Privacy
Last updated 28 October 2026
Halcyon keeps the things you put into it so you can work with them, and for nothing else. This page says what that is, who else handles it, where it lives, and how to get rid of it. Halcyon is run by ByBirth Pty Ltd (ABN 81 701 688 182), and we handle personal information in line with the Australian Privacy Principles.
What we store
- Your account: name, email address, time zone, your settings, and a hashed password if you set one.
- What you and the people in your workspaces add: clients, projects, cards, comments, events, time, invoices, expenses and files. That can include your clients’ contact details, your business and bank details for invoices, and other people’s email addresses when you invite them.
- For Pro: which workspace is subscribed, its plan, seats and billing dates, and Paddle’s reference numbers. We never hold your card details.
- To keep things running and safe: the outside calendar addresses you subscribe to, push subscriptions for your devices, API tokens (stored hashed), webhook addresses, and counts of API use.
What we don’t do
- We don’t sell your data or share it with advertisers.
- We don’t use analytics or tracking cookies.
- We don’t read your workspace’s content unless you ask us to help with a problem in it. Our staff tools show account details (names, email addresses, workspace names, plans and counts), not what’s inside.
Cookies and your browser
Halcyon sets cookies only to keep you signed in. Your browser also remembers a few display choices, like how a list is sorted. When you buy Pro, Paddle’s checkout runs on the page and may set its own cookies for the payment. The sign-up and sign-in forms use Cloudflare Turnstile to tell people from bots, which looks at signals from your browser but doesn’t set tracking cookies.
Who else handles it
Each of these handles data only to run its part of Halcyon:
- Supabase: the database, file storage and sign-in, in their Sydney region. This is where your data lives.
- Vercel: serves the app. Pages are worked out in Sydney, next to the database.
- Resend: sends Halcyon’s emails (sign-in links, invitations, notifications), from its Tokyo region in Japan.
- Paddle: our reseller and merchant of record for Pro, in the United Kingdom and the United States. It collects your payment details, billing name, address and email, under its own privacy policy, and keeps payment records as tax law requires.
- Cloudflare: Turnstile, on the sign-up and sign-in forms.
- Your browser’s push service (Apple, Google or Mozilla), if you turn on push notifications: it carries each notification to your device.
- GitHub: holds our weekly backups for 12 weeks, in the United States. They’re encrypted before they’re stored, so GitHub can’t read them.
When you point Halcyon somewhere yourself (an outside calendar to follow, a webhook, or an app using your API token), it fetches from or sends to that address, as you asked. Your calendar link works the other way: anything holding it can read that calendar, until you make a new link from Settings.
How it’s protected
Every workspace is walled off from every other at the database level, so another account can’t read your data even by guessing an address. Everything travels encrypted, and files are only reachable through short-lived links.
Deleting your data
You can delete your account from Account settings at any time. That removes your profile, every workspace you own, everything in them and the files you uploaded, and cancels any Pro plan those workspaces have. It can’t be undone. Copies in backups expire on their own: Supabase’s daily backups within a week, our weekly ones within 12 weeks. Paddle keeps its payment records for as long as tax law requires.
Seeing or correcting what we hold
Most of it you can see and change yourself, in the app. For anything else, or to make a complaint, email us. If you’re not happy with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Contact
Questions about your data: support@halcyon.software.