Effective date: August 1, 2026 Last updated: 6 July 2026
TimeCart ("TimeCart", "we", "us") is operated by Javed Mohammed, an individual (the "Operator"). This policy explains what personal data we collect through the TimeCart mobile application and related services (the "Service"), why we collect it, who we share it with, and the rights you have over it.
Contact for all privacy matters: javed.moma@gmail.com
If you do not agree with this policy, do not use the Service.
We only collect what the Service needs to work. We collect no data for advertising, and we do not sell or rent personal data — to anyone, ever.
| Data | Required? | Why we collect it |
|---|---|---|
| Email address | Required | Account creation, sign-in, account notices |
| Password | Required | Authentication (stored encrypted by our auth provider; we never see it) |
| Full name | Required | Your identity on your profile and in matches |
| Profile photo | Optional | Shown on your profile |
| Profile description, skills, experience, interests, certifications, portfolio, social links | Optional | Help counterparts evaluate a match |
| Phone number | Optional | Shared with a counterpart only after you both engage a match |
| Location (free-text and/or map coordinates) | Required for requests; optional for profile | Matching you with nearby requests |
| Service requests (category, service type, timeline, budget, details, tags) | Required to post a request | The core marketplace function |
| Photos and videos attached to requests | Optional | Illustrate your request |
| Voice recordings (when you dictate a request) | Optional | Converted to text to create your request (see §3) |
| Chat messages and attachments | When you use chat | Communication between matched users |
| Reviews and ratings you write or receive, and public replies | When you use reviews | Reputation within the marketplace |
| Reports and blocks (reason, details) | When you report or block | Safety and moderation |
| Data | Why |
|---|---|
| Push notification tokens (Expo push token; on iOS also an Apple VoIP push token) | Delivering notifications and incoming-call alerts to your device |
| Device platform (iOS/Android) and app version | Compatibility and support |
| Usage signals on matches (when a match is shown to you, viewed, accepted, rejected, passed, messaged, or called), with timestamps | Improving match quality and ranking |
| A numeric representation ("embedding") of your request text | Finding requests with similar meaning during matching. Generated on our own server; not sent to any third party |
| Call activity records (that a call happened, with whom, when, duration) | Your call history in the app. We never record or store call audio or video. |
The app asks for these permissions, each only when you use the related feature. All are optional — denying them disables only that feature.
We share personal data only with the processors below, only as needed to run the Service. Each receives the minimum necessary.
| Provider | Purpose | What they process |
|---|---|---|
| Supabase (hosted infrastructure) | Authentication, database, file storage | Account data, all app content (profiles, requests, messages, media) |
| Anthropic | AI understanding of your request | The text of the request you type or dictate, to extract structured details (category, timeline, etc.) |
| OpenAI | Voice-to-text | Your voice recording when you dictate a request, converted to text |
| OpenStreetMap / Nominatim | Geocoding and map tiles | The location text you enter (converted to map coordinates); map tile requests |
| Apple Push Notification service | iOS notifications and call alerts | Your device push tokens |
| Expo | Push notification delivery | Your device push token and notification content |
| Telegram (internal admin alerts) | Alerting our moderation team to abuse reports | Internal account IDs and the text of abuse reports (no names or emails) |
Calls are connected device-to-device using WebRTC; when a direct connection is impossible, encrypted call traffic is relayed through our own server, which does not store it.
We do not permit any provider to use your data for their own purposes, including AI model training, where a contractual or configuration option to prevent it exists.
International transfers: our servers and providers may process data in the United States, the European Union, or India. Wherever it is processed, this policy applies.
Wherever you live, you can:
We answer all requests within 30 days, and we never discriminate against you for exercising a right. Region-specific rights follow.
We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information beyond what is necessary to provide the Service. California residents may exercise the rights in §5 (right to know, delete, correct) by email; we will verify your identity via your account email. You may use an authorized agent. Categories collected are listed in §1; purposes in §1 and §3; recipients in §3. We do not knowingly collect data of anyone under 18 (§7).
The Operator is accountable for personal information under our control and is the designated Privacy Officer (javed.moma@gmail.com). We collect, use, and disclose personal information only with your consent and for the purposes stated here; you may withdraw consent at any time, subject to legal or contractual restrictions (withdrawing required data means closing your account). You may request access to, and correction of, your personal information. Complaints may be directed to us and to the Office of the Privacy Commissioner of Canada. Quebec residents: you may also request cessation of dissemination (de-indexing) where the law provides; complaints may go to the Commission d'accès à l'information.
The Operator is the Data Fiduciary. We process your personal data on the basis of the consent you give at sign-up, for the purposes in §1 and §3 only. You have the right to: access a summary of your personal data and the processing activities; correction, completion, updating, and erasure; grievance redressal; and to nominate another individual to exercise your rights in the event of death or incapacity. You may withdraw consent at any time (withdrawal of required data means account closure); withdrawal does not affect prior lawful processing.
Grievance Officer (also serving under the Information Technology Rules, 2021): Name: Javed Mohammed Email: javed.moma@gmail.com Grievances are acknowledged within 24 hours and resolved within 15 days.
If unsatisfied, you may approach the Data Protection Board of India.
Passwords are handled by our authentication provider and never visible to us. Data in transit is encrypted (TLS). Access to production systems is restricted to the Operator. Secrets are stored in a managed vault. No system is perfectly secure; if a breach affects your data we will notify you and the applicable regulator as the law requires (e.g., PIPEDA breach reporting, DPDP Board notification).
The Service is for adults. You must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18; if we learn we have, we will delete the account. Parents/guardians: contact javed.moma@gmail.com.
We will post changes here and update the date above. For material changes we will notify you in-app or by email before they take effect. Continued use after the effective date means acceptance.
Javed Mohammed — Operator, Privacy Officer (Canada), Grievance Officer (India) Email: javed.moma@gmail.com Granville Ct, Atlanta, GA 30328, USA