SolidHoursBack to the site

Privacy

Last updated 26 July 2026

Solid Hours is a personal planning app. This page explains what happens to your information, in plain language.

There are two quite different ways to use it, and the answer depends on which one you chose.

If you run it yourself

Solid Hours is self-hosted software. When you run it on your own machine or your own server, your data is written to a single SQLite file on that machine and nothing is sent anywhere. There is no account with us, no sync service, and no telemetry of any kind — the app does not phone home, and there is nothing for us to see even if we wanted to.

The only outbound connections the software makes are the ones you switch on yourself: fetching a calendar feed you subscribed to, sending a sign-in email through a provider whose key you supplied, or calling an AI provider with a key you supplied.

If you use app.solidhours.com

app.solidhours.com is an instance operated by the maintainer of Solid Hours on a rented server in Europe. If you use it, your data sits in a database on that server rather than on your own machine, and the maintainer is responsible for it.

That instance is currently run for a small number of invited people. It is not open registration.

What the hosted instance stores

  • Your email address, name and profile picture, if your sign-in provider supplies them.
  • Everything you put into the app: tasks, projects, ideas, notes and their images, habits, journal entries, and your focus and time-tracking records.
  • Calendar events pulled from any calendar feed you subscribe to, along with the address of that feed, which is encrypted before it is stored.
  • Sign-in sessions, held as a hash rather than a usable token, and a record of which push notifications were sent so the same one is not repeated.

Who else is involved

The hosted instance depends on a few outside services. Each one is listed with the only thing it actually receives:

  • Cloudflare — routes traffic to the server and terminates HTTPS, so it handles your requests in transit.
  • Brevo — sends sign-in emails. It receives the address the email goes to, and nothing from inside the app.
  • Anthropic — powers the optional assistant, briefing and coaching features. It receives only the text needed to answer the specific request you made, and only when you use one of those features. It is not used for anything else, and your data is not used to train models.
  • Google and Apple — only if you choose to sign in with them, and only to confirm your email address. Neither is given access to anything in the app.
  • Your browser's push service (Apple, Google or Mozilla, depending on your device) — delivers reminder notifications if you turn them on.

What does not happen

  • No analytics, no tracking pixels, no advertising, and no third-party scripts — on this website or in the app.
  • Your data is never sold, rented or shared for marketing.
  • Your data is never used to train AI models.
  • Nothing is ever written back to your calendar. Calendar access is read-only, always.

How long it is kept, and getting it back

Your data stays until you delete it or ask for the account to be removed. Because the whole database is a single file, an export or a deletion is straightforward — ask and you will get a copy of everything, or have it erased.

Backups of the hosted instance are kept for fourteen days and then overwritten, so deleted data can persist in a backup for up to that long.

Security, stated honestly

Traffic is encrypted in transit, calendar addresses are encrypted at rest, sign-in tokens are stored only as hashes, and sessions can be revoked immediately.

What this is not: a service with a security team, an audit, or a compliance certification. It is one person's project running on one server. Judge it accordingly, and keep your own copy of anything you cannot afford to lose.

Your rights

You can ask what is held about you, get a copy, have it corrected, or have it deleted. Email hello@solidhours.com and you will get a real answer. There is no form and no ticket queue.

Changes

If this policy changes in a way that affects what happens to your data, the date at the top changes and anyone using the hosted instance is told by email. Silent rewrites are not the intent.