Privacy Policy

1. What data we collect

Location — precise and approximate device location, including background location when you have granted permission.
Device identifiers — your Expo push token, used to deliver notifications to your device.
Email address — collected through Google OAuth when you sign in.
Task content — titles, notes, due dates, and location facets you create through conversation or the companion app.
Insights — behavioral observations Onward builds over time about how you work.
Saved places & activity context— places you name and save in the companion app, and your current activity state (e.g. walking, driving) used for context-aware task surfacing.

2. How we use your data

Task location matching & geofence notifications — your location is compared against places you have saved so Onward can surface relevant tasks when you arrive.
Push notifications — your push token delivers daily briefings and due-date reminders.
Authentication & account management — your email identifies your account and lets you sign in securely.

3. Background location

Onward uses background location solely for geofence-based task notifications. When you arrive at a saved place that has a relevant task, a local notification fires on your device. Location data is not used for advertising, analytics, or any purpose other than task surfacing.

4. Third-party sharing

Supabase — hosts the database and authentication service that stores your account, tasks, insights, places, and activity context.
Google — provides the OAuth sign-in flow used to authenticate your account.
Expo push service — receives your device token and notification content to deliver push notifications.
Connected AI assistants — when you connect Onward to an AI assistant (such as Claude, ChatGPT, or Gemini) via the MCP protocol, your task content and rankings are shared with that AI service as part of normal operation. This sharing occurs only through connections you explicitly authorize.
These service providers process your data solely to operate Onward. Your data is never sold or shared for advertising.

5. Data retention

Your data is retained until you delete your account. To request account deletion, email nickdavenock@gmail.com. All data is permanently purged upon deletion.

6. Your rights

Account deletion — email nickdavenock@gmail.com to request deletion. All data is permanently purged.
Location permissions— you can revoke location access at any time through your device's system settings. Revoking permission stops new location collection, geofence monitoring, and place-saving. Previously collected location context may continue to influence task ranking until it expires or is cleared. Core task management and push notifications continue to work regardless.