Introduction
GoTime (also known as "HaoLeMe" or "好了么") is a social accountability countdown application developed and operated by Shixi Chen, an individual developer (referred to as "we," "us," or "our" in this policy). We are committed to protecting your privacy and handling your personal information responsibly and transparently.
This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the GoTime mobile application and associated website (haoleme.me). Please read this policy carefully before using our services. By using GoTime, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use our services.
Privacy at a glance:
- We only collect information necessary to provide and improve our services
- We do not sell your personal information to any third party
- We do not use your data for AI model training
- Application records and avatar files are stored on our privately operated Home Lab server; authentication and diagnostics use the service providers listed below
- You can view, correct, export, or delete your personal information at any time
- You can delete your account at any time, and we will permanently erase your data
- California residents have additional rights under the CCPA/CPRA
1. Information We Collect
We collect only the minimum information necessary to provide, maintain, and improve our services. Below is a detailed breakdown of each category of information, the purpose for collection, and whether it is required or optional.
Account Registration and Authentication
| Information | Purpose | Required |
|---|---|---|
| Email address | Email-based authentication via one-time passcode (via Clerk) | Yes (if choosing email login) |
| Apple ID identifier | Sign in with Apple authentication (via Clerk) | Yes (if choosing Apple login) |
| Google account identifier | Google OAuth sign-in (via Clerk) | Yes (if choosing Google login) |
GoTime supports three login methods: (1) email verification via one-time passcode; (2) Sign in with Apple; and (3) Google Sign-In. You only need to use one. All authentication is handled by our identity provider, Clerk. When using Sign in with Apple or Google, you will be directed to the respective provider's login interface. We never receive your password — only the unique user identifier each provider supplies. GoTime's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only access your basic Google account identifier for authentication purposes and do not access, store, or share any other Google user data. See Apple's privacy policy and Google's privacy policy.
Profile Information
| Information | Purpose | Required |
|---|---|---|
| Display name | Shown to friends within the app | Yes (for profile setup) |
| Username | Unique identifier for friend search and discovery | Yes (auto-generated, editable) |
| Avatar photo | Profile image shown to friends | Optional |
| Bio | Personal profile display | Optional |
| Birthday | Personal profile display | Optional |
| Gender | Personal profile display | Optional |
| Region | Personal profile display | Optional |
A display name and username are required during profile setup. All other profile information is optional. You can leave optional fields blank or use system defaults without affecting core app functionality. If you upload an avatar, we use Apple's built-in PhotosPicker so you select an image directly from your photo library; we do not request raw camera access and we receive only the image you choose.
Countdowns and Social Interaction Data
| Information | Purpose | Required |
|---|---|---|
| Friend connections | Establishing social connections for accountability features | Yes (for social features) |
| Countdown records | Creating, managing, and displaying countdown tasks | Yes |
| Interaction data (nudges, alarm mode, etc.) | Social interaction features between friends | Yes (for social features) |
Countdowns are private to the connected participants by default. The creator can optionally enable a read-only public link, as described under “User-directed sharing” below. Alarm mode requires explicit authorization from the friend before it can be used.
Push Notification Data
| Information | Purpose | Required |
|---|---|---|
| Device push token | Delivering countdown reminders and friend interaction notifications via Apple Push Notification service (APNs) | Yes (if notifications enabled) |
| Device platform and name | Ensuring notification compatibility and delivery | Yes (if notifications enabled) |
| Timezone | Ensuring countdown reminders arrive at the correct local time | Yes |
Push notifications are optional. You can disable them at any time in your iOS Settings without affecting other features.
Achievement and Statistics Data
To provide badges, medal progress, friendship goals, and statistics, we record your task completion history and streak data derived from your countdown activity. We also store your selected earned cosmetic rewards, such as an avatar decoration, timer appearance, completion effect, or app icon, so your preferences can be restored. These features do not require additional profile details or access to your address book.
Invitations and invitation rewards
When you use an invitation link, we store an opaque invitation code and, if a qualifying new account claims it, the inviter/invitee account relationship, claim time, and resulting invitation rewards. This lets us award both people once and prevent self-invitations or duplicate claims. It is used for app functionality, not advertising or cross-app tracking. Completing an eligible new profile and claiming an invitation within 48 hours of registration is optional; the app remains usable without a referral.
Service Logs
To maintain the security and reliability of our services, we collect standard server logs (e.g., access timestamps, request types, error logs, and internal user identifiers). User identifiers in logs are system-generated UUIDs and do not contain your name, email, or other directly identifying information. Logs are retained for no more than 180 days.
Optional First-Party Product Analytics
After you opt in through the app, GoTime may record a limited set of product events to understand whether core features work and where people need help: onboarding_completed, friend_invite_started, friend_request_sent, first_friend_added, countdown_created, countdown_accepted, countdown_completed, alarm_permission_granted, and alarm_friend_allowed.
Each event contains only the event name, timestamp, and your internal pseudonymous GoTime user UUID. We do not include countdown text, friend names, email addresses, advertising identifiers, or precise location. These events are written to our own structured server logs on our privately operated Home Lab server; we do not use a third-party analytics SDK or share them with third parties for analytics, advertising, or tracking.
You can decline or later withdraw analytics consent through the in-app analytics control without losing core features. Collection stops after consent is withdrawn. We can also disable collection remotely for all users without requiring an app update. Product analytics logs are retained for no more than 180 days.
2. How We Use Your Information
We use the information we collect for the following purposes:
- Service operation: To create and maintain your account, provide countdown and social accountability features, manage friend connections, and deliver the core app experience
- Authentication: To verify your identity when you register, log in, or perform account-sensitive actions via email one-time passcode, Sign in with Apple, or Google Sign-In (all managed through Clerk)
- Notifications: To send you countdown reminders, friend interaction alerts, and achievement notifications through Apple Push Notification service (APNs)
- Gamification: To calculate and display achievement badges, streaks, and statistics based on your countdown activity
- Product improvement, with your consent: To measure completion of a small set of core setup, friend, countdown, and alarm-permission steps so we can identify reliability or usability problems
- Security and integrity: To detect, prevent, and respond to fraud, abuse, security incidents, and technical issues
- Compliance: To comply with applicable legal obligations
We do not use your information for advertising, behavioral profiling, or AI/ML model training. We do not engage in automated decision-making that produces legal or similarly significant effects on you.
3. How We Share Your Information
User-directed sharing
Ordinary in-app social interactions share relevant information (such as your display name, avatar, countdown status, and interaction data) with the friends you have connected with. Public sharing is a separate, optional action; a countdown is not made public merely by creating or completing it.
If the countdown creator chooses “Share read-only link,” we create an unguessable link that lets anyone who has it view the countdown title, start time, end time, and current status in a browser without an account. It does not show participant names, account identifiers, avatars, private notes, or interaction history. The link expires after seven days, and the creator can revoke it with “Close sharing.” It also becomes unavailable if a participant deletes their account, the participants block one another, or the creator hides the countdown. A recipient of the link may forward it, so share it only with people you intend to have access; avoid putting sensitive information in a publicly shared title.
If you choose to share a completion poster, the app renders the countdown title, duration, and result on your device and opens the iOS share sheet. The poster omits participant identities and private notes, and does not enable a public link. Invitation and profile links can also be shared through the system share sheet. The service you select processes anything you send under its own privacy policy. Revoking a countdown link cannot remove an image or copy that someone has already saved or reposted.
Service providers
We use the following third-party service providers to operate GoTime. Each provider only receives the minimum data necessary to perform its specific function, and is contractually obligated to protect your information.
Our optional product analytics are first-party and remain in our own server logs. We do not provide these events to a third-party analytics or advertising provider.
| Provider | Service | Data Shared |
|---|---|---|
| Clerk | Authentication (email OTP, Apple Sign-In, Google OAuth), session and token management. Clerk processes data using its own sub-processors including Google Cloud Platform, Cloudflare, and Postmark. See Clerk's sub-processor list | Email address, Apple user identifier, Google account identifier |
| Developer-operated Home Lab infrastructure | Application API, database, and self-hosted MinIO object storage | Account and social application records, selected avatar files, reward preferences, and first-party service logs |
| Cloudflare | Secure network delivery and protection for public service endpoints through our Home Lab tunnel. See Cloudflare's privacy policy | Traffic necessary to deliver requests, including IP address, request metadata, and the data sent through the endpoint. This is used for network delivery and security, not cross-app advertising or tracking |
| Apple | Push notifications (APNs) and Sign in with Apple (SIWA) | Device push token, Apple user identifier |
| OAuth sign-in provider | Google account identifier | |
| Sentry | Crash and error reporting for the iOS app and backend. Sentry is configured with send-default-pii: false. The iOS app does not attach an account identifier, screenshots, view hierarchy, or performance traces. Backend error reports can include a stable account-derived reference and request ID to investigate account-specific failures; these server diagnostics are therefore linked to an account. Backend performance tracing is disabled. See Sentry's privacy policy | iOS diagnostic events (stack traces, error messages, app version, OS version, device model) without an account UUID; server error diagnostics with a SHA-256-derived account reference and request ID. We do not intentionally send your name or email |
Legal requirements
We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request.
Business transfers
If GoTime is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via in-app notification before your information becomes subject to a different privacy policy.
We do not sell, rent, or trade your personal information to any third party for marketing, advertising, or any other purpose.
4. Data Storage and Retention
Storage location
Primary account and social application records, avatar files, and first-party logs are stored on our privately operated Home Lab server, including its database and MinIO object storage. MinIO provides an S3-compatible interface; this does not mean those files are hosted by Amazon Web Services. Authentication data processed by Clerk uses Clerk's infrastructure (including Google Cloud Platform in the United States); see Clerk's privacy policy. Apple, Google, and Sentry process the limited information described above on their own infrastructure. Using the service may therefore involve transferring data to the countries in which these providers operate. We use HTTPS/TLS and restrict access to the application data.
Retention periods
We retain your data for the following periods. After the applicable retention period, data is deleted or anonymized.
- Account information (email, Apple ID identifier, Google account identifier): Retained while your account is active. Upon account deletion, all personal data is permanently erased within 30 days, including account information, profile data, social interaction data, device tokens, and all tokens associated with Apple Sign-In (we will call Apple's token revocation endpoint). This action is irreversible
- Profile data (display name, avatar, bio, birthday, optional gender and region): Retained while your account is active; deleted within 30 days upon account deletion. Avatar files are removed from cloud storage
- Social interaction data (countdowns, friend connections, achievements, invitation attribution, and reward preferences): Retained while your account is active; deleted within 30 days upon account deletion
- Public countdown links: Valid for seven days unless revoked sooner. Expiry or revocation prevents further access through our service; it does not delete the underlying private countdown or copies saved outside the app
- Device push tokens: Retained while your account is active; deleted within 30 days upon account deletion
- Email verification codes: Expire automatically after 10 minutes or upon successful verification, whichever comes first
- Service logs: Retained for no more than 180 days for security and debugging purposes. Logs do not contain directly identifying personal information
- Optional first-party product analytics: Retained for no more than 180 days. Collection stops when you withdraw consent or when we remotely disable analytics
5. Security
We implement industry-standard technical and organizational measures to protect your personal information:
- Encryption in transit: All data transmitted between the app and our servers is encrypted using HTTPS/TLS
- Encryption at rest: Sensitive information (such as authentication tokens and identifiers) is encrypted using AES-256-GCM before storage. Encryption keys are managed through secure key management practices
- Access controls: Strict role-based access controls and authentication mechanisms prevent unauthorized access to your data
- Data isolation: Each user's data is logically isolated from other users
- Security monitoring: We perform regular security reviews of our systems and data processing activities
While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. In the event of a data breach affecting your personal information, we will notify you within 30 days of discovery and will notify the California Attorney General as required by California law (Cal. Civ. Code section 1798.82).
6. Your Privacy Rights
Rights available to all users
Regardless of where you live, you have the following rights regarding your personal information:
- Access: You can view your profile, countdown records, friend connections, and achievement data at any time within the app. You may also request a copy of your personal information, and we will respond within 45 days
- Correction: You can update your profile information at any time within the app. If you believe other information we hold about you is inaccurate, you may request that we correct it
- Deletion: You can delete your account at any time from within the app. Upon deletion, all your personal data will be permanently erased, including your profile, friend connections, countdown records, achievements, avatar files, and all tokens associated with Apple Sign-In (we will call Apple's token revocation endpoint). This action is irreversible.
- Withdraw consent: You can withdraw consent at any time by:
- Disabling push notifications in your iOS Settings
- Revoking photo library access in your iOS Settings
- Contacting us to withdraw consent for specific data processing activities
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
- Data portability: You may request a copy of your personal information in a structured, commonly used, machine-readable format
Additional rights for California residents (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with the following additional rights:
- Right to know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it
- Right to delete: You have the right to request that we delete the personal information we have collected from you, subject to certain exceptions provided by law
- Right to correct: You have the right to request that we correct inaccurate personal information that we maintain about you
- Right to opt-out of sale or sharing: You have the right to opt out of the "sale" or "sharing" of your personal information. However, GoTime does not sell or share your personal information as those terms are defined under the CCPA/CPRA, so there is no need to opt out
- Right to limit use of sensitive personal information: You have the right to direct us to limit our use of your sensitive personal information to only what is necessary to provide our services. GoTime only uses sensitive personal information (such as your account login credentials) for the purpose of providing and securing our services, so no further limitation is needed
- Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you our services, charge you different prices, provide a different quality of service, or retaliate against you in any way for exercising your rights
Response timeline: We will acknowledge your request within 10 business days and respond substantively within 45 days of receiving your verifiable request. If we need additional time (up to 45 more days), we will inform you in writing of the reason and the extension period.
How to submit a request: You can exercise your CCPA/CPRA rights by emailing us at support@haoleme.me. We will verify your identity before processing your request by matching information you provide with information we have on file.
Authorized agents: You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization and may still verify your identity directly.
7. Children's Privacy
GoTime is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13, in compliance with the Children's Online Privacy Protection Act (COPPA).
If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete that information as quickly as possible. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at support@haoleme.me so we can take appropriate action.
8. Do Not Sell or Share My Personal Information
GoTime does not sell your personal information. We have not sold personal information in the preceding 12 months and have no plans to do so.
We also do not "share" your personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
We do not use or disclose "sensitive personal information" for purposes other than those permitted under the CCPA/CPRA (i.e., we only use it to provide and improve our services).
9. Cookies and Tracking Technologies
GoTime is a native mobile application and does not use browser cookies. Our website (haoleme.me) serves information, app links, and optional read-only shared countdowns. We do not use website advertising cookies, analytics cookies, or similar tracking technologies to profile you. Network providers process the request data described above to deliver and protect these pages. We recognize and honor Global Privacy Control (GPC) opt-out preference signals. Because we do not sell or share your personal information as defined by the CCPA/CPRA, a GPC signal will not result in any change to your experience, as there is no sale or sharing to opt out of. We do not engage in online tracking.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. The updated policy will be posted on this page with a revised "Last updated" date.
For material changes — including but not limited to expansion of data collection, changes in purpose of use, or addition of new third-party service providers — we will notify you via in-app notification before the changes take effect and, where required by law, obtain your consent.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
11. Governing Law
This Privacy Policy and any disputes arising from or related to it shall be governed by the laws of the State of California, United States, without regard to its conflict of law provisions. Any legal action or proceeding relating to this Privacy Policy shall be brought exclusively in the state or federal courts located in Los Angeles County, California.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:
- Developer: Shixi Chen (individual developer)
- Address: Los Angeles, CA, United States
- Email:support@haoleme.me
- Report abuse or objectionable content:support@haoleme.me with the subject line "Content Report"
- CCPA/CPRA requests: California residents may submit data access, deletion, correction, or opt-out requests by emailing support@haoleme.me with the subject line "CCPA Request"
- Response time: We will respond to all privacy-related inquiries within 45 days