Privacy Policy

Last updated: October 29, 2026

This Privacy Policy explains what personal information Year in Review collects, how we use it, who we share it with, and the choices you have. If anything here is unclear, email [email protected].

The short version

1. Who We Are

Year in Review is operated by SideStreet Software Inc. For questions about this Privacy Policy, contact [email protected].

2. What We Collect

Anonymous app identifier

The first time you open Year in Review, the app creates a random identifier associated with your installation or device. This identifier is not based on your name, email address, or other directly identifying information. We use it to support app functionality, diagnostics, and backup or sync features before you sign in, and in some cases even if you never create an account.

If you later sign in, this identifier may become associated with your account so your existing data can continue working across sessions and devices.

Account information

If you choose to sign in with Apple or Google, we receive the email address and display name associated with that account. We do not receive or store your Apple or Google password. Signing in is optional.

Your tracker content

We process the trackers you create, including titles, categories, daily entries, tags, goals, field values, and notes. This data is stored locally on your device so the app can function. Depending on how you use the app, some or all of this data may also be stored in our database to support backup, sync across devices, and recovery after reinstall.

Your content is not public and is not visible to other users. Limited access by our personnel may occur only when reasonably necessary to operate, secure, maintain, or support the service, and only subject to appropriate access controls.

AI chat (removed)

Earlier versions of the app included an AI chat. It has been removed, and the current app does not send your data to any AI provider. Chat history saved by an earlier version stays in your account until you delete your account, and is deleted with it.

Crash reports

If the app crashes or encounters a serious error, a crash report may be sent to Sentry. Crash reports may include the device model, operating system version, app version, and the technical stack trace of the error. Crash reports do not intentionally include the content of your entries, notes, tags, or goals.

Usage analytics

We collect limited first-party usage events, such as when a user opens a tab or creates a tracker, so we can understand which features are used and which are broken. These events may include tracker titles, which are scrubbed on-device to remove email addresses, phone numbers, and similar patterns before transmission. We do not collect the content of your entries, notes, or tags for analytics purposes.

Analytics events are stored in our own database, not with a third-party analytics provider, and are automatically deleted after 90 days.

External AI assistant connectors

You can connect an external AI assistant, such as Claude, ChatGPT, Cursor or another MCP-compatible client, to your account from Settings → Connect AI Assistants. You sign in to Year in Review from the assistant, and it gets access to your account only.

When a connected assistant makes a request, we process it on our servers. The assistant can read and change the same tracker data you see in the app, but only trackers that sync to your account: trackers kept only on your device cannot be reached. It can also add and manage todos, which are stored in your account. What the assistant does with that data is covered by its provider’s privacy policy, not this one. We log per-call metadata (tool name, status, duration, anonymized client identifier) to operate and debug the service. We do not log the content of your tracker entries or the text of your prompts.

To stop an assistant’s access, remove Year in Review from that assistant’s connector settings. Earlier versions of the app could also generate API keys, and a key keeps working until it is revoked. To revoke one, email [email protected]. Deleting your account deletes every key.

Device information

We collect device model, operating system and version, app version, language, and time zone to support the app and diagnose issues.

Voice input

Year in Review lets you dictate notes using your device’s speech-to-text features. Speech recognition is performed by your device operating system or its provider. We only receive and store the resulting text that becomes part of your note. We do not receive or store the underlying audio. On some platforms, such as iOS, the platform provider may process dictation audio on its own servers. Please review that provider’s privacy policy for more information.

Apple Health (iOS only)

Year in Review can read data from Apple Health. This is off by default: the app can read nothing until you allow it in Apple’s Health permission sheet, which appears when you make a tracker from Apple Health. Apple lets you allow or deny each type of data separately.

When you make a tracker from Apple Health, we ask only for the data behind it — for example step count — and read it for the days the tracker covers, plus any earlier history you choose to import. For a workout tracker we also read each workout’s type, duration, start time and energy, so the app can offer a one-line note describing it; that detail is not stored unless you add the note.

With access you have already allowed, the app also reads Apple Health in two other places, on your device only. Your year review can show a year of steps, sleep, active energy and exercise minutes, including a metric you have no tracker for. The home screen looks at the last 30 days to suggest a tracker worth making. These readings are not uploaded and are not added to your trackers.

What a tracker reads becomes values on that tracker, exactly as if you had typed them. Those values sync to your account like the rest of your tracker data so they appear on your other devices and survive a reinstall. We do not upload the underlying Apple Health records themselves, and we do not store a copy of your Health data separately from your trackers.

Health data is never used for advertising or marketing, never sold or shared with data brokers, never used to train AI models, and never stored in iCloud. If you connect an external AI assistant to your account, it can read your trackers, including the values Apple Health filled in, the same way it reads the rest of your tracker data.

To stop a tracker reading Apple Health, delete the tracker. To stop all reading, including the year review and suggestions, turn Year in Review off in Apple’s Health app under Sharing, or in Settings → Privacy & Security → Health. Values already recorded on your trackers remain yours and can be deleted like any other entry.

What we do not collect

We do not collect your location, contacts, photos, browsing history, or advertising identifier. We do not read health data unless you allow Apple Health access, as described above. We do not embed third-party advertising or consumer analytics SDKs such as Google Analytics, Meta, PostHog, Mixpanel, or Amplitude. We do not share your data with advertisers or data brokers, and we do not profile you for advertising.

3. How We Use Your Information

We use the information described above only to: - provide and operate the app - back up and sync your data across devices - answer requests from AI assistants you connect - diagnose crashes, bugs, abuse, and security issues - understand how the product is used so we can improve it - respond to support requests - comply with applicable laws and enforce our terms

We do not use your information for targeted advertising or cross-context behavioural advertising.

4. Service Providers

We rely on a small number of service providers to operate Year in Review. These providers process personal information on our behalf and only for the purposes we specify, subject to contractual and technical safeguards.

Supabase

Used for database hosting, authentication, and server functions. Your trackers, analytics events, account information, and any chat history saved by an earlier version may be stored in Supabase infrastructure.

Sentry

Used for crash and error monitoring. Receives crash and diagnostic information as described above.

Cloudflare

Hosts the AI assistant connector. It handles requests from assistants you connect and stores their sign-in tokens.

Apple and Google

Used as identity providers if you sign in with Apple or Google. We receive only the information made available through their sign-in flows, such as your name and email address.

We may also disclose information if required by law, legal process, or government request, or where reasonably necessary to protect our rights, users, the public, or the integrity and security of the service.

5. Where Your Data Is Stored

Your data is hosted on infrastructure operated by our service providers and may be stored or processed outside your province, country, or region of residence, including in the United States and the European Union. Data protection laws in those places may differ from those in your home jurisdiction. We use contractual and technical measures intended to protect your information wherever it is processed.

6. How Long We Keep It

We keep personal information only for as long as reasonably necessary for the purposes described in this policy.

7. Your Rights and Choices

You can delete your account and associated data at any time from Settings > Account > Delete Account.

Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or obtain a copy of your personal information, and to withdraw consent where processing is based on consent.

For users in Canada, including under PIPEDA and Quebec Law 25, you may request access to your personal information, request correction of inaccurate information, and withdraw consent subject to legal or contractual restrictions. You may also file a complaint with the Office of the Privacy Commissioner of Canada or, if applicable, the Commission d’accès à l’information du Québec.

For users in the EU, EEA, and UK, our legal bases generally include performance of a contract with you, legitimate interests in operating, securing, and improving the service, and consent where required by law. You may also lodge a complaint with your local data protection authority.

For California residents, you may have rights to know, access, correct, and delete personal information, and to opt out of sale or sharing as defined by California law. We do not sell personal information or share it for cross-context behavioural advertising.

To exercise any right not available through the app, email [email protected]. We will respond within a reasonable time and, where required by law, within the applicable legal deadline.

8. Children

Year in Review is not intended for children under 13, and we do not knowingly collect personal information from them. Where a higher minimum age applies under local law, the app is not intended for users below that age unless any legally required parental or guardian consent has been obtained. If you believe a child has provided personal information in violation of this section, contact us and we will take appropriate steps to investigate and delete the information where required.

9. Security

We use safeguards designed to protect your information, including encryption in transit, row-level security controls in our database, short-lived authentication tokens, access controls, and other reasonable technical and organizational measures. No method of storage or transmission is completely secure. If we become aware of a security incident affecting your personal information, we will notify affected users and relevant authorities where required by law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice in the app or by other appropriate means and update the “Last updated” date above. Your continued use of the app after the effective date of the revised policy is subject to the updated policy, to the extent permitted by law.

11. Contact

For any question, request, or complaint about this Privacy Policy, contact:

SideStreet Software Inc. Email: [email protected]