Privacy Policy

Unstuck is owned and operated by Cyber Safety Alliance Limited. For the purposes of UK and EU data-protection law, we are the data controller for the personal information described in this policy.

We are not currently required to appoint a statutory Data Protection Officer. Privacy enquiries are handled by our privacy contact above.

This policy applies to the Unstuck website; the mobile, desktop and web applications; task, calendar, focus and capture features; Collections and People; sharing and collaboration; the AI Assistant and voice features; widgets, shortcuts and connected-device functions; subscriptions and billing; beta features; and our support and marketing communications.

It does not cover third-party services you connect to Unstuck, or the app stores through which you may purchase a subscription. Those providers have their own privacy policies.

Unstuck exists to reduce cognitive load. That means people trust it with unusually personal material — the thing they've been avoiding for three weeks, a note about a difficult conversation, the reason today fell apart. We treat that seriously.

Your captures are a record of a mind at work, not a data asset.

Four commitments guide every decision we make about data:

• Minimum collection. If a feature works without a piece of data, we don't collect it.
• Private by default. Sharing is opt-in, per item, per person.
• No behavioural profiling. We don't build advertising profiles or infer health conditions from your usage.
• No shame in the data. We don't rank users, score productivity, or use missed sessions against you.

Unstuck is designed for people who experience executive dysfunction, and many of our users have ADHD. This creates a genuine privacy consideration we want to be direct about.

We do not ask for, and do not require, any diagnosis or health information. There is no field for a condition, no medical questionnaire and no health screening. Using Unstuck is not a disclosure of any diagnosis.

However, information you choose to write into tasks, captures or People notes could reveal special category data — for example health, medication, therapy appointments, religious or political views, or details about your relationships. Where that happens:

• we process it only to provide the service you asked for, on the basis of your explicit consent, given by choosing to enter it;
• we do not analyse it to infer a condition about you;
• we do not use it for marketing, segmentation or profiling;
• we do not disclose it to advertisers, insurers, employers or data brokers, ever; and
• you may delete it at any time.

People and sharing features let you record context about others — a note that your mum has an appointment, or that a colleague is waiting on a document.

When you enter information about someone else, you become responsible for doing so lawfully and fairly. Please:

• keep notes proportionate and factual;
• avoid recording another person's health, financial or otherwise sensitive details unless you genuinely need to and it is appropriate;
• never use People to monitor, track or build a covert profile of anyone; and
• remember that if you share an item, the person you share it with will see what's in it.

If someone contacts us about information you have stored about them, we may need to notify you and take proportionate steps in line with our legal obligations.

Under UK GDPR we must have a lawful basis for each purpose. Ours are:

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out.

9.1 What gets sent

When you send the Assistant an instruction — typed or spoken — we send our AI provider that instruction, the recent messages of that conversation, and a working snapshot of your account, so it can act without making you repeat what it should already know. The snapshot is an inventory: it says what exists, not what everything says. It is bounded — this week, your open tasks, and the most recent items in each category — not your full history.

The snapshot contains: today's date and your local time, and the time left free in your day; your open tasks (name, estimate, life area, and when each is scheduled); this week's calendar entries, including the names of the tasks in them and whether they are done; the names of your lists and how many items each holds; the ids and tags of the captures waiting in your inbox; your life areas and tag names; the facts you have asked the Assistant to remember; short summaries we derive from your own history (when you focus best, what you have told us you get stuck on, and routines we have noticed in your schedule); the name on your account, or the name you asked to be called; how many people are in your trusted circle; and, if a focus session is running, the task you are focusing on.

It does not contain the text of your captures, the text of your list items, the names of the people in your circle, files or images you attach, your focus-session history, your archived lists, your task history beyond this week, or your settings and billing details. When a request actually needs one of those — “what’s on my shopping list”, “read me my inbox” — the Assistant fetches that list or those captures and sends them for that one request.

If someone has shared a Collection with you, it is part of what you can see, so it is part of what your Assistant can see: its name and item count are in the snapshot, and its items are sent if you ask the Assistant about it. The reverse is true of anything you share — it can reach the other person's Assistant the same way. Sharing is always your choice, and you can revoke it at any time.

Talk (voice) mode sends your speech and the same snapshot to the same provider.

9.2 Our training commitment

9.3 Providers and processors

We use established AI infrastructure providers acting as our processors under written terms that restrict them to processing on our instructions, require appropriate security, prohibit training on your content, and impose retention limits.

We maintain a current list of subprocessors, available on request from privacy@unstucknow.io.

9.4 Retention by providers

Providers may retain a request briefly for abuse monitoring or operational reasons, subject to contractual limits. We do not authorise longer retention for their own purposes.

9.5 Improving our own product

We may review a small number of Assistant interactions to detect failures and improve quality. Where we do this, we use de-identified or aggregated data, or content you have voluntarily submitted as feedback. Access is restricted and logged.

9.6 Turning it off

You can disable the AI Assistant in Settings. The rest of Unstuck continues to work without it.

If you use voice capture, Talk mode, or a platform assistant such as Siri:

• audio may be processed to produce a transcript;
• transcription may be performed on your device or by a service provider, depending on platform and settings;
• the resulting transcript is stored as your content, and you can edit or delete it;
• where the operating system handles the voice interaction, that platform's privacy policy also applies; and
• we do not retain raw audio after a transcript has been produced, except briefly where needed to complete the request.

Microphone access is requested only when you use a voice feature, and you can revoke it in your device settings.

To deliver notifications we process a push token issued by Apple or Google, plus the minimum content of the notification itself. Push tokens are device identifiers, not identity documents, and we delete them when a device is removed or notifications are disabled.

Your notification level — Calm, Balanced or Coach — controls how much we send. Notification content may appear on your lock screen depending on your device settings; adjust those settings if others can see your screen.

Nothing is shared by default. Content becomes visible to another person only when you share it, or when a collaborator acts within permissions you granted.

When you share an item, the recipient may see its title and details, its first physical action, and — for Partner or shared-focus items — activity such as "Paused by Sam". They do not gain access to anything else in your account.

When you accept an invitation, the person who invited you can see your display name and your activity on the shared item only.

You can revoke access at any time. Revoking stops future access but cannot retrieve information already seen, remembered or exported by the other person.

Insights are generated from your own session and estimate history and shown only to you. They are observations, not scores.

We do not compare you to other users, publish leaderboards, share Insights with anyone, or use Insights for advertising or eligibility decisions.

We share personal information only with the following categories of recipient, and only as far as necessary:

All processors act under written contracts that limit them to our instructions and require appropriate security.

We are based in the United Kingdom. Some providers process information outside the UK or EEA, including in the United States and in Singapore (where our AI infrastructure provider processes Assistant requests).

Where information is transferred outside the UK, we rely on an adequacy decision or adequacy regulations where one applies; the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum; and a transfer risk assessment together with additional technical and organisational safeguards such as encryption in transit and at rest.

You may request further information about transfer safeguards from privacy@unstucknow.io.

We keep personal information only as long as needed for the purpose it was collected, then delete or anonymise it.

We may retain specific information for longer where necessary to comply with a legal obligation, or to establish, exercise or defend a legal claim.

We use appropriate technical and organisational measures, including encryption in transit using TLS and encryption at rest; hashed and salted password storage; access controls on a least-privilege basis, with staff access to user content restricted and logged; multi-factor authentication for administrative access; network segregation and monitoring; regular patching and dependency updates; backups with tested restoration; and vendor security review before engaging a processor.

No system is completely secure. Please help by using a strong unique password, enabling device protections, reviewing connected sessions, and installing updates promptly.

If a personal-data breach occurs, we will investigate promptly and contain it; assess the risk to affected people; notify the Information Commissioner's Office within 72 hours where the breach is likely to result in a risk to rights and freedoms; notify affected users without undue delay where there is a high risk, explaining what happened and what to do; and record the incident and the lessons taken from it.

Subject to conditions in applicable law, you have the following rights:

To exercise a right, email privacy@unstucknow.io, or use the export and deletion tools in the app where available.

We will respond within one month. If a request is complex we may extend this by up to two further months and will tell you why. We may need to verify your identity first, and we will not charge a fee unless a request is manifestly unfounded or excessive.

You do not need to email us to exercise most everyday choices:

On our website we use strictly necessary local storage for sign-in, security and remembering essential preferences. These do not require consent — which is why you don’t see a cookie banner.

We use no analytics, performance, advertising or cross-site tracking cookies at all.

In the apps we use local storage on your device for offline use and preferences. This stays on your device except where sync is needed to provide the service.

Most browsers let you block or delete cookies. Blocking strictly necessary cookies may prevent sign-in from working.

Unstuck is not intended for children under 13, and we do not knowingly collect their personal information. If we learn that an account belongs to a child under 13, we will delete it and the associated information.

Users aged 13–17 need permission from a parent or legal guardian. Protections that apply to every account — and therefore to every young person’s account — include:

• we send no marketing emails to anyone — only account emails (sign-in, security);
• we run no analytics or tracking at all;
• sharing is invite-only — nothing about you is visible to anyone unless you explicitly share it; and
• we collect the minimum needed to run the service (see section 4).

A parent or guardian may contact privacy@unstucknow.io to ask about, access or request deletion of a young person's account. Appendix A of our Terms sets out the acknowledgement we ask parents to give, and sign-up asks every new user to confirm they are 13 or older and, if under 18, that they have that permission.

Unstuck makes automated suggestions — which task to start, how long something might take, how your day could be sequenced.

These are recommendations, not decisions. They never determine your access to the service, your price, your eligibility for anything, or any legal or similarly significant outcome. You can always ignore, override or change them.

We do not carry out solely automated decision-making with legal or similarly significant effects, and we do not profile you for advertising.

We may update this policy as the product develops or the law changes. The effective date at the top always reflects the current version.

For material changes we will give notice in the app, by email, or on the website before they take effect, and will seek your consent where the law requires it. Minor clarifications and corrections may take effect on publication.

We keep previous versions and can provide an earlier one on request.

If you are unhappy with how we have handled your information, please tell us first at privacy@unstucknow.io. We aim to acknowledge within 3 working days and to respond substantively as soon as reasonably possible.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office:

If you are in the EEA, you may complain to your local data-protection authority. You do not have to come to us first, though we would like the chance to help.

Related pages: Terms of Service · Privacy · Support · Account deletion