, which platform it is, and its time zone, so each device gets its own messages at the right local time. The phone apps ring most alarms on their own, from a schedule held on the phone. So that a server message never rings an alarm your phone will ring itself, each phone also records with your account which alarms it has scheduled, as alarm times and references to the task or repeating rule, along with the alarm sound setting you chose on that phone. That record holds no task text. Turning notifications off stops these messages, and all of this is deleted with your account. If you opt in to email reminders, we use your account email address to send them.

Email about eudy. This is off unless you turn it on, in Settings → Privacy or when you start a trial. If you turn it on, we record that you asked and the date you asked, so we have a record of your consent, and we use your account email address to send you occasional email about eudy, such as a new feature or a change to the price. Turning it off records that too, and that choice overrides an earlier yes. We do not send this to anyone who has not asked for it, and every such email includes a way to stop receiving them.

Diagnostic reports. If the app encounters an unexpected error, we may record a small diagnostic report so we can find and fix the problem. A report contains technical details only: the error message and where in our code it occurred, the app version, your general browser type, the page address within the Service, and whether your device was online. It never contains the text of Your Content. Diagnostic reports are sent only if you are signed in and have allowed analytics; if you decline analytics, none are sent.

Calendar connection. The Service can show events from an external calendar, such as Google Calendar, as read-only context beside your plan. This is off unless you turn it on. To turn it on, you paste your calendar's private feed address into Settings, and we store that address with your account settings so the connection is available on your devices. Treat that address like a password: anyone who has it can read that calendar, and you can revoke it at any time through your calendar provider. When the Service refreshes, our server fetches the calendar using the address you supplied and returns the upcoming events to your device, which keeps a copy so the view works between refreshes. We do not store your calendar address or your calendar events on our servers, and we do not record them in our server logs. We keep only each event's title, its start and end times, and, when the event has them, its description and location; guest lists and every other field in the calendar file are discarded without being stored or sent to your device. Calendar events never become part of your plan on their own. If you choose to add one as a task or a reminder, its title becomes Your Content from that point on and is stored, synced, and treated like anything else you type, including under the sharing features described in Section 5. A description or location becomes part of your plan only if you add the event as a task, when it is placed in that task's Details, where you can edit or remove it. Disconnecting the calendar in Settings stops all fetching and removes the stored address and the copy of events held on your device.

3. How we use your information

We use the information we collect to: provide, maintain, and sync the Service; create and secure your account; process purchases and manage premium entitlements and free trials; deliver reminders you have opted into; understand how the Service is used so we can improve it; respond to your support requests; detect, prevent, and address fraud, abuse, and technical issues; and comply with legal obligations.

We do not use Your Content to train artificial intelligence. The tasks, plans, notes, and anything else you write in eudy are not used to train, fine-tune, test, or evaluate generative AI or machine learning models, ours or anyone else's, and we do not send Your Content to any AI service. Our service providers hold Your Content only to run the Service on our instructions and are not permitted to use it to train their models. eudy itself contains no AI features, so nothing you write is sent to a language model in the course of using it. This is also a commitment in our Terms of Service: the license you grant us does not include training.

4. Legal bases for processing

If you are in the European Economic Area, the United Kingdom, Brazil, or another region with similar laws, we process your personal data on the following legal bases: performance of a contract (to provide the Service you request); consent (for optional push and email reminders, for connecting an external calendar, for usage analytics, for the analytics user count where your region requires consent first, and for occasional email about eudy itself; each is off until you opt in, and you can withdraw consent at any time); legitimate interests (to operate and secure the Service, to prevent fraud and abuse, and, outside the regions where consent is required first, to count how many people use the Service with an anonymous identifier that you can turn off at any time); and compliance with legal obligations.

5. How we share information

We do not sell your personal information, and we do not sell or share the contents of Your Content. We do not track you across other companies' apps or websites, we do not use your information for advertising, and we do not use it to train artificial intelligence (see Section 3). We share information only in these circumstances:

• Content you choose to share. Some features publish selected content because you ask them to, and only then. If you create a share your day link, a read-only snapshot of that day (its task text, notes, alarm times, completion states, that day's reminders, and which task is marked as your focus) becomes visible to anyone who has the link, until you stop sharing from the same menu or the link expires (links expire automatically after 30 days unless you renew them). Nothing is ever shared through these features without an action you take.
• Service providers. With the vendors in Section 6, who process data on our behalf to run the Service under agreements that limit how they may use it and require them to protect it to the same standard this policy describes.
• Legal and safety. When we believe disclosure is required by law, or is reasonably necessary to protect the rights, property, or safety of eudy, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy or notify you of any material change.

6. Third-party services

We rely on the following providers, each of which processes data under its own privacy terms:

• Google Firebase (Authentication, Cloud Firestore database, Hosting, Cloud Messaging, and Analytics): account sign-in, including Sign in with Google, content storage and sync, serving the Service over an encrypted (HTTPS) connection, push reminders (a push reminder carries the title of the task it is for; on iPhone, Firebase hands it to Apple's notification service for delivery), and usage analytics.
• Resend: delivers the emails the Service sends, such as password-reset emails, any reminder emails you opt into, and the occasional email about eudy if you have asked for it.
• Stripe: payment processing for purchases made on the web.
• Apple App Store / Google Play: payment processing for purchases made within the respective mobile apps; those purchases are also subject to the store's terms and privacy policy. If you use Sign in with Apple, Apple also handles that sign-in and passes us your email address, or a private relay address if you choose to hide it.
• Your calendar provider, only if you connect a calendar (for example Google Calendar, Microsoft Outlook, or Apple iCloud): our server requests your calendar from that provider using the address you supply, so the provider receives that request and handles it under its own terms and privacy policy. We do not send it any information about you or your plan.

We encourage you to review these providers' privacy policies for details on their practices.

7. Data retention & deletion

We retain your account information and Your Content for as long as your account is active or as needed to provide the Service. You can permanently delete your account and all of its content at any time from Settings inside the Service; doing so removes your account, Your Content, and any diagnostic reports tied to your account from our active databases, subject to a short period during which residual copies may persist in backups. If you cannot sign in to use the in-app option, email privacy@eudy.app from the email address on the account and we will process the deletion for you. Full step-by-step instructions, and a complete list of what is deleted and what we are required to keep, are on our Delete your account page.

If you have connected a calendar, the stored feed address and the copy of events held on your device are removed when you disconnect it in Settings, and when you delete your account. We hold no separate copy to delete, because we do not store your calendar events on our servers.

Analytics records are kept for 14 months and are then deleted automatically. Because these records are not linked to your account, deleting your account does not identify any analytics data to remove; if you would rather we collect none at all, you can turn analytics off at any time in Settings, and we will collect nothing from that point on.

The page-view and app-open counts described in Section 2 are daily totals only and contain no information about any individual, so there is nothing in them to link to you, to delete on request, or to remove when an account is deleted. We keep them indefinitely as a record of how much the website is read.

Some records survive account deletion because we are legally required to keep them: records of purchases and payments are retained by us and by our payment processors to meet tax, accounting, and fraud-prevention obligations. Where the GDPR applies, this retention relies on the legal-obligation exception to the right to erasure.

8. Data security

We take reasonable measures to protect your information, including encryption in transit and at rest through our infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. For more detail, see our Security page.

9. International data transfers

The Service is operated from, and your information is processed and stored in, the United States and other locations where our service providers operate. If you access the Service from outside the United States, you understand that your information may be transferred to and processed in countries whose data-protection laws may differ from those of your jurisdiction. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on the transfer mechanisms our service providers have put in place, including the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework and its UK extension.

10. Your privacy rights

Depending on where you live, you may have the right to access, correct, update, port, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. These rights are provided under laws including the EU and UK GDPR, Brazil's General Data Protection Law (LGPD), Canada's PIPEDA and Quebec's Law 25, Australia's Privacy Act 1988, and New Zealand's Privacy Act 2020. If you are a California resident, you have the right to know what personal information we collect, to request correction or deletion, and not to be discriminated against for exercising your rights; we do not sell or share personal information as those terms are defined under California law.

You can access and edit most of your information directly in the Service, and you can delete your account at any time. To make any other request, contact us using the details in Section 13. We will respond as required by applicable law. If you are in the European Economic Area or the United Kingdom and believe we have not handled your personal data properly, you also have the right to lodge a complaint with your local data-protection supervisory authority.

11. Children's privacy

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will take appropriate steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

13. Contact us

If you have questions or requests regarding this Privacy Policy or your personal information, contact us at privacy@eudy.app, or by mail at Lyra Technologies LLC, 300 Main St, Ste 21 #535, Madison, NJ 07940. This mailbox is our point of contact for data-protection requests, including those made under the GDPR and Brazil's LGPD.