Privacy Policy
Dao with Ian Felton
This app is built to support a quiet practice. It collects as little as possible. An account is required to use the app: you sign in with your email address and an 8-digit code. Your meditation sessions, journal entries, and library annotations are stored on your device and automatically synced to a private cloud account that only you can read.
What we store on your device
All app data is stored locally in your device's private storage. The same data is also saved to the cloud (see below).
- Meditation sessions — Date, start time, duration, notes, and tags. Stored in a local SQLite database.
- Journal entries — Date, time written, body, and tags. Stored in a local SQLite database.
- Annotations on library texts — The text being annotated, the annotation body, and the time written. Stored in a local SQLite database.
- App preferences — Whether you have completed the introduction walkthrough. Stored in device key-value storage.
- Backup timestamp — The date and time of your last manual data export. Stored locally.
- Authentication session — A session token from our authentication provider is stored locally so the app can keep you signed in. No password is stored.
Accounts and sign-in
An account is required to use the app. The sit timer, journal, and library annotations are not available without signing in. There is no anonymous mode.
To sign in, you provide your email address. The app sends you an 8-digit verification code, which you enter to complete sign-in. Your email address is the only credential — there are no passwords. We use your email address to send the sign-in code and to associate your synced data with your account.
Authentication is handled by Supabase. Sign-in code emails are delivered through Resend (resend.com) on behalf of dao@ianfelton.com. Resend processes your email address and the sign-in code message body for the sole purpose of delivering that email.
What leaves your device
- Podcast feed — The app fetches an RSS feed from Anchor.fm to display episodes. No user data is included in this request.
- Podcast audio — When you play an episode, audio is streamed from Anchor.fm's servers. No user data is sent.
- Authentication — Your email address is sent to Supabase to request a sign-in code, and the code is sent to you via Resend.
- Cloud sync — Your meditation sessions, journal entries, and library annotations are sent to Supabase as you create them, so they can be restored on your other devices. The data sent is the same as the data described above. Each row is tagged with your account identifier, and database access rules ensure only you can read it.
Cloud storage
The following is stored in our Supabase database:
- Your email address.
- Your meditation sessions (date, start time, duration, notes, tags).
- Your journal entries (date, time, body, tags).
- Your annotations on library texts (text ID, body, time).
Cloud data is hosted by Supabase in the United States (us-east-1). Database row-level-security rules ensure that no other user can read your data, and we do not view, share, sell, or otherwise use it. The data is never seen by advertisers or analytics providers because the app contains neither.
Permissions
- Internet access — Required to sign in, sync your data, fetch the podcast feed, and stream audio.
- Audio (background playback) — Used so meditation timer chimes and podcast audio can continue while the app is in the background or the screen is off.
- Notifications (optional) — Used only if you opt in.
- File access (import only) — Used when you choose to import a backup file.
- Microphone, camera, location, contacts, calendar — Not requested or used.
Analytics and tracking
This app contains no analytics software, no crash reporting services, no advertising networks, and no user tracking of any kind. Your data is never sold or shared.
Data backup and export
You can export your session data at any time from the data screen. The export creates a plain JSON file that you control. The app does not upload this file.
Third-party services
Three third-party services receive data from the app:
- Supabase — provides authentication and cloud database storage. Receives your email address and your synced sessions, journal entries, and annotations.
- Resend — delivers sign-in code emails on behalf of dao@ianfelton.com. Receives your email address and the sign-in code message body for the purpose of delivering that email.
- Anchor.fm (Spotify) — hosts the podcast RSS feed and audio files. Receives standard request metadata when fetching the feed or streaming audio. No user data is sent.
Their respective privacy policies apply to those communications.
Children's privacy
This app is not directed at children. We do not knowingly collect any information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.
Deleting your data
Account and cloud data. You can permanently delete your account and all cloud-stored data from inside the app: open the tend tab and tap delete account. This action is immediate, cannot be undone, and permanently removes your authentication record and all of your rows from our database — your email address, meditation sessions, journal entries, and library annotations.
Local data. Uninstalling the app removes all locally stored data from the device. Backup files you have exported to other storage are not affected.
If you are unable to access the app for any reason, you may also email dao@ianfelton.com from the email address associated with your account to request deletion. Email-based deletion is processed within 30 days.
Contact
Effective date: April 30, 2026