Scope and draft status
Tardy is a planning app for United States residents age 18 or older, operated personally by Michael Minh Nguyen and Aaron Nguyen. This policy describes the app and connected services. Contact tardyadmin@tardyplanner.app about privacy, access, correction, or deletion. Independently operated services have their own policies.
This is a release-pending review draft, not yet effective. It describes the revised app and backend, which await a coordinated release. The effective date will be assigned with that release. It does not confirm the behavior of an installed or production version. Publishing or opening this page does not record agreement or AI permission.
Terms version 2 and AI disclosure version 2 are described below. Website visitor, support, and historical waitlist handling are addressed separately in the current website notice.
Current website and waitlist privacy notice
The website links directly to the public TestFlight invitation. You do not need to join a website waitlist to access it. This section describes current website practices and retained waitlist records, separately from the release-pending app policy.
We retain information submitted to the waitlist: your email address, any school or campus-champion interest you chose to provide, the signup source, and the signup time. The older signup endpoint remains available even though the public pages no longer display a waitlist form. We use these records for signup and launch updates, to understand campus interest, and to respond to related requests. Records are stored in the website’s SQLite database and copied to a Google Sheet used by Tardy’s administrators; failed copies are queued for retry.
The signup endpoint uses IP addresses in server memory for abuse prevention and request limits. The request-limit window is not a promise of deletion at the end of that window. Website hosting and service operation also process network and technical information needed to deliver and protect the site.
The current website code does not set analytics or advertising cookies, use browser storage for advertising, or include a third-party analytics tracker. Fonts are served with the site. External destinations such as TestFlight and connected services follow their own policies when you visit them. This does not mean hosting providers process no technical information.
Support is provided by email. We receive your email address and the message, account details, device information, screenshots, or attachments you choose to send, and use them to respond and handle account, feedback, or privacy requests. Our email provider processes that correspondence. Do not send passwords, private feed URLs, or unnecessary sensitive information.
The website code does not automatically expire or delete retained waitlist records. Support correspondence follows mailbox-provider practices; no fixed retention period is promised here. Contact tardyadmin@tardyplanner.app to request removal from the waitlist or ask about your website information. We may need to verify the request and address copies held in the database, Google Sheet, or support mailbox. This notice does not promise an automatic unsubscribe process or immediate removal of every provider copy.
Joining the waitlist, visiting this website, or sending support email does not create an app account or enable app AI processing, calendar access, Text Tardy, or marketing permission for a different purpose.
Agreement and AI sharing
AI powers automatic planning, coursework analysis, document extraction, and Ask Tardy. In the revised agreement flow, an initially unchecked Terms/AI checkbox is separate from the age and US-residency checkbox. Checking it and selecting Continue accepts the Terms and expressly permits the described AI sharing. Tardy does not collect a birth date or precise location for eligibility.
The AI provider for this release is DeepSeek, accessed through its direct API. Relevant data travels from your device through Tardy's authenticated backend to DeepSeek. Automatic planning and analysis may send data after acceptance without a separate prompt for each request. The categories that can be shared are listed next.
The revised agreement records Terms version 2, AI disclosure version 2, the decision and source, and server time. Acceptance of an older version, signing in, or reading a policy does not establish this permission.
The Terms/AI checkbox reads:
I agree to Tardy’s Terms and consent to Tardy sharing my account details, coursework, calendar details, reminders, preferences, and chats with DeepSeek for AI planning and assistance.
Data that can be sent for AI processing
- Your display name and relevant account context, time zone, and preferences.
- Course and assignment titles, descriptions, syllabus text, due dates, completion information, importance and time estimates, and study history.
- Calendar event titles, times, notes, locations, availability, commitments, plans, and reminders from the sources you connect.
- Your assistant messages, relevant conversation history, and text extracted from a syllabus or class schedule you choose to import.
AI processing, providers, and your choice
Ask can send a bounded calendar workspace to Tardy's backend, then supply relevant details to the model as it answers. Automatic planning supplies assignment and scheduling context even if you do not open Ask. Document scanning extracts text on the device before sending the extracted text for analysis. Tardy also supplies a one-way account pseudonym for provider abuse monitoring. That pseudonym is not your name or email, but content in the same request may identify you. It is not anonymous processing.
DeepSeek is operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. Processing may occur in China. Its general public privacy policy describes purposes that include improving and training its technology, and retention based on purpose and legal requirements. Its Open Platform Terms state that the public privacy policy does not cover processing of end-user data by developer applications. Tardy has not established API-specific no-training protections, processing regions, fixed retention periods, or how deletion cooperation will work for this service. The Open Platform Terms describe necessary technical cooperation with end-user rights requests, but no service-specific deletion timeframe has been confirmed. We do not promise no training or deletion within a fixed period, and we do not assert that every API input is used for model training.
The revised app has no separate AI-off mode. Sign out on all devices and stop using Tardy to stop new app AI requests. Use Settings > Delete Account to end your account and request erasure, or contact us if you cannot use the app. Signing out does not retract already submitted data or erase retained copies. A request already in progress may finish. A previously linked Text Tardy account is separate from an app sign-in; texting is disabled in the revised app code and production state remains to be confirmed.
Delete Account is also available before accepting the updated Terms. There is no separate AI-off switch in this release; calendar access, messaging permission, and marketing consent remain separate from the combined Terms/AI agreement.
We will disclose material changes to the AI recipient or sharing purposes and obtain permission before that changed sharing begins. Do not put passwords, access tokens, highly sensitive records, or other people's private information that you lack permission to share into chats or imported documents.
Accounts and connected data
Sign-in. Firebase Authentication handles email/password, Apple, and Google sign-in. We receive your account identifier, email, and the name you or the sign-in provider supplies. Tardy does not store your email password in its app database or backend database. Signing in with Google does not itself grant Google Calendar access.
Canvas school sign-in. Searching for a school sends your search text to Canvas's public school directory. Selecting a school opens its Canvas and identity-provider pages inside Tardy in a temporary browser session. You enter your school credentials into those pages; their operators process the login. Tardy's integration does not read password fields or send school passwords or session cookies to Tardy's backend or AI provider.
After sign-in, Tardy uses that session on the device to request your Canvas profile, current courses, your submission records, and planner check-offs. It extracts the private Calendar Feed URL and assignment identifiers with completion dates/status. The browser uses nonpersistent storage; Tardy does not keep that sign-in session for later synchronization. School and identity provider logging follows their own policies. This flow is separate from a Canvas developer-key OAuth connection and may not work for every school. You can instead paste a Calendar Feed URL.
The feed URL acts as a credential. It stays in the current Tardy account's device Keychain and is sent directly to the Canvas host to refresh the feed, not synced to Firebase or another device. It is not uploaded to Tardy’s backend or AI provider. Calendar feeds provide only the assignments and events that Canvas exposes there. Completion marks read at school sign-in do not turn the feed into continuous access to submissions, grades, syllabi, or hidden work. Imported academic information and completion marks are stored in the account's device caches and can become AI context.
An older enhanced Canvas API connection may also remain on an account. Its personal access token is encrypted on Tardy's server in Firebase and held in app memory while in use; it can provide richer coursework and syllabus information. A school sign-in does not create that type of token. The service can decrypt a retained legacy token to provide the connection; this is not an end-to-end-encrypted credential vault. Disconnect Canvas or delete your account to remove a retained account connection.
Apple and Google Calendar. With the separate permissions you grant, Tardy reads and writes connected events and plans study time around them. Google OAuth tokens stay in the account-scoped device Keychain. Apple Calendar access is enabled separately for each Tardy account on a shared device. Relevant event content may be sent through Tardy to DeepSeek as described above; it does not always stay on your phone.
Tardy-created provider events include opaque ownership and planning identifiers in their notes so the app can reconcile its own events. Those markers do not contain your name, email, Firebase user ID, or assignment title. Your events remain subject to Apple, Google, and any connected calendar provider's own storage and policies.
Plans, learning, and assistant context. Tardy keeps academic caches, completion and study-time learning information, plans, and Ask history on the device under your account. Assistant preferences and planning setup are also synced to Firebase for restoration. The app builds request context from these records; it does not retain a separate assistant-context PDF.
Saved Tardy cloud calendar. Accounts with saved cloud calendar data can view, edit, and delete it through authenticated server endpoints. Events and recent operation receipts are encrypted in Firebase. The calendar stores up to 500 events with titles, times, time zones, and revision timestamps, but no notes or locations. Up to 256 bounded operation receipts may include earlier copies of change results. Deleting an event removes the active event, while receipt copies can remain until replaced or the account is erased. These records have no automatic time-based expiry.
Providers, security, and usage records
Firebase and Google Cloud provide authentication, account storage, backend hosting, and push delivery. Apple and Google process their respective sign-ins and connected calendar operations. DeepSeek processes AI requests. Linq and Twilio relate to the disabled messaging features described below. Support requests are handled through our support email provider; do not send passwords or private feed links in support messages.
Private account credentials and messaging/cloud-calendar content use authenticated encryption at rest and are restricted from direct client Firestore access. Device credentials use Keychain. Provider API keys remain on the server. These controls do not prevent authorized service processing; they do not make AI requests end-to-end encrypted between you and your device.
We keep account-linked AI call counts, token/cost measurements, and per-route spending records to enforce limits and explain usage. Model-call logs include operational measurements such as route, model, duration, token use, and result status; the logging code excludes prompt text, replies, and raw account IDs. Hosting providers also process network and operational information needed to run and secure the service. This is not a promise that no technical logs exist.
Tardy does not sell personal data, run ads, or track you across other apps and websites for advertising. The app has no banking or finance feature and does not read or upload your address book. Saving a Tardy contact uses Apple's confirmation screen. Content you provide can nevertheless contain sensitive information; avoid including information that is unnecessary for planning.
Retention
- Account data, saved cloud events, and synced preferences remain until changed, reset, or deleted. Device caches and history remain until their relevant clearing action or account cleanup.
- Normalized AI analysis and document-extraction results can be cached for 180 days with exact-input hashes, not the raw source request. Results may still contain personal information. Ordinary chat replies are not kept in this result cache.
- Automatic planning strategies can be retained for two days and reused for up to two hours. Daily strategy-call and AI-budget counters have a three-day expiry. Account-linked spending summaries have a 400-day expiry.
- Database expiry means eligibility for cleanup, not guaranteed immediate deletion. Cleanup timing depends on deployed expiry policies and subsequent activity. Bounded records without an expiry remain until replaced or erased.
- A minimal account-ID and deletion-status record is retained to block old sessions and finish cleanup. It becomes eligible for expiry 24 hours after the deletion sweep completes; incomplete deletion records remain for retry.
- Provider copies, hosting residual copies, and support correspondence have their own operational and legal retention. Tardy does not promise that an account deletion instantly removes every provider copy or log. Contact us about specific retention or deletion requests.
Disabled messaging features and older records
Text Tardy and SMS digests are disabled in the revised app code. This draft does not confirm production availability. Accepting the Terms does not connect a number or enable texting. Earlier linked accounts may have encrypted retained sender bindings, snapshots, conversations, reminders, requests, and delivery records until cleared or deleted.
When Text Tardy is available and separately connected, Linq receives sender and recipient addresses, message content, and delivery information. The AI provider receives relevant message and Tardy context. An encrypted snapshot can let the server answer while the app is closed; changes requiring the phone wait for the phone to execute them. Snapshots older than 24 hours are not used, but that freshness limit does not itself delete them. Conversation history is bounded to 24 messages and 32,000 UTF-16 units. Pending requests expire after 24 hours; results and operation receipts are bounded and may be cleaned during later activity. Delivery jobs have a 24-hour expiry.
Event text reminders, when separately enabled, use upcoming event titles and times through Linq without an AI call at delivery. Earlier requested text reminders may retain their title, time, recipient binding, and delivery state. The disabled SMS digest feature used a separately supplied phone number and deadline summary with Twilio. None of these messaging permissions are granted by the general Terms checkbox.
Disconnecting Text Tardy or deleting the account removes the connection and shared messaging records. STOP pauses texts and clears waiting actions, but does not delete all shared context or saved cloud events. Clearing local Ask history does not erase a separately retained server conversation. Signing out does not disconnect an earlier linked sender. Delivered messages remain in your Messages app and with providers; a send already in progress may arrive. If the current app does not expose a legacy connection control, contact us or use account deletion. Saved cloud events and their receipts are separate from messaging context and remain until removed or the account is erased.
Your controls, reset, and deletion
Disconnect sources. Disconnect Canvas or Google Calendar in Settings to remove its usable device credential. Canvas disconnect also removes academic caches, linked plans and learning data, pending proposals, notifications, and Tardy-owned non-recurring Canvas-linked calendar events where access allows. Your own and imported provider events are not removed. An old Canvas API credential is disconnected on the server; if offline, another device may retain access until that change synchronizes. Cleanup failures leave minimal retry information containing opaque IDs and date bounds, not passwords, feed URLs, or assignment text. Existing Ask messages remain until cleared.
Delete Account. In Settings > Delete Account, confirm your identity with your sign-in method. Tardy deletes the account sign-in and removes its account records, including preferences, planning setup, Canvas connection, saved cloud calendar, messaging connection and content, AI result caches, and usage records. Deletion that cannot finish immediately is recorded for server retry. The minimal deletion marker described above remains temporarily.
Delete Account is available from the agreement screen before accepting the updated Terms. You do not need to grant the revised AI permission to request account deletion.
On the device used to delete, Tardy clears account data and pending notifications and removes Tardy-created provider events from today forward where calendar access allows. Your own events and earlier events remain. Apple sign-in authorization is revoked as part of the Apple deletion flow; Google sign-in is disconnected for a Google account. Deletion cannot be undone. Clear Tardy from other devices as well; deletion does not remotely erase all device-local copies. It also does not retract delivered messages or override provider/legal retention. Email us if you cannot access the app.
Reset Account. Settings > Reset Account clears account content and current device history so you can set up again, but keeps your sign-in and the usage, spending, and rate-limit records that prevent a reset from restarting service limits. Reset removes Tardy-created provider events, including past events, where access allows; your own events remain. You must complete the agreement and setup again. A reset cannot be undone and is not account deletion.
You may also contact us to request access, correction, deletion, or other privacy rights available under applicable law. We may verify your identity before acting. Contact tardyadmin@tardyplanner.app if an account belongs to someone under 18; Tardy is not offered to minors.
Effective date, changes, and requests
Effective date: not assigned. This release-pending review draft was reviewed on 18 October 2026. The website effective date must be coordinated with the revised app and backend release; these pages alone do not make those controls live.
We update this policy as the service changes and identify the revision above. Material changes receive the notice and renewed permission required by law and the app's agreement flow. Publishing a revised webpage alone does not record a user's permission to share with an AI provider.
Questions or privacy requests?
Contact Michael Minh Nguyen and Aaron Nguyen at tardyadmin@tardyplanner.app.