Privacy Policy

01The short version

Fixed stores your habits and schedule on your device. We do not sell your data, we do not run ads, and we do not track you across other apps or websites.

Data leaves your device in only three situations, and each one is something you turn on yourself:

• You turn on cloud backup, which sends an encrypted copy of your data to our server. It is encrypted on your device first, with a key that never leaves your device, so we hold something we cannot read.
• You connect an optional integration such as Canvas, and your device requests data from that service directly.
• You buy a subscription, which is processed by Apple, not by us.

We never ask for your name, your email address, or a password. Creating a backup account does not require any of them.

This summary is here to be useful, not to replace the detail below. Where the summary and the full sections differ, the full sections govern.

02Who we are

Fixed is published by FLX Create LLC, a limited liability company organized in the State of California, United States. In this policy, "we," "us," and "our" mean FLX Create LLC. "You" means the person using the app. "The app" means Fixed on any platform we publish it for, including the web app, iPhone, iPad, Apple Watch, and Mac.

For the purposes of the EU and UK General Data Protection Regulation, FLX Create LLC is the controller of the limited personal data described in this policy.

Our contact details are in section 19.

03What stays on your device

The core of Fixed works entirely on your device. The following is created by you and stored in the app's own storage on your device:

• Your habits, their targets, and the days you log them
• Your schedule: blocks, their titles, times, categories, and notes
• Your checklists and the steps inside each block
• Your completion history, day scores, and streaks
• Your alarm times and app settings
• Your answers to the setup questions, including the goal you wrote in your own words
• Any custom trackers or metrics you create
• Any nutrition file you import, and the values read from it
• Photos you take in the app, and the folder, name and note you file them under

If cloud backup is off, none of this is transmitted to us, we have no copy of it, and we cannot recover it for you if you lose it.

If you turn cloud backup on, a copy of this data is encrypted on your device and then sent to our server. We still cannot read it, for the reasons set out in section 8 — but a copy does exist outside your device, and we would rather say so plainly than hide it in a clause.

04Photos and scanned documents

Fixed can take a photo of a worksheet, a receipt, a form, a meal — anything — clean it up so it reads like a document, and file it under a folder or attach it to an assignment.

Those images never leave your device. They are stored in a separate database in the app's own storage on your phone, and they are deliberately excluded from cloud backup. We have no copy of them and no way to obtain one. This is not a promise about our intentions; the images are not sent anywhere, so there is nothing for us to hold.

Two consequences we would rather state than bury:

• They are not backed up. If you lose the phone, delete the app, or clear its storage, the photos are gone. Export a folder to PDF if you need a copy somewhere safe.
• They can be removed at any time. Deleting a photo in the app deletes the image itself, not just its entry in a list.

Fixed asks your device for camera access only when you tap to take a photo, and only for that purpose. No image analysis, face detection, or text recognition is performed by us or by any third party. The clean-up step is arithmetic on the pixels, carried out on your device.

05Reminders and notifications

If you allow notifications, Fixed can remind you about assignment due dates and your morning alarm. The reminder is composed on your device from data already on your device, and is shown by your device. Nothing is sent to us or through a push service — Fixed has no push server, holds no push subscription, and cannot message you when the app is closed.

A record of which reminders have already been shown is kept on that device so the same one does not repeat. It stays on the device and is not included in cloud backup.

You can turn reminders off in Settings, and you can revoke notification permission in your device's own settings at any time.

06What leaves your device, and when

This table is the complete list. Nothing else is transmitted.

Photos and scans are not on this list, and that is the point. They are never transmitted — not to us, not to a backup, not to anyone.

We do not embed advertising networks, analytics SDKs, or third-party trackers in the app. If that ever changes, we will update this policy and describe what is collected before the change takes effect.

07Abuse prevention

Our server limits how many requests one caller can make in an hour. Without it, anyone could fill our database or use our Canvas relay as a free bandwidth pipe, and the cost of that lands on us.

To count requests we need to tell callers apart. We do it like this:

• Your IP address arrives with every request, as it does with every request to every website. We never write it down.
• We combine it with the current hour and a fixed internal string, run that through a one-way hash, and keep only the first 8 bytes of the result.
• That short hash and a counter are stored — nothing else. No IP address, no account id, no request contents.
• Every row expires within the hour and is deleted.

Because the hash changes every hour and cannot be reversed, these rows cannot be used to follow anyone over time or to link requests back to a person. They exist to answer one question — “has this caller made more than N requests this hour?” — and then they are gone.

08Cloud backup and sync

Phones get lost, broken, and replaced. Cloud backup exists so that your history survives that. It is off until you create a backup account, and the app is fully functional with it off.

There is no password, and no email address

Most apps would ask you for an email address and a password. We deliberately do not, because that would mean we store credentials, send reset emails, and become worth breaching. Instead:

• When you create a backup account, your device generates a random 32-character sync key and shows it to you once. You save it.
• The key itself is never transmitted to us and is never included in the backup. It is stored only on your device.
• What identifies your account on our server is a one-way SHA-256 hash of that key. It cannot be reversed into your key, and it is not derived from anything about you.
• A new phone gets your data back by entering the key.

We therefore never ask for, receive, or store your name, your email address, your phone number, a password, or a password hash.

Your data is encrypted before it leaves your device

The backup is encrypted on your device, using AES-256-GCM with a key derived from your sync key by PBKDF2-HMAC-SHA-256 at 210,000 iterations with a random salt, and a fresh random initialization vector for every backup. Only then is it sent to us.

This is end-to-end encryption, and we mean the literal thing: we do not hold your sync key, so we cannot derive the decryption key, so we cannot read your backup. Neither can anyone who compromises our server, and neither can anyone who compels us to hand it over.

Exactly what our server stores

One row per account, containing four values and nothing else:

There is no column for a name, an email address, a device identifier, an advertising identifier, or an IP address. Each backup replaces the previous one; we do not keep a history of versions.

Where it is hosted, and what our host can see

The sync server runs on infrastructure operated by Cloudflare, Inc., which acts as our processor and service provider. Cloudflare does not receive the contents of your data in readable form — what passes through it is the same ciphertext described above.

As with every service reached over the internet, the network connection itself carries your IP address to the host handling the request. Cloudflare processes connection-level information of this kind for security and delivery purposes under its own terms; we do not store IP addresses, and we do not join any connection information to your account identifier.

If you lose your key

Turning it off and deleting the copy

• Settings → Sign out removes the key from that device and stops it backing up. Your data stays on the device. The encrypted copy on our server remains until you delete it.
• Settings → Delete my cloud account permanently deletes the row from our database. Nothing of yours remains on our server afterwards. This is immediate and cannot be undone.

09Optional integrations

Fixed can connect to services you already use, so that your own information appears alongside your schedule. Every integration is off until you turn it on, each is a separate decision, and none is required to use the app.

Canvas

We never ask for your Canvas username, your password, or an API access token. Instructure's own API Policy prohibits an app used by multiple people from asking them to generate access tokens, and we do not intend to hold student credentials under any circumstances.

Instead, Canvas gives every user a personal, read-only calendar feed link (in Canvas: Calendar → Calendar Feed). If you choose to connect Canvas, you paste that link into Fixed. It returns your assignments, their due dates, and your class events. It is read-only: Fixed cannot submit work, change grades, post, or alter anything in your Canvas account.

Where the link is kept. On your device. It is never included in your encrypted backup and never shared with anyone.

How the request is made. Canvas does not permit browsers to read the feed directly, so the request passes through a relay we run on Cloudflare. That relay fetches the feed and hands the text back to your device. It accepts only Canvas calendar-feed addresses, and it does not log or store the link or the calendar contents. We do not keep a copy of your assignments on our servers. The relay does keep a short-lived request count to stop abuse — see section 7 for exactly what that involves.

How to cut it off. Disconnect in Settings, which deletes the link from your device. You can also reset the feed inside Canvas, which invalidates the old link everywhere it has ever been used.

Nutrition file import

If you export a data file from a nutrition-tracking service and import it into Fixed, the file is read entirely on your device. It is never sent to any third party. If cloud backup is on, values you have saved into the app are included in the encrypted backup like the rest of your data. Because this is health-related information, it is also covered by our separate Consumer Health Data Privacy Policy.

Services governed by their own terms

When you connect a third-party service, your use of that service continues to be governed by that service's own terms and privacy policy. We do not control those services and are not responsible for how they handle your information on their side.

10Purchases and subscriptions

All purchases made through an Apple platform are processed by Apple, which is the seller of record. We never see or receive your payment card number, your billing address, or your Apple Account credentials. Apple provides us with anonymized, aggregated sales reporting, which does not identify individual customers.

Your subscription status is checked on your device against Apple's records. Manage or cancel your subscription in your device's Settings, or at apps.apple.com/account/subscriptions.

11Who we share data with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have never done so.

The only parties who receive any data in connection with the app are:

We require that any third party with whom the app shares user data provides the same or equal protection of that data as is stated in this policy.

We may also disclose information if we are legally compelled to do so by valid legal process, or where necessary to protect our rights or the safety of others. Given the architecture described above, what we could produce in response to such a request is an opaque identifier and a block of ciphertext we cannot decrypt.

12How long we keep data, and how to delete it

Data on your device

Data stored on your device is kept until you delete it. You have two ways to do so:

• Settings → Erase all data in the app, which permanently removes your habits, schedule, history, settings, and any imported data from the device.
• Deleting the app, which removes its storage container along with it.

Both are immediate and irreversible on that device.

Photos and scans can also be deleted one at a time, in the app, which removes the image itself and not merely its listing. Because they are never uploaded, deleting them on the device deletes them everywhere they exist.

Your encrypted backup

If cloud backup is on, the encrypted copy is kept until you delete it, because its entire purpose is to still be there when you need it. Each backup replaces the previous one, so we hold one copy, not a history.

Settings → Delete my cloud account deletes it permanently. Erasing data on your device or deleting the app does not delete the backup — that is deliberate, so that reinstalling on a new phone still works. If you want both gone, delete the cloud account first, then erase on-device data.

If an account is untouched for 24 months, we may delete the backup. We cannot notify you first, because we have no way to contact you.

Data held by others

Apple retains purchase records under its own policies. Data held by a service you connected is retained by that service under its own policy; disconnecting in Fixed revokes our access but does not delete your account with them.

Data held by us

If you email us, we keep that correspondence for as long as needed to handle your request and for a reasonable period afterwards, and no longer than two years unless a longer period is legally required. We do not add you to any mailing list.

13How to withdraw consent

Every transmission described in this policy is switched off by a control inside the app:

• Cloud backup: Settings → Sign out stops it. Settings → Delete my cloud account also erases the copy we hold.
• Canvas: Settings → Integrations → Disconnect, which deletes the feed link from your device. Resetting the feed inside Canvas revokes it everywhere.
• Everything: Settings → Erase all data, or delete the app.

Withdrawing consent does not affect processing that already took place, and it does not disable the rest of the app. Fixed is fully usable with every optional feature turned off.

14Do Not Track

California law requires us to state how we respond to "Do Not Track" signals. Fixed does not respond to Do Not Track signals, because it does not perform the tracking those signals are designed to stop. The app does not monitor your activity across other apps or websites, does not build an advertising profile, and contains no third-party advertising or analytics networks.

We also do not permit other parties to collect personally identifiable information about your online activities over time and across different sites or services through the app.

15Children

Fixed is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. You must be 13 or older to use the app, which the app asks you to confirm before you can use it. It is not submitted to the App Store Kids Category and is not designed for or marketed to children.

Because a student information integration could in principle be used by a younger student, we ask for your year of birth before that integration can be connected, and we use that answer only to determine eligibility, apply reasonable security to it, and delete it afterwards.

If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you are a parent or guardian and believe this has happened, contact us at the address in section 19. Because a backup is identified only by an opaque hash, we will need the sync key in order to identify and delete the corresponding backup.

16Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal information, to object to processing, and to withdraw consent.

For the data stored on your device, these rights are self-service and immediate. You hold the data. You can view all of it in the app, edit any of it, export it, and erase it, without asking us and without waiting for us. We think that is a better answer than a request form.

For your encrypted backup, the same is true. You can read it by pulling it into the app with your key, replace it by backing up again, and delete it outright from Settings. We cannot exercise these rights on your behalf even if you ask us to, because we cannot decrypt the backup and cannot identify which row is yours without your key.

For anything else described in this policy, or to ask a question about how we handle information, write to us at the address in section 19. We will respond within 45 days, and will tell you if we need longer.

If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your national data protection supervisory authority. Where we transfer personal data outside your region — for example, to Cloudflare in the United States — we rely on appropriate safeguards, including standard contractual clauses where applicable.

If you are in Washington State or Nevada, additional rights apply to health-related information. See our Consumer Health Data Privacy Policy.

We will not discriminate against you for exercising any of these rights.

17Security

We take reasonable measures appropriate to the nature of the data and the size of our operation:

• Your backup is encrypted on your device with AES-256-GCM before transmission, under a key we do not hold. A breach of our server exposes ciphertext and an opaque hash, not your data.
• We store no passwords, because the app has none. There are no credentials of yours for us to leak.
• Your sync key is held in its own storage slot on your device, is never placed in app state, and is never included in the backup payload.
• Authorization tokens for integrations are stored in the device Keychain, restricted to that device, and excluded from backups. They are never transmitted to us.
• All network requests use encrypted connections.
• With cloud backup off, your habits and history never leave your device at all, and are protected by your device's own encryption and passcode.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security. Keeping your device locked, updated, and under your control — and keeping your sync key somewhere safe and private — is an important part of protecting your information.

18Changes to this policy

If we make a material change to this policy, we will update the effective date at the top, and we will notify you inside the app before the change takes effect, with a summary of what changed. For changes that expand what data is transmitted or who receives it, we will ask for your consent again rather than assuming it.

Non-material changes — clarified wording, corrected typos, updated contact details — will be reflected by a revised "last updated" date.

The September 12, 2026 revision added cloud backup, which is a material change. It is off by default and requires you to switch it on, so no data of yours was transmitted under it before you chose to.

19Contact us

Questions, complaints, and requests about privacy can be sent to:

We aim to reply within five business days, and in any case within the timeframes required by applicable law.