Legal document
Privacy policy
Last updated: 2026-09-27
This document says what data Time To Be Generous keeps about you, why, for how long, and what you can require of us. It describes what the application does today, and nothing else.
Who is responsible for your data
The data controller is the application's publisher:
- Generous Co, a Delaware corporation, United States
- Federal Employer Identification Number (EIN): 88-3361885
- Mailing address: PO Box 513, Pebble Beach, CA 93953, United States
- Contact for anything concerning your data: privacy@generousco.ai
The data we collect
We collect only what the application needs in order to work. There is no analytics tool, no advertising, no location tracking and no access to your contacts.
| Data | Where it comes from |
|---|---|
| E-mail address, name, username, profile photo | You, at sign-up and then in your settings |
| The photos of your smiles | You, when you send one to a friend |
| Password | You. It is kept as a hash, never in readable form |
| Google or Apple identity | The provider, only if you choose that way of signing in |
| Timezone and language | Your device, so the product's day is your day |
| Archetype and the five axis scores | Computed from the discovery journey |
| Your friendships, notifications, reports and feedback | Your use of the application |
| Notification token | Your device, so we can send you notifications |
The discovery journey does not keep your answers. Only the resulting archetype and the five scores are stored: if you ask for a copy of your data, you receive the result, not the cards you swiped.
Reports and feedback messages are free text. They may name another person, and they are read by a human on our team.
Why we collect it
Each piece of data serves a defined purpose and rests on a legal basis the General Data Protection Regulation provides for:
| Purpose | Legal basis |
|---|---|
| Creating your account and signing you back in | Performance of the contract these terms form |
| Connecting you to your friends and running the daily ritual | Performance of the contract |
| Sending you an e-mail code to confirm a sensitive action | Performance of the contract, and our legitimate interest in securing your account |
| Sending you notifications | Your consent, given on your device and withdrawable at any time |
| Handling a report and protecting people | Our legitimate interest in keeping the space safe |
Who else has access
We use technical providers, which act only on our instructions:
| Recipient | What it receives |
|---|---|
| Amazon Web Services (hosting) | All of the data, which lives on its servers |
| Amazon SES (e-mail delivery) | Your e-mail address and the contents of the message sent |
| Expo (notifications) | Your device's token and the contents of the notification |
| Google, Apple | Nothing we send them. They identify you to us, only if you go through them |
Your data is never sold, rented or passed to advertisers. It is used for no targeted advertising, here or anywhere else.
What others see of you
- A smile's photo is visible only to the person who sends it and the person who receives it.
- Your friends see your name, your username, your profile photo and your portrait.
- Your profile also has a public page, at your username's address: it shows your name, your username, your profile photo, your archetype and its five scores to anyone who has the link. It is kept out of search engines.
- Someone you block no longer sees anything of you in the application, and you no longer see anything of them.
How long we keep it
| Data | Retention |
|---|---|
| Sign-in token | 15 minutes |
| Renewal token | 60 days |
| Codes sent by e-mail | 15 minutes, after which they are useless |
| Smile photos | Until the friendship ends, one of you blocks the other, or either account is deleted |
| Your account's data | Until you delete your account |
Deleting your account from your settings erases the row that represents you and everything attached to it: your friendships, your smiles, your notifications, your feedback. Your profile photo and your smiles' photos are erased from disk, and we ask Apple to revoke the link if you signed in through them. There is no bin and no grace period.
Where it is hosted
Our servers and our database are hosted by Amazon Web Services in the Paris region (eu-west-3), so your data stays in the European Union. There is one exception, which carries no personal data: the availability alarms are hosted in Virginia, the service that provides them existing nowhere else.
Profile and smile photos are written to our own server's disk, not to a third-party storage service.
Your rights
Wherever you live, you have the following rights. They are those the EU General Data Protection Regulation (GDPR) gives people in the European Union, and we apply them to everyone:
- to access the data we hold about you and obtain a copy of it
- to have it corrected where it is inaccurate
- to have it erased, which deleting your account does immediately
- to object to a processing operation or ask that it be restricted
- to withdraw your consent to notifications at any time, without calling into question what came before
Write to privacy@generousco.ai to exercise any of these rights: we answer by hand, within one month. If our answer does not satisfy you, you may refer the matter to the data protection authority of the country where you live.
Minors
The application is not intended for people under fifteen, and we do not knowingly collect any data about a child under thirteen. If we learn that an account was opened by someone younger, we delete it.
Changes to this document
This document describes what the application does today. Should that change, in particular if we were to add a new processing operation, it will be updated before that goes live and the date at the top of the page will show it.