Deflective

Privacy policy

Last updated: 19 August 2026

This policy explains how Deflective ("we", "us" or "our") handles personal data when you use the Deflective websites, web application or native iOS app. Deflective is the data controller for this processing and is based in the United Kingdom.

Information we collect

  • Account information: your Firebase user ID, email address and, when provided by Google, your name, profile image and sign-in provider. Passwords are handled by Firebase Authentication and are not visible to us.
  • Planning information: tasks, notes, projects, deadlines, estimates, priorities, work or personal context, preferred time windows, planned work blocks, settings and completion history.
  • AI information: text you enter into AI features, recent conversation context, relevant tasks, projects, settings and, if connected, relevant calendar event titles and times. We also record AI call and token totals to apply plan allowances.
  • Subscription information: your plan, subscription status, billing period and Stripe customer and subscription references. We do not receive or store your full payment card details.
  • Native app and notification information: if you enable notifications in the iOS app, a device identifier, Firebase Cloud Messaging token, device platform and your reminder preferences. Reminder notifications can include a task title and due time.
  • Technical information: basic request information such as IP address, browser or device type, timestamps and diagnostic or security logs may be processed by us and our hosting providers when you use the service.

How we use your information

  • create and secure your account and keep you signed in;
  • store, synchronise and organise your tasks and plans;
  • generate AI-assisted task details, plans and suggestions;
  • avoid calendar clashes and perform calendar sync you enable;
  • manage subscriptions, usage limits and customer support;
  • send reminders you have requested; and
  • operate, troubleshoot and protect Deflective.

Under UK data protection law, we rely on performance of our contract with you to provide the core service, your consent for optional permissions and integrations, our legitimate interests in operating and securing the service, and legal obligations that apply to billing, tax and compliance records. You can withdraw consent for an optional feature at any time without affecting earlier processing.

AI features

When you use AI features, Deflective sends the information needed for that request to OpenAI to produce a response. This can include task titles, descriptions, dates, the text you enter (your prompt), relevant project and schedule details, recent chat messages and, if Google Calendar is connected, relevant event titles and times. We never send passwords or payment information.

Data is collected only when you start an AI request — for example parsing a task from Quick Add, asking for planning suggestions, or sending a Chat message. OpenAI processes this as a sub-processor under a Data Processing Agreement that includes Standard Contractual Clauses and equivalent safeguards for transfers from the United Kingdom to the United States. Deflective does not train its own AI models using your content. Under our OpenAI API terms, API traffic is not used to train OpenAI models. AI output is a suggestion: you decide whether to accept it, and it does not make decisions that have legal or similarly significant effects on you.

You can grant or withdraw consent in Settings under Enable AI features. Turning the setting off stops further sharing with OpenAI.

Google Calendar

Google Calendar is optional. If you connect it, we store an encrypted refresh token so the connection persists and record your chosen calendar and sync settings. We read calendar names and event titles, dates and times to show availability, avoid scheduling clashes and give AI features planning context.

Write sync is enabled when you connect Calendar unless you turn it off in Settings. Deflective then creates and updates calendar events for your planned work blocks or task deadlines. The service is designed to modify only events it identifies as having been created by Deflective. You can disconnect at any time, which removes the stored connection token, and can choose whether to remove events created by Deflective.

Deflective's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Native iOS permissions

  • Notifications: the app asks for permission only when you enable task reminders. You can turn reminders off in Deflective and control permission in iOS Settings. Disabling reminders stops notifications, although the registered device token may remain until your account data is deleted.
  • Microphone and speech: voice input is optional and starts only when you tap the microphone control. Speech recognition is provided by your browser or operating system, which may send audio to Apple, Google or another speech service under that provider's terms. Deflective receives the resulting text and does not intentionally store the audio recording.

Cookies and local storage

We use browser storage that is necessary to authenticate you, maintain your session and remember interface choices such as calendar or task view. On the marketing website we may also store your analytics-cookie preference. We do not use advertising cookies. Stripe and Google may use their own cookies when you visit their checkout, account or consent pages.

Analytics

We use Google Analytics 4 via Firebase Analytics to understand how the marketing site and the Deflective app are used (for example page views, button clicks, and high-level product events such as task completion counts). Events do not include task titles, notes, chat messages or other planning content you enter. On the marketing website, analytics storage is disabled until you accept; you can decline. In the web and native apps, aggregated product analytics help us improve reliability and planning features. Google may process analytics data outside the United Kingdom under appropriate safeguards.

Service providers and sharing

We share personal data only as needed to provide the service, comply with law, protect rights and security, or complete a business transfer. Our main service providers are:

  • Google Firebase for authentication, database hosting, cloud messaging, analytics, and Google Calendar when you connect it;
  • Google Analytics for anonymised usage and conversion statistics;
  • OpenAI for AI-assisted planning;
  • Stripe for subscription checkout, billing and payment support;
  • Vercel and related infrastructure providers for web hosting; and
  • Apple for iOS app distribution and push notification delivery.

We do not sell your personal data and do not share it for cross-context behavioural advertising. Some providers process data outside the United Kingdom. Where required, we use recognised safeguards such as adequacy regulations or approved contractual protections.

Retention and security

We keep account and planning information while your account is active so that it remains available across devices. Calendar credentials are removed when you disconnect Calendar. Billing, fraud-prevention, security and transaction records may be kept for longer where required by law or reasonably necessary to resolve disputes. Data may remain in restricted backups until those backups expire.

We use technical and organisational safeguards appropriate to the data, including access controls, encrypted network connections and encryption of stored Google refresh tokens. No online service can guarantee absolute security.

Your choices and rights

You can edit or delete tasks and projects in Deflective, disconnect Google Calendar, disable reminder notifications, turn off Enable AI features in Settings (which stops further sharing with OpenAI) and sign out at any time. You may also ask us to provide a copy of your personal data, correct it, delete it, restrict or object to its use, or transfer data you supplied. You may withdraw consent where processing relies on it. These rights can have legal exceptions.

To exercise a right or request account and data deletion, email privacy@deflective.co.uk. We may need to verify your identity. If you are in the UK, you can also complain to the Information Commissioner's Office.

Children

Deflective is not directed to children under 13, and we do not knowingly collect their personal data. Please contact us if you believe a child under 13 has provided personal data.

Changes and contact

We may update this policy as Deflective changes. We will update the date above and provide additional notice where a change materially affects your rights. Questions about this policy can be sent to privacy@deflective.co.uk.