Privacy policy
Last updated 2 August 2026 · bmvp.ai Ltd
The short version
Your tasks, plans and notes are stored on your phone. Treasynx has no user accounts and no server that holds your day. Three things do leave your device, all of them because you asked: an AI prompt goes to the provider you chose with your key; the microphone sends audio to your phone's speech service if you use it; and an entirely optional feature donates twelve anonymous numbers describing the shape of a plan — off unless you turn it on. We collect no analytics and run no crash reporting. Everything else stays where it is.
Who we are
Treasynx is published by bmvp.ai Ltd, a company registered in England & Wales (company no. 17126191), registered with the Information Commissioner's Office under reference C1898705. For the purposes of UK GDPR we are the data controller for the limited processing described below.
Privacy questions: support@treasynx.com
Formal or legal notices: legal@bmvp.ai
What stays on your device
The following never leaves your phone unless you explicitly export or sync it:
- Tasks, times, durations, categories and notes
- Saved planners and work-pattern templates
- Chronotype questionnaire answers and results
- Hourly rate, currency choice and time-value figures
- Hobbies, wellbeing entries, gratitude notes
- Streaks, XP, levels and badges
- Any AI provider API keys you enter
- Your theme, colour and alert preferences
This is held in your app's private storage, which other apps cannot read. Uninstalling Treasynx deletes it. We cannot recover it for you, because we never had it.
What leaves your device, and when
Treasynx contacts other services only for specific features. Each one is listed here with what it receives.
| Service | When | What it receives |
|---|---|---|
| OpenWeatherMap | Only when you use weather-aware trip planning | Approximate coordinates or a place name, and the time you're planning for. |
| OpenStreetMap & Overpass |
Only when you ask for nearby places or a route | Approximate coordinates and a search radius. |
| OpenRouteService | Only when you request directions | Start and end coordinates. |
| Your chosen AI provider |
Only when you generate or adjust a plan with AI | The planning prompt, which may include task titles you've written. Sent from your phone directly to the provider you configured, using your key. It does not pass through us and we never see it. |
| Your WebDAV server |
Only when you sync a backup | Your encrypted backup file, sent to a server address you supplied — your Nextcloud, Koofr or similar. Not ours. |
| Your phone's speech service |
Only while you hold the microphone in the schedule interview | The audio you speak. Android hands this to whatever speech service is installed — on most phones Google's, which transcribes it on their servers. We never receive it and never store it. Typing gets the same result if you'd rather not. |
| Supabase (EU, Ireland) |
Only if you switch on "Help train the model", which is off by default | Twelve numbers describing the shape of a plan, and whether you kept it. Never task titles, notes, dates, times or anything you typed. See Donating plan shapes below. |
| Google Play | Only when you buy Pro or a subscription | Handled entirely by Google Play Billing. We receive confirmation that a purchase occurred; we never see your card details. |
Bring your own AI key
Treasynx does not operate an AI service. If you use the AI features you supply your own key, and your request goes straight from your phone to that provider, governed by their privacy policy rather than this one. It is worth reading the one that applies to you.
Sixteen are supported: Anthropic, OpenAI, Google Gemini, Grok (xAI), Groq, DeepSeek, Mistral, OpenRouter, Together, Fireworks, Cerebras, Perplexity, DeepInfra, and any other OpenAI-compatible endpoint — plus two that involve no third party at all: Ollama or LM Studio on your own machine, where nothing leaves your network, and the on-device model, where nothing leaves your phone.
Two are worth flagging rather than burying in a list. DeepSeek is operated from China, so your prompts would be processed there. Perplexity searches the web to answer, which means your prompt shapes outbound searches. Neither is a reason to avoid them; both are a reason to choose knowingly.
Running the AI on your phone instead
You can install a small language model on the device and use the AI features with no key, no account and no network at all — aeroplane mode is a valid way to run it. In that configuration nothing about your schedule leaves the phone, which is a property of the wiring rather than a promise you have to trust.
We do not supply or host the model. You download it from its publisher and accept their licence — for the Gemma models, Google's Gemma Terms of Use. bmvp.ai Ltd is not a party to that licence and does not check it; complying with it is between you and the publisher. The file lives in the app's private storage and no new phone permission is required.
If you switch on local training, a small scorer is trained on your phone from which plans you keep, and used to choose between drafts. That training never leaves the device. It is not the language model changing — no phone can retrain a language model, and we do not claim otherwise.
Voice input
The microphone in the schedule interview is optional and does nothing until you tap it. When you do, Android passes the audio to your phone's speech recognition service, which on most phones is Google's and works by uploading the recording for transcription. We never receive the audio, never store it, and cannot see it — but it does leave your device, and it goes to a company you did not pick as an AI provider. The first time you tap the microphone the app explains this and asks. Typing produces exactly the same result.
Donating plan shapes
This is the only feature in Treasynx that sends anything to us, and it is off unless you switch it on in AI settings. There is no prompt, no reminder, and nothing in the app works worse if you decline.
What is sent
Twelve numbers describing the shape of a plan — what fraction of the day was focus work, how long the average block ran, how many blocks there were, and so on — plus whether you kept, edited or rejected it. Alongside those: a random identifier generated on your phone, which model produced the plan, and the app version.
Never sent: task titles or notes, dates, the time of any block, prompts, anything an AI wrote for you, your location, your device model, any advertising identifier, or any account detail. The payload cannot be turned back into a schedule because the schedule was never in it. You can see the exact data in the app before agreeing.
Why we ask
The scorer that learns which plans you keep needs roughly twelve examples before it says anything and a few hundred before it is any good, so every new install is useless for weeks. Pooled shapes let a sensible starting scorer ship inside the app, so one person's first week benefits from other people's second month. That is the whole purpose. It is not sold, not shared with anyone, and not used for advertising — there is no advertising in Treasynx.
Basis, processor and retention
- Controller: bmvp.ai Ltd.
- Lawful basis: your consent, Article 6(1)(a) UK GDPR.
- Processor: Supabase, hosting the database in Ireland (EEA).
- Retention: 18 months from collection, then deleted.
- Age: this feature is for users aged 18 or over.
Withdrawing, and one catch worth knowing
Use Withdraw and delete everything on the donation screen. Collection stops at once, the queue on your phone is erased, and the server is told to delete every row your install has sent. If the server can't be reached you are told so and given an email address, rather than left to assume it worked.
The catch, stated plainly because it is a real limitation of the privacy-preserving design: donated rows carry only that random identifier, stored nowhere but your phone. That is what stops the data being traceable to you — and it is also the only thing that lets us find your rows in order to delete them. If you clear the app's data or uninstall without withdrawing first, that identifier is gone and we can no longer locate your rows on request. So withdraw first, then clear. We would rather tell you that now than discover it together later.
Analytics
There is none. No PostHog, no Firebase, no telemetry of any kind. Nothing in Treasynx measures which screens you open, how often you use it, or what you do while you are there.
This page previously described PostHog in detail, including how to switch it off in Settings. Neither the analytics nor the setting existed — the library was added to the project and never wired up, and this page was written for the version of the app that was planned rather than the one that shipped. That was our error, and it is corrected here rather than quietly removed, because a privacy notice that has described collection which never happened should say so plainly.
The practical consequence is that we know almost nothing about how the app is used. We find out what is broken when someone tells us, which is why there is a bug report button in the app and why we ask people to use it. If analytics is ever added, this page will describe it before the release that adds it, and it will be opt-in.
Crash reporting
There is no crash reporting SDK in Treasynx. No Crashlytics, no Sentry, nothing that phones home when something breaks.
What does happen is what happens for every Android app: if Google's "usage and diagnostics" setting is on, Android reports crashes to Google Play and we see them anonymised and aggregated in the Play Console. We do not choose that, cannot enable it for you, and cannot tell who a crash came from. It is controlled by your Android settings, not by us. If we ever add a crash SDK, this page will say so before the release that adds it.
Checking for new AI models
The model optimiser is optional and off by default. Switched on, it asks each provider you already hold a key for which models it currently offers, so it can warn you when the one you use is retired — which would otherwise break your AI features with no explanation. The request carries your key and nothing else: no schedule, no prompt, no personal data. It runs only while the app is open, never in the background, and at the interval you choose.
Reporting AI output
Every AI-generated response carries a control to report it. Choosing a category and sending opens your own email app with a message addressed to us, which you can read before it goes. Whether the AI's response is attached is your choice and is off by default, because a response is built from your schedule and can repeat your own notes back. A report without it is still useful — the category and the model are the two things that matter most.
Location
Location is optional and used only for weather and nearby places. Treasynx requests coarse or fine location only at the point you use one of those features, never in the background, and does not store a location history. Deny the permission and the rest of the app is unaffected — you can type a place name instead.
Backups and encryption
Exports can be encrypted with AES-256-GCM, with the key derived from your passphrase using PBKDF2. The passphrase is never stored and never transmitted. If you lose it, the backup cannot be opened — not by us either. Where you put the file is your choice; if you sync it to a third-party service, that service's policy applies to the file at rest.
Lawful basis for processing
| Purpose | Basis |
|---|---|
| Running the app on your device | Contract — you asked for a planner |
| Weather, places, routes | Consent, by choosing to use the feature |
| AI planning | Consent, by configuring a provider and key |
| Voice input | Consent, by choosing to use the microphone |
| Donating plan shapes | Consent, withdrawable in the app at any time |
| Purchases and refunds | Contract, and legal obligation for records |
International transfers
Donated plan shapes are held by Supabase in Ireland, which is inside the EEA and covered by the UK's adequacy decision, so no additional transfer safeguard is required. If you choose a non-UK AI provider or WebDAV host, your request travels to wherever they operate — a transfer you initiate and control by choosing that provider. Voice audio goes wherever your phone's speech service processes it, which for Google's is subject to Google's own policy.
Retention
On-device data lives until you delete it or uninstall. Donated plan shapes are deleted 18 months after collection, or sooner if you withdraw. Purchase records are kept as long as UK tax and accounting law requires.
Your rights
Under UK GDPR you can request access, correction, erasure, restriction, portability, and object to processing. In practice, for most of it you don't need us: your data is on your device, exportable to a file you hold, and deletable by you at any time. For anything concerning analytics or purchases, write to support@treasynx.com and we'll respond within one month.
If you're unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Treasynx is not directed at children under 13 and we do not knowingly collect data from them. There is no social feature, no user-to-user messaging and no public profile. The optional plan-shape donation is restricted to users aged 18 or over.
Changes to this policy
If we change how data is handled we'll update this page and the date at the top, and note material changes in the app's release notes. The current version always lives at treasynx.com/privacy.