Last updated: May 27, 2026
This policy applies to all Exabyte Systems products, apps, websites, and related services, including Timelok, DocuFile, exabyte.systems, and future Exabyte products unless a product-specific privacy notice says otherwise. It explains what information we handle, how we use it, when it may be shared, and what choices you have.
Some Exabyte products are local-first apps. For those products, including Timelok and DocuFile, the default design is that your private app content stays on your device unless you choose a platform feature such as iCloud sync, Android backup, or another device sync service, use an integration that requires processing by a provider, make a purchase, contact us, authenticate with a third-party account provider, or enable privacy-scrubbed diagnostics.
We may receive information you choose to provide, such as:
Please do not send sensitive secrets, passwords, private keys, access tokens, or confidential documents in support emails unless we specifically ask for them through a secure support process.
When you visit an Exabyte Systems website, our hosting and security providers may process standard technical information such as IP address, browser type, device type, operating system, referring page, requested URL, access time, and basic log data. We use this information to deliver the website, maintain security, diagnose outages, and understand aggregate traffic.
If we add forms, newsletters, accounts, or other website features, we will process the information needed to provide those features.
The exact product data we handle depends on the product and features you use. For local-first apps, product data is usually stored on your device using platform storage such as app databases, local files, UserDefaults, app group containers, local storage, secure storage, the Keychain, or equivalent operating system storage. Widgets and extensions receive only the display or state data they need to function.
For products that offer cloud sync, integrations, subscriptions, authentication, analytics, crash reporting, or support, some information may be processed by Apple, Google, Hanko, RevenueCat, Sentry, TelemetryDeck, hosting providers, email providers, model hosting providers, or other service providers as described below.
Timelok is an Exabyte Systems local-first productivity app for iPhone, iPad, Mac, Apple Watch, widgets, and related extensions.
Depending on which Timelok features you use, Timelok may store:
If you grant permission, Timelok reads from and writes to your Apple Calendar and Reminders using Apple's EventKit APIs. This lets Timelok show your schedule, create events, schedule tasks, create reminders, and manage alerts you request. Calendar and Reminders data stays in Apple's Calendar and Reminders stores; Exabyte Systems does not keep a separate server copy.
If you grant location permission, Timelok may use your current or selected location for location-based reminders, geofences, and travel-time features. Location data is used for the feature you request and is not sent to Timelok analytics.
If you use voice input, Timelok asks for microphone and speech-recognition permission. Audio is used to transcribe your speech into task text. Timelok does not send voice transcripts to analytics or crash-reporting services.
If you use Focus blocking, Timelok may store the apps and websites you choose to block. On iOS and iPadOS, blocking uses Apple's Screen Time frameworks. On macOS, blocking may use local system configuration, a local PAC proxy file, and a local block page server. Timelok does not collect your browsing history.
DocuFile is an Exabyte Systems local-first document management and search app for supported desktop and mobile platforms.
Depending on which DocuFile features you use, DocuFile may store:
When you import a document, DocuFile may validate the file, extract text, perform OCR, generate summaries, extract metadata, suggest tags, generate embeddings, detect duplicates, and index the document for search. These features are designed to run on your device. DocuFile does not need to send your documents, extracted text, OCR output, embeddings, summaries, tags, or search queries to Exabyte Systems servers for these local features.
DocuFile may use local OCR and machine-learning components such as Apple Vision, PaddleOCR, ONNX Runtime, FastEmbed, or bundled/local model files. If a version needs to download a model file before local processing can run, the model or package hosting provider may receive ordinary technical download information, such as IP address and request metadata, but your document content does not need to be uploaded to download a model.
DocuFile may use Hanko for authentication. If you create or use an account, Hanko may process information needed for sign-in, such as email address, passkeys or other authentication factors, session cookies or tokens, authentication events, and related technical data. Hanko's processing is governed by Hanko's own terms and privacy policy.
DocuFile may offer optional iCloud sync for paid or Pro features. In local-only mode, DocuFile data stays on the device unless you export it, share it, back up the device, or use an Apple system service that syncs it.
If you enable DocuFile iCloud sync, Apple may sync DocuFile data through your Apple iCloud account. Depending on the version and settings, this may include document metadata, extracted text, summaries, tags, views, embeddings, file hashes, iCloud file paths, file sizes, timestamps, entitlement records, and original files stored in iCloud Drive. Local search indexes such as Tantivy or HNSW are device-local accelerators and may be rebuilt from synced metadata.
Exabyte Systems does not operate iCloud servers and does not receive your Apple ID credentials. Apple's iCloud, CloudKit, iCloud Drive, and Advanced Data Protection behavior is governed by Apple's terms and privacy policy.
If you purchase a subscription, lifetime unlock, trial, or other paid feature, Apple through StoreKit, Google through Google Play Billing, RevenueCat, or another purchase provider may process purchase and subscription data such as receipt information, product identifiers, subscription status, entitlement state, transaction identifiers, expiration dates, refund status, and technical information needed to validate access. Exabyte Systems does not receive your full Apple ID, Google account, or payment-card details from Apple or Google.
Some products may use diagnostics and product analytics to find crashes, measure reliability, and understand broad feature usage. Timelok uses Sentry for crash and performance monitoring and TelemetryDeck for privacy-preserving analytics when those services are configured.
Before Timelok diagnostic data is sent, Timelok is configured to remove or avoid:
TelemetryDeck uses a per-install salted identifier rather than your name or email address. Sentry is configured without default personally identifying user profiles.
DocuFile is designed without third-party advertising SDKs or analytics. Unless a DocuFile version clearly discloses otherwise, DocuFile does not send document titles, filenames, file paths, document text, OCR output, embeddings, summaries, tags, account email, or user-entered search text to Exabyte-operated analytics or crash-reporting services.
Timelok AI features are designed to use Apple Intelligence or local rule-based logic on supported devices. Timelok does not send task text, notes, routines, calendar content, or AI input/output to cloud LLM providers. If a Timelok AI feature is not available on your device, the feature may be unavailable or use a clearly labeled local fallback.
DocuFile's AI-assisted document features are designed for local processing. DocuFile may use local models or local inference libraries to extract text, perform OCR, create embeddings, generate summaries, suggest tags, classify documents, and search semantically. DocuFile does not use imported documents or extracted document text for advertising, and local DocuFile AI features do not require sending private document content to cloud LLM providers.
If a future Exabyte Systems product or future product feature uses an external AI provider for private user content, we will disclose that processing in that product's notice or interface before sending private user content to that provider.
We use information to:
Some Exabyte Systems products may offer local-only use and optional iCloud sync. In local-only mode, product data stays on the device unless you export it, share it, back up the device, or use a platform service that syncs it.
If you enable iCloud sync, app data syncs through your Apple iCloud account using Apple services such as iCloud, CloudKit, or iCloud Drive. Apple provides the iCloud infrastructure and handles that data under Apple's terms and privacy policy. Exabyte Systems does not operate the iCloud servers and does not receive your Apple ID credentials.
For privacy-sensitive users, Apple's Advanced Data Protection may provide additional protection for supported iCloud categories. Exabyte Systems cannot enable Advanced Data Protection for you.
Future Exabyte products may also be distributed on Google Play or use Android and Google platform services such as Google Play Billing, Google Play services, Google account features, Android backups, or device-level sync where available. Google provides those platform services and handles related information under Google's terms and privacy policy.
We share information only in limited situations:
We do not sell personal information and do not share personal information for cross-context behavioral advertising.
Provider policies:
Exabyte Systems websites may use cookies or similar technologies that are necessary to operate the site, remember choices, prevent abuse, or understand aggregate website traffic. Products that use authentication providers such as Hanko may also use cookies, local storage, or similar technologies to maintain sessions and protect accounts.
We do not use third-party advertising cookies for cross-site tracking unless a future website feature clearly discloses that choice and any required consent controls.
Local product data remains on your device until you edit it, delete it, delete the app, erase the device, or use in-app delete controls. Timelok keeps time entry history until you delete it so insights and planned-vs-actual summaries remain useful. DocuFile keeps imported documents, extracted text, metadata, embeddings, local indexes, and related organization data until you delete them or remove the app data.
iCloud-synced data follows Apple's iCloud, CloudKit, and iCloud Drive retention behavior. Google or Android platform data follows Google's retention behavior for the relevant service. Purchase records are retained by Apple, Google, RevenueCat, or other purchase providers according to their own legal, fraud-prevention, tax, and subscription-management requirements. Authentication records are retained by the authentication provider according to that provider's policy. Diagnostics, analytics, website logs, and support messages are retained only as long as reasonably needed for the purposes described in this policy, unless a longer period is required by law or needed for security, dispute resolution, or abuse prevention.
Some Exabyte Systems products include export and delete controls. Timelok's Settings include data controls for app data. Timelok export creates a portable JSON file containing app data such as tasks, projects, time entries, settings, and export metadata.
Timelok's Delete All User Data removes local Timelok records, resets settings, clears the Timelok Keychain namespace, removes local telemetry identity defaults, removes App Group defaults, and deletes extension/widget cache files when available.
Important Timelok limitation: in this version, Timelok's delete flow does not yet purge the CloudKit zone server-side. If you used iCloud sync, an iCloud copy may remain under your Apple account until removed through Apple iCloud storage controls or until Timelok ships server-side CloudKit zone purge support. You can also disable iCloud sync to stop further uploads.
DocuFile may provide controls to delete documents, remove documents from views, download or export original files, and purge corrupted local records. Deleting a DocuFile document removes the local app record and related local indexes for that document. If the document was synced to iCloud Drive or CloudKit, copies may remain under your Apple account according to Apple's retention and sync behavior unless the app version you use also deletes the corresponding iCloud items or you remove them through Apple's iCloud controls.
For information we process outside an app, such as support emails, account authentication records, purchase records, or website logs, contact us to request access, correction, export, or deletion where required by applicable law. For information handled by Apple, Google, Hanko, RevenueCat, Sentry, TelemetryDeck, model hosting providers, or your email provider, you may need to use that provider's privacy tools as well.
We use technical and organizational safeguards appropriate to the type of information we handle. Timelok uses Apple platform protections such as the app sandbox, file protection, Keychain storage, local authentication, App Group boundaries, and permission prompts. Sensitive telemetry is scrubbed before transmission. Cryptographic code in Timelok uses reviewed Apple and RustCrypto primitives.
DocuFile uses local app storage, Tauri platform permissions, file validation, path sanitization, file type checks, duplicate-detection hashes, and local database/search indexes to process documents. DocuFile's local-first design reduces the need to upload private document content to Exabyte Systems servers for document search and enrichment.
No website or app can promise perfect security. If you believe you found a privacy or security issue, please report it privately.
Our websites and products are not directed to children under 13 or the equivalent minimum age in your jurisdiction. We do not knowingly collect personal information from children for Exabyte Systems-operated services.
Exabyte Systems uses providers that may process information in the United States, the European Union, and other countries where they or their service providers operate. Their processing is governed by their own privacy policies and applicable legal safeguards.
Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing of personal information. Some products provide in-app export and delete controls for data we can control directly. For information handled by Apple, Google, Hanko, RevenueCat, Sentry, TelemetryDeck, model hosting providers, or your email provider, you may need to use that provider's privacy tools as well.
You can control app permissions in system settings, including Calendar, Reminders, Location, Microphone, Speech Recognition, Notifications, Screen Time/Family Controls, iCloud, iCloud Drive, Android permissions, Google Play services, local files and folders, and other platform permissions supported by your device.
We may update this policy when our products, providers, website features, or legal requirements change. If a change materially affects how we handle your data, we will make reasonable efforts to make the update clear in the relevant product, website, release notes, or this document.
For privacy questions, data requests, or security reports, contact:
Please do not send sensitive account secrets, private keys, access tokens, or confidential documents in plain text.