Your privacy at Cavatim

Last updated: 13 October 2026

This notice covers the Cavatim website, iPhone and iPad app, Mac companion, widgets, example diary and email waitlist. The data controller is Boyce Property Services Ltd., company number 06258012, registered in England and Wales. Its registered office is 6 Bexley Square, Salford, Greater Manchester, England, M3 6BZ. Contact our privacy team at support@cavatim.com for privacy questions or a rights request. You can also write to the registered office, marking your letter “Cavatim privacy”.

Exploring Cavatim

The example diary uses fictional entries. It does not load your personal diary and changes to the example are not saved. The marketing video and its images are served by this website; there is no embedded third-party video player or email tracking pixel.

We have not added advertising trackers or marketing analytics to this Site. Our server provider, Hostinger, processes technical information, such as IP addresses and request details, to deliver and secure the website. Cavatim uses an essential, secure session cookie. Server access ends after 48 hours without opening the app or website in the foreground. Background widget refreshes do not extend it. The cookie can remain in your browser for up to 90 days, but an expired server session cannot be used to access your account. Logging out revokes that session and clears the cookie. The signed-in diary saves your appearance preferences in your browser; these are cleared when you log out through Cavatim. You can also clear them through your browser settings.

Joining the waitlist

We collect the email address you enter, the time you join, the wording and version of your consent, your confirmation status and the status of the welcome email. With your consent, we send a founder welcome message and contact you about Cavatim’s limited trial and opening. Joining is optional and creates neither a planner account nor a paid subscription. We do not collect card details.

Your welcome message contains an email confirmation link. Until you confirm, we will not send trial or opening announcements. We do not automatically enrol existing account holders or people from an earlier waitlist into this email list.

You can withdraw your consent at any time using the unsubscribe link in an email or by contacting support@cavatim.com. This does not affect the lawfulness of earlier processing. We use a short-lived, keyed representation of your IP address and request counts to limit automated abuse, under our legitimate interest in protecting the service. The email service does not store your raw IP address in the waitlist database.

Who the service is for

Our description “for high achievers” describes the people the planner is designed to support. The waitlist asks only for your email address and marketing consent. We do not request income, professional credentials or evidence of achievement, and do not use diary content or optional usage sharing to rank applicants or decide invitations. Declining optional usage sharing does not affect access.

Invitation-only accounts

New accounts can currently be created only through a private invitation email. We use the invited email address, first name, invitation identifier, expiry and delivery status to administer access. The link is single-use, expires after seven days and is bound to the invited address. A waitlist entry does not create an account. Invitation administration is based on our legitimate interests in managing a secure private opening and, when you accept, taking steps at your request to provide your account. Invitations and security emails are separate from optional marketing messages. Your email address is needed to deliver an invitation and manage your account; without it we cannot provide that access.

Your signed-in diary

You sign in with your Cavatim email and password, followed by a single-use six-digit code sent to your email. New invited accounts also verify their email this way; an authenticator app is not required for sign-in. Existing authenticator secrets and recovery-code hashes are retained for legacy security actions. Authenticator secrets are encrypted, and recovery codes are stored as one-way hashes; keep these private. Resetting a password does not remove those legacy security records. We store a salted password hash, not the password itself, and use a separate account identifier to keep your diary separate from other accounts. Login attempts are limited using short-lived keyed representations of email addresses and IP addresses. You do not need ChatGPT sign-in to use this VPS-hosted Cavatim diary.

We store the plans, tasks, goals, recurring rules, notes, journal entries, settings and import information you choose to save, plus revision information needed to sync changes. We use this information to provide the diary you request, on the basis of our contract with you. We process necessary security and support information under our legitimate interests in operating a reliable service and meeting legal obligations where applicable.

Diary content, including goals, notes and the saved changes needed for undo, is encrypted at rest with AES-256-GCM. Each encrypted value is bound to its account and record type. Encryption keys are kept separately from the database under restricted server access. Account ownership is checked independently for reads, changes, exports and widget access. This is server-side encryption, not end-to-end encryption: the service can decrypt information to provide syncing and widgets, and authorised operators or providers may be able to access it when necessary. Other accounts are not authorised to open your records.

Please avoid entering sensitive information, such as medical records, that you do not need for planning. The current Site has no AI generation or transcription feature that automatically sends diary entries to a model. If you choose to connect an assistant or use its page tools, information you request can be made available to that assistant under its own terms and privacy settings.

In the online planner, unfinished drafts and pending changes can be kept in encrypted browser storage and recovered for 14 days. Expired copies are cleared when you next open the planner. Recovery is tied to your signed-in account and requires you to review the draft before saving. Signing out or deleting your account clears this account’s drafts in that browser. This is account-bound encryption, not end-to-end encryption.

Where offline access is enabled for your account, you can separately choose to prepare a device with an encrypted copy of your planner. Browser copies use your offline passphrase; iPhone and iPad copies use a device-only Keychain key and device authentication. These copies include pending edits, conflicts and unfinished writing. Signing out or reaching the 30-day offline access deadline locks access without deleting that work. A disconnected device learns of remote revocation when it reconnects, or locks when its existing access expires. Offline drafts have no automatic age-based deletion.

Encrypted recovery files remain wherever you choose to save them. Keep the recovery passphrase separately: losing it, clearing browser storage, removing the app or losing the device can make unsynced work unrecoverable. Native offline copies are excluded from device backups. Server sync retains account-bound operation receipts and encrypted undo history to prevent duplicate changes; account-level limits stop new sync before that history grows without a bound. Deleting an account removes its server records but cannot remotely erase disconnected device copies or exported recovery files.

Apps, widgets and account emails

The app displays the same account and diary hosted at cavatim.com. Native widgets receive a limited copy of your dated tasks, times and completion status, and supported notepad widgets may display note titles, using a revocable device credential stored in the Apple Keychain. The app and widget share this credential and a locally saved agenda through an app group. Your device may show task titles on its Home Screen or Lock Screen, including when someone else can see the screen. Signing out clears the app’s local agenda and credentials; iOS controls when an already displayed widget redraws. You can revoke a device in Account settings. Device access follows its linked session’s 48-hour inactivity deadline and is revoked when you reset your password, revoke that device or sign out of the linked session. Older connections have a bounded transition period after this security update. The current app clears expired cached data and schedules a blank widget at its known access deadline; iOS may delay a displayed image update.

Notepad capture opens the app’s note editor. When you choose to save, the note is sent to the same Cavatim account and stored as diary content under our contract with you. Unsaved drafts may be kept locally on the device to let you finish later. The Mac companion also uses an explicitly connected Cavatim account; supported actions require the appropriate device permission. Widget previews and locally stored drafts may be visible to someone with access to your device.

We store the device name you choose, a random device registration identifier, its account association and issue/expiry times. We do not use an advertising identifier, fingerprint your device for marketing, or track you across other companies’ apps or websites. Your optional profile names, birthday-book contacts and addresses, and uploaded cover logo are account content. The app does not access your device address book or photo library without your action.

Invitations, account verification, password recovery and security-change alerts are service emails, separate from marketing consent. Our branded messages have no open-tracking pixel. Security alerts do not contain your diary, password or authenticator secret. The mailbox provider receives your email address and the verification or recovery message. We store expiring, single-use link verifiers and delivery state. Links and passwords are not included in analytics or application logs.

Subscriptions and Apple

If you buy Pro through Apple, Apple processes the payment under its own terms and privacy notice. We receive signed transaction information, product and subscription identifiers, renewal/expiry and refund status, and a random identifier linking the purchase to your Cavatim account. We do not receive your payment card number or Apple Account password. We process these records under our contract with you to provide paid access and restore purchases, under our legitimate interests to prevent duplicate claims and fraud and handle support, and where necessary to meet legal obligations. Apple is a separate controller for its payment and account processing; see Apple’s privacy policy.

Deleting your Cavatim account removes its live diary, profile, device access and sessions. It does not cancel Apple billing. Minimal pseudonymous purchase identifiers and status may remain to prevent a deleted account’s purchase being claimed by another account and to meet payment, fraud-prevention or legal requirements; these retained billing records contain no diary text or email address. Encrypted recovery backups currently have no automated expiry and may retain earlier copies after deletion from the live database. They are restricted to recovery and investigation, are not available through another user account, and are not used for ordinary product analytics. We review retained copies when handling an erasure request; if a backup is restored, deletion and consent-withdrawal requests must be reapplied before ordinary use. Contact us about retained records or a privacy request.

Optional basic usage sharing

With your consent, we collect known feature names, types and times of successful saved actions, counts of goals and tasks, and whether activity came from the website or native app. Count snapshots are first recorded after a successful opted-in save; missing counts are not treated as zero. We measure time when a supported screen is in the foreground, with a separate estimate for time following recent interaction. This is not total time for which a login exists, and excludes background widget refreshes. Multiple screens are bounded to avoid counting the same time twice.

Usage is linked to your account in a private management dashboard operated by Boyce Property Services Ltd. It does not include goal or task titles, notes, journal entries, passwords, invitation links, search text, screen recordings or keystrokes. The system records that an interaction occurred, not what you typed.

Sharing is off until you affirmatively allow it. Refusal does not affect your planner, widgets or subscription. You can withdraw in Cookies & privacy choices on the website or inside the app. Withdrawal stops new collection and deletes your usage events, timing state and aggregate count snapshots from the live service. Existing encrypted recovery backups may retain earlier copies until removed under the recovery process. Usage records are otherwise retained for up to 90 days and removed by the maintenance process. Collection is not reconstructed for periods before consent.

Invitation and account administration records are processed separately where needed to provide access and prevent abuse. They are not evidence that someone used the product. No advertising identifier or cross-company tracking is used.

Who helps us provide the service

• OpenAI hosts the separate, owner-only analytics dashboard through ChatGPT Sites. It receives the invitation, account summary, optional usage and waitlist management information displayed there; the dashboard does not receive diary text. The earlier Sites version and its preserved migration copy remain private for recovery. OpenAI and its hosting subprocessors, including Cloudflare, process information under the Sites terms. OpenAI also processes information for its own account, security and service purposes under its privacy policy.
• Hostinger provides the VPS that hosts this website, its account and diary databases, the separate waitlist, and server recovery backups. Waitlist and account-service messages are delivered through the existing Cavatim SMTP mailbox. The mail service receives your email address and the message contents, but not your diary.
• Authorised staff of Boyce Property Services Ltd and service administrators can access information when necessary for support, maintenance, security or privacy requests. We may disclose information to advisers or authorities where legally required or justified. We do not sell your information.

Where information is processed

Our providers may process information outside the UK, including in the United States. We do not promise UK-only storage. The ChatGPT Sites data processing terms and Hostinger’s data processing terms describe their responsibilities and contractual transfer safeguards, including the applicable UK transfer provisions. Contact us for information about the safeguards relevant to your data.

How long we keep it

• Unconfirmed waitlist entries: up to 30 days after joining.
• Confirmed waitlist entries and consent/delivery records: up to 12 months after joining, or until you unsubscribe, whichever comes first.
• On unsubscribe, the live waitlist entry and pending email are removed. A keyed hash of the email is retained for up to 12 months to honour the opt-out and prevent automatic re-enrolment. Contact us if you later wish to rejoin.
• Cavatim sessions expire after 48 hours of foreground inactivity and are revoked on logout. Expired session records never grant access and are cleared during subsequent session maintenance. Authenticator login challenges expire after ten minutes; invitation links after seven days. Expired email-action and delivery records are removed by the scheduled mail maintenance process. Login-attempt counters apply for 15 minutes and expired counters are cleared during later login attempts.
• Waitlist abuse counters: up to one hour. Expired waitlist records are cleared automatically by the mail service.
• Diary records: while you keep your account or until you delete it. Items in “Recently deleted” remain recoverable until permanently removed. You can download a diary backup from the Account menu. You can permanently delete your account in Account settings after confirming your password.
• Support correspondence: only for as long as needed to resolve the enquiry and any resulting legal obligation or dispute; normally reviewed for deletion within 12 months of closure. Providers’ operational logs and recovery copies follow their own service retention settings and may outlast deletion from the live database.

Your rights and choices

Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your personal information. You can object to processing based on legitimate interests, and to direct marketing at any time. Email support@cavatim.com. We may need proportionate identity checks and normally respond within one month. A lawful extension may apply to complex requests; we will explain it.

You can complain to the UK Information Commissioner’s Office, including if you are unhappy with our response. We do not use your information for automated decisions with legal or similarly significant effects.

Keeping information safe

We use encrypted HTTPS connections, encrypted diary storage, account-scoped access checks, salted password hashes, authenticator verification, rate limits, restricted server credentials and input validation. Waitlist information is separate from diary records. Access is limited to people and providers who need it to deliver the service. No online service can promise absolute security.

We will update this notice when the service or its data use changes, and seek a new choice where required before adding optional uses such as marketing tracking.