Trust by design

Privacy Policy

Our approach

AimAscent is designed for deeply personal goals. We believe that calls for restraint: collect less, explain clearly, and give people meaningful control over their information.

Last updated: August 12, 2026. AimAscent is still in pre-release development, and this policy describes the current architecture and service boundaries.

Local app data

Your Aims, Stages, Projects, Actions, Routines, Reviews, notes, and related records are created and used locally on your device. Core planning remains available without a cloud account. Local data can be read by the app on an unlocked, authorized device and is subject to the security of that device and its backups.

Accounts and website information

If you create an account, purchase or manage membership, use Official Sync, or join the website waitlist, we may process:

  • Your email address and sign-in identity
  • Device, session, entitlement, subscription, and billing-provider metadata
  • Your preferred platform and language
  • The time and version of communication or Pace consent

Official Sync

Official Sync is optional and end-to-end encrypted. Aim, Stage, Project, Action, Routine, Review, preference, and Tool payloads are encrypted on your device before upload. The service stores encrypted changes and does not receive the Vault Key or recovery code.

Sync encryption does not hide account identity, entitlement, device and Vault identifiers, mutation metadata, timestamps, approximate payload size, or active-timer coordination metadata. A compromised unlocked device can also read content available on that device.

Optional Personalized Pace coaching

Personalized Pace is an optional AimAscent Plus feature and an explicit exception to the end-to-end encrypted Sync path. It is off until you accept the current Pace disclosure. When you actively ask Pace a question, your device creates a bounded context from the current planning scope, recent execution evidence, your question, and a short conversation tail. The scope may be an Aim or Stage, or a Project or Action that intentionally has no Aim; Pace does not silently substitute your primary Aim. That request is sent over TLS to the AimAscent service and then to the DeepSeek public API to generate a response.

The request excludes structured account, email, Vault, device, and persistent record identifiers. AimAscent also applies length limits and heuristic redaction for common email addresses, phone numbers, links, secrets, and identifier-like text. This is data minimization, not a promise of anonymity: user-authored titles, plan text, questions, or conversation may still identify you or reveal sensitive information that automated rules do not recognize.

The AimAscent application is designed not to persist or log the question, coaching context, conversation, or generated answer. To enforce consent, successful-reply credits, provider safety limits, idempotency, and a safe transport retry, it stores account-linked consent version and timestamps plus content-free request and quota metadata. This metadata can include a request-scoped identifier and one-way proof, billing month, lease and consent generation, request state, successful-reply and provider-attempt counters, rate-limit timestamps, and update times. A provider attempt can count toward the separate safety budget even when it does not produce a successful reply; it does not consume a successful-reply credit. The current service does not define a separate time-based deletion schedule for these metadata records; deleting the account removes them.

DeepSeek is a separate recipient and processes submitted content under its current API terms, privacy terms, and available controls. AimAscent does not promise that DeepSeek provides zero retention or never uses API data for model improvement unless a current, applicable agreement supports that statement. Processing may occur in jurisdictions where the provider operates.

You may revoke Pace consent in the app. The service closes the account's Pace egress gate before waiting for an already-admitted request to finish, and it discards a generated answer if the consent generation no longer matches. Once revocation completes, no earlier request lease can deliver a result or start another provider attempt. Revocation cannot recall content already sent to DeepSeek, reverse processing already completed, or create a provider-side deletion guarantee.

How we use information

We use information to provide sign-in, encrypted sync, membership, customer support, security, fraud prevention, service operation, optional Pace responses, and communications you requested. Waitlist information is used for launch updates, early-access invitations, platform demand, and the pre-release experience. We do not sell personal information or use your goals to build an advertising profile.

Service providers

Information may be processed by infrastructure and security providers, Resend for account email, Creem or Apple for billing, and DeepSeek when you enable and actively use Personalized Pace. Each provider handles information under its own terms and our applicable service arrangements. We aim to keep the provider list and shared data limited to what each service needs.

Your choices

  • Use the local planning system without enabling Official Sync or Personalized Pace
  • Review and revoke Pace consent to stop future cloud coaching requests
  • Unsubscribe from product emails
  • Request access, correction, export, or deletion where applicable
  • Delete your AimAscent account, subject to any active subscription steps shown in the app

Deleting an account disables the account and removes Pace metadata, encrypted sync data, identities, devices, and sessions. AimAscent retains a pseudonymous account and billing tombstone so delayed cancellation, refund, revocation, fraud-prevention, and legally required financial events remain auditable. It does not remotely erase a local database that remains on one of your devices.

Security and limits

We use measures such as transport encryption, end-to-end encrypted Sync payloads, short-lived access tokens, and data minimization. No system can guarantee absolute security. TLS protects information while it travels, but an intended service such as AimAscent or DeepSeek must receive plaintext Pace content in order to process a coaching request.

Contact

Privacy requests and questions can be sent to privacy@aimascent.com. We will update this policy and the Pace consent version when a material change affects the information sent or the services that process it.