Privacy Policy

The Command Center is a planning app for tasks, goals and projects. We store what you put into it so we can show it back to you on your devices and to the people you choose to share with. We do not sell your data, we do not show ads, we do not track you across other apps or websites, and no AI system reads your content.

The Command Center, on the web at cc.lemonstone.ai and as an iPhone app, is run by Lemonstone AI FZ-LLC, a company registered in Ras Al Khaimah, United Arab Emirates. We are the controller of the personal data described here. You can reach us at support@lemonstone.ai.

• Your account. Your first and last name, your email address and your password. The password is stored only in hashed form by our sign-in provider. We never see it.
• Your content. The tasks, goals, projects, habits, categories, notes, dates and reminders you create, including the description you write for a project.
• Your settings. Your theme, your timezone, your color and which notifications you have switched on.
• Calendar connections, if you add one. When you connect a Google or Microsoft calendar we store the email address of that calendar account, which calendars you chose to show, and the access tokens that let the app reach them. The tokens are encrypted before they are saved. Your calendar events are read live when you open the app and are not stored on our servers.
• Notification addresses. A push token is the address Apple or your browser gives us so a message can reach one device. For a browser we store one only if you allow notifications there. For the iPhone app we store one while you are signed in, so the app can quietly keep itself up to date in the background and is ready the moment you open it. We use it to show you something only when you turn notifications on for that phone. We remove it when you sign out and when you delete your account. If the phone cannot reach us at that moment, the token stops working and is cleared automatically once Apple tells us it is no longer valid.
• Technical logs. Like every website, our hosting provider records your IP address, browser type and the time of each request for a short period, for security and troubleshooting.

• Face ID and Touch ID. The iPhone app asks iOS to confirm it is you. We never receive or store any biometric data.
• The iPhone app keeps a copy of your recent tasks on the phone so it works offline and so the Home Screen widget can show them. Logging out or deleting the app removes it.
• The website uses one sign-in cookie to keep you logged in, and your browser remembers your theme. There are no advertising or analytics cookies.

We use your data for one purpose, which is to run the app for you. That means signing you in, showing and syncing your content across your devices, keeping the iPhone app up to date in the background so it is ready when you open it, sending the reminders you asked for, showing your calendar next to your tasks, keeping the service secure, and answering you when you write to us. For people in the EU, EEA and UK the legal bases are our contract with you, our legitimate interest in keeping the service secure, and your consent for notifications and calendar connections, which you can withdraw at any time in the app.

Your content is private to you by default. Other people see it only when you decide so.

• Members who can edit a shared category see everything inside it. They also see the names of the other members who can edit it, and of the view only members they are connected to. Someone who was given view only access sees only the tasks, goals, projects and habits of the people who shared it with them, plus the ones marked Shared.
• A person you connect with can see your name and email address, as you can see theirs, and can view the categories you choose to share with them. They cannot edit them.
• A person you connect with can also see your calendar and your timezone, even when you share no category with them. You can hide any of your calendars from them.

We use a small number of providers to run the service. Each one only receives what it needs for its part.

• Supabase hosts our database and sign-in system. The data is stored in the EU (Ireland).
• Vercel hosts the website and its servers.
• Resend delivers account emails, such as the confirmation and password reset emails.
• Apple delivers notifications to the iPhone app. Your browser maker (Apple, Google or Mozilla) delivers them to the website. The notification text passes through them.
• Google or Microsoft, only if you connect a calendar. The app reads your events and adds, changes or removes an event only when you ask it to.

The app's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to show and manage your calendar inside the app. It is never used for advertising and never shared.

Some of these providers operate outside your country, including in the United States, and our company is in the United Arab Emirates. Where the law requires it, transfers are covered by standard contractual clauses or an equivalent safeguard. We may also disclose data when the law requires us to.

We keep your data for as long as you have an account. You can delete the account yourself at any time, from Settings, Account on the website or from Settings in the iPhone app. Deletion is immediate and cannot be undone. It removes your profile, your own categories and everything in them, your calendar connections, your notification addresses and your login.

One thing stays. Content you added to a category you share with other people remains with that group, without your account attached, so their shared work does not disappear with you. If you want it gone, delete it before you delete your account.

Encrypted backups are overwritten within 30 days.

You can see and correct your data in the app, and you can delete your account there. You can also write to us to ask for a copy of your data, to have it corrected or deleted, or to object to how we use it. We answer within 30 days. If you live in the EU, EEA or UK you also have the right to complain to your local data protection authority.

The Command Center is not meant for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will remove it.

When we change this policy we update the date at the top. If a change is significant we tell you by email or in the app before it takes effect.

Questions about privacy go to support@lemonstone.ai.