Privacy notice

1. Who is answering

Controller

The company behind this site and behind the apps is YYY SOFTWARE LTD. It decides what data is taken and why, which under the UK General Data Protection Regulation and the Data Protection Act 2018 makes it the controller. Every answer on this page is that company's answer.

Article 37 sets out when an organisation must appoint a Data Protection Officer. Our processing sits outside those triggers, so questions go to the company itself rather than to a named officer, at the address above.

2. How to read a card

Sections 4 to 16 are cards. Each one takes a single kind of information and puts the same seven questions to it. The wording of the questions is borrowed from the store panels on purpose, so that what you read here can be laid straight over what you read before installing.

What each question means

Collected. Whether the information reaches us or a company working for us. Data that is created on your phone and stays on your phone is not collected, however personal it is.

Linked to you. Whether the information sits against something that identifies you, such as an email address or an account. Counted numbers with no name attached are not linked.

What it is for. The actual use. Not the widest use we could imagine one day.

Who else sees it. Any other organisation the information passes through, and what its role is.

Deletable. Whether you can make it go, and what happens when you ask.

Lawful basis. The Article 6 ground that makes the processing lawful. Nothing is processed without one.

Kept for. How long it survives before deletion, and what starts the clock.

A card marked not collected is still worth reading. Phones hold plenty that an app of this kind could ask for and does not, and a stated no is more use to you than silence.

3. The two roles we can be in

Both roles

Data protection law hangs everything on who chose the purpose. Choose it yourself and you are a controller, carrying the duties. Act on somebody else's instruction and you are a processor, carrying fewer.

For this website and for our own applications, the choice is ours, so the controller duties are ours: publishing this notice, answering your rights requests, reporting breaches, keeping records. Section 30 covers the narrower situation in which another organisation decides and we merely carry out the work.

The suppliers listed in section 23 are mostly our processors. They hold data because we asked them to, under a written contract that meets Article 28, and they are not free to use it for their own ends.

17. Sensitive categories and offence records

Controller

Article 9 fences off a set of especially revealing categories: what your body is doing, who you sleep with, what you believe, where your ancestors came from, whether you belong to a union, and biometric or genetic readings that identify you. Article 10 does something similar for criminal convictions and offences.

None of this is sought by the website or by an app of ours. The cards above say so one category at a time, because a general reassurance is easier to write and worth less.

You can still put such a thing in an email to us, and people occasionally do while explaining a problem. Where that happens it is held as part of the correspondence and deleted on the schedule in section 25, and it is not indexed, tagged or used to sort you into anything. If you would rather not have it sitting in a mailbox at all, say so in the message and it will be taken out.

Should a future feature ever need a category from Article 9, an Article 6 basis would not be enough on its own. A second condition from Article 9(2) and from Schedule 1 to the Data Protection Act 2018 would have to apply, and this notice would carry it before the feature shipped.

18. Age, and who these apps are for

Controller

This website is written for adults, and nothing on it is aimed at children. We do not knowingly hold data about a child through it.

Section 9 of the Data Protection Act 2018 sets 13 as the age at which a child can consent for themselves to an online service. Below that, consent has to come from whoever holds parental responsibility. Where an app of ours ever relies on consent, it will be built to that line rather than around it.

The Information Commissioner's Age Appropriate Design Code applies to services likely to be accessed by children, and it asks for a standard of care rather than an age gate: privacy settings that start at the protective end, no nudges towards giving up more, no design pattern built to keep a child in the app. Those are the terms our apps are drawn to. Every card above answers the same for a fourteen-year-old as for anyone else, because the answers do not depend on knowing who you are.

Store listings carry a content rating and an age band, set through Apple's and Google's own questionnaires. Where a rating and this notice ever appear to disagree, write to us and we will fix whichever is wrong.

A parent or guardian who believes a child's data has reached us can write to the address in section 34. We will look, we will say what we found, and where there is something to delete it will be deleted rather than justified.

19. Every lawful basis, in one place

Controller

Each card names its own basis. This table gathers them so the pattern is visible in one view, with the interest being pursued spelled out wherever legitimate interests is the basis, as Article 13(1)(d) requires.

Legitimate interests is the basis most easily stretched, so it is the one we test hardest. Each row above was weighed against what you would reasonably expect, and each is limited to data you either sent us or generated by connecting. Where the balance came out the other way, the row is not there. Section 31 explains how to object to any of them.

20. Phone permissions, and taking them back

Controller

A permission prompt is a promise with a button on it. The rule our apps follow is that a prompt appears at the moment the feature is used, never on first launch as a sweep, and that saying no leaves everything else working.

Whatever you grant, you can take back, and you do not need us to do it:

On iPhone and iPad

Open Settings, scroll to the app, and every permission it holds is listed with a switch. Settings, then Privacy & Security, gives the same information organised by permission instead of by app, which is the better view when you want to see everyone holding a particular one.

On Android

Open Settings, then Apps, choose the app, then Permissions. Settings, then Privacy, then Permission manager gives the by-permission view. Recent Android versions also revoke permissions automatically for apps you have not opened in a while, and that behaviour is fine by us.

Removing a permission takes effect at once. An app of ours is written to carry on without one rather than to nag, and no screen will hold a feature hostage until you go back and grant it.

21. App Tracking Transparency on iPhone

Controller

App Tracking Transparency is Apple's rule that an app must ask before linking what it knows about you to data held by other companies for advertising or measurement. The prompt is the familiar one asking whether an app may track you across apps and websites owned by other companies.

You will not see that prompt from an app of ours, and the reason is plain: there is nothing behind it. No advertising identifier is requested, as card 12 records, and nothing about you is joined to a data set belonging to anyone else. An app that does not track has no honest reason to display a prompt asking to.

The permission itself remains yours to inspect. Settings, then Privacy & Security, then Tracking lists every app that has asked, and lets you switch off the ability to ask at all.

Apple's own privacy labels sit on each store listing under App Privacy, and are generated from declarations the developer files. Ours are filed to match the cards on this page. If a label and a card ever diverge, treat it as a mistake worth reporting, and write to us.

22. The Data Safety form on Google Play

Controller

Google Play requires a Data Safety declaration for every listing: which of Google's data types the app collects, which it shares, whether each is required or optional, whether data travels encrypted, and whether a user can request deletion. Google publishes the answers on the store page and holds the developer to them.

The card format on this page follows that form deliberately. The store panel gives you a line per data type; this page gives you the same line with the reasoning attached, so the two can be read against each other in a minute.

Both stores also let a developer publish a link to a privacy policy. That link points here. Where a store panel and this page cannot both be right, this page is the one we will correct the other against, and the correction goes in at the next release rather than waiting.

23. Everyone who touches any of it

Controller

A processor holds data because we asked, does only what the contract permits, and cannot use it for itself. Article 28 sets out what that contract must contain: instructions in writing, confidentiality, security, help with your rights requests, no sub-processor without permission, and deletion or return at the end. Every processor below is engaged on those terms.

Two entries are named on request rather than on the page, because a supplier can change and a stale name in a policy is worse than none. Ask at the address in section 34 and you will be told who they are, which country each processes in, and the safeguard in place. That reply is not conditional on you being a customer.

Beyond this table, data goes out only where a court, a regulator or a law enforcement body is entitled to it, or where a professional adviser needs it for a live matter. Each such request is checked against the power claimed rather than waved through. Were the business ever sold or reorganised, records would pass with it, and a notice of that would go on this page.

24. Data that leaves the United Kingdom

Controller

Some of the organisations above operate outside the UK. Chapter V of the UK GDPR allows that only through defined routes, and these are the ones relied on here.

Adequacy

Where the destination is covered by UK adequacy regulations made under Article 45 and section 17A of the Data Protection Act 2018, nothing further is needed. The European Economic Area is covered, along with the other countries the Secretary of State has recognised. For a United States organisation certified under the UK Extension to the EU–US Data Privacy Framework, we check the certification is live and covers the kind of data in question before leaning on it.

Contractual safeguards

Without adequacy, the route is the International Data Transfer Agreement, or the International Data Transfer Addendum bolted onto the European Commission's Standard Contractual Clauses, both issued under section 119A of the Data Protection Act 2018. In practice a supplier offers a data processing addendum built on the EU clauses with the UK Addendum on top, and that is the form we accept.

Checking the destination

Signing clauses is not the end of it. Before relying on them we look at the law and the practice of the country involved, at how sensitive the data is, and at what protects it in transit and at rest. Our processing is narrow and holds nothing from Article 9, which keeps the risk low, but the assessment is carried out rather than presumed.

Seeing the paperwork

Ask for the safeguard covering a transfer that affects you and you will get it. Commercial terms with no bearing on your data may be blanked; the parts describing what protects the data will not be.

25. How long each thing survives

Controller

Article 5(1)(e) says data must not be kept longer than the purpose needs. A period picked because it sounded reasonable is not a policy, so every row here carries the reason that produced the number.

Deleting from live systems happens when you ask. Backups are the honest exception: they are sealed copies, and reaching into one to remove a single record would compromise the thing they exist for. Restored data is re-deleted immediately, and the cycle above puts an outside limit of 90 days on the wait.

26. What guards it

Controller

Article 32 requires security proportionate to the risk. Here is what that means in practice on a small estate.

Every connection to this site and to any app of ours runs over TLS, with the strict transport header set so a browser will not fall back to plain HTTP. Content security rules on the site restrict what may execute and where anything may be fetched from, which shuts the door on injected scripts. The site is static: no database sits behind it, no form posts anywhere, and no interpreter runs on a page request, which removes whole classes of attack rather than defending against them.

Accounts holding company data carry a second factor. Access follows need rather than seniority, and there is not much of either to spread around. Suppliers are chosen partly on what they publish about their own security, and each contract contains the Article 28 terms above.

No system is beyond compromise, and a page claiming otherwise would be telling you something untrue. What we can say is what is in place, which is above, and what happens if it fails, which is next.

27. If it goes wrong

Controller

A personal data breach means a security failure that destroys, loses, alters or exposes personal data, whether by accident or by attack. It is wider than a hack: mail sent to the wrong recipient counts, and so does a lost laptop.

The procedure, in order. The failure is contained first and the scope established: what data, how many people, how bad the consequences could be. Article 33 then gives us 72 hours from becoming aware to report it to the Information Commissioner, unless the risk to people is unlikely; where the 72 hours cannot be met in full, we report what we have and follow with the rest. Article 34 adds a duty to tell the people affected directly where the risk to them is high, in plain language, saying what happened, what it means for them and what to do about it. An internal record is kept whether or not either report is required, because Article 33(5) says so and because the pattern of near misses is where the next fix comes from.

What we will not do is wait for certainty before telling you something that affects you, or describe an incident in language designed to make it sound smaller than it was.

If you think something has gone wrong with data of yours, write to [email protected]. A message of that kind goes to the front of the queue.

28. Account deletion, and deleting everything else

Controller

Both stores require an app with accounts to offer a route to delete your account and the data behind it, reachable from inside the app and from outside it. That is the standard here.

From inside an app

Where an app of ours has an account, the settings screen carries the account deletion control, and it does not hide behind a support conversation. Confirming it removes the account and everything held against it from live systems, then from backups on the 90-day cycle in section 25.

By writing

Send a message to [email protected] asking us to delete your data, and say how much of it you mean. That covers an app account, the whole of your correspondence with us, your place on the update list, or all of it together. Where the mailbox alone does not establish who you are, we may need one more thing to check it, asked for narrowly rather than as a document round.

What deletion cannot reach

Two things survive, and both are outside our discretion. Accounting records tied to a purchase are held for the statutory period in section 25. A suppression note that you asked for no further mail is itself the mechanism that keeps the promise. Everything else goes.

The store account is separate

Deleting an app account of ours does not touch your Apple or Google account, your purchase history there, or your subscription. Those live with the store, and are managed in the store's own settings. Removing an app from a handset is likewise not a deletion request to us, because a request has to reach us before it can be acted on.

29. Decisions made by machine

Controller

Article 22 covers decisions taken about you by automated means alone, where the effect is legal or similarly significant: refusing credit, filtering an application, pricing by profile. Nothing on this site or in an app of ours makes a decision of that kind, so the Article 22 safeguards are not engaged.

Nor is anyone profiled. No score is calculated about you, no segment is assigned, and no model is trained on your data to predict what you will do next. Were that to change, this section would carry the logic involved, what it means for you, and the route to a human being, before rather than after.

30. When we are the processor

Processor

Occasionally another organisation decides the purpose and we carry out the work: an application built to a specification, or a system supported on someone else's behalf. In that arrangement they are the controller and we are the processor, and the duties change shape.

What that means in practice: we act on their written instructions and nowhere beyond them; we keep the data confidential and secure; we take no sub-processor without their agreement; we help them meet their own obligations, including answering the rights requests that reach them; and at the end of the work we delete or return the data as they direct.

The person whose data it is deals with the controller rather than with us, because they hold the relationship and the duty to answer. If a request of that sort arrives here by mistake, we pass it to them promptly and tell you that we have, rather than answering something that is not ours to answer.

31. Your rights, and how to fire one

Controller

Chapter III of the UK GDPR gives you a set of rights over data about you. They are exercised by asking, in whatever words you like, to [email protected].

How a request is handled

Article 12(3) sets the deadline at one month from receipt, extendable by two further months for a request that is genuinely complex, in which case we tell you inside the first month and say why. Nothing is charged. Where we cannot tell from the message that the request is really from you, we ask for one thing that would settle it, and the clock waits for that answer rather than running down.

If we decline any part of a request, you get the reason in writing along with the route to challenge it, which is section 32. A refusal without an explanation is not an answer.

32. Taking it to the ICO

Controller

The Information Commissioner's Office regulates data protection in the United Kingdom, and you may complain to it about how we have handled your data. Article 77 gives you that right directly, and nothing on this page limits it.

Coming to us first is often quicker and sometimes fixes the thing outright, but it is a suggestion and not a condition. You are free to go straight to the regulator, and doing so will not change how we treat you afterwards.

Section 168 of the Data Protection Act 2018 also lets a court award compensation for damage caused by a contravention, and Article 79 preserves the route to a judicial remedy. Those sit alongside a complaint rather than instead of it.

33. When this page changes

Controller

This notice changes when the facts change: a new feature that touches data, a supplier swapped out, a period revised, a card that needs a different answer. The date and version at the top move with it.

A wording tidy goes in quietly. A change to what is collected, why, who sees it or how long it lives is different, and it will be described here rather than folded in silently. Where a change needs your consent, you will be asked before it takes effect and not told about it afterwards. Where it materially affects someone on the update list, a message goes out.

The store listings carry declarations that have to match this page. A change here that affects a card triggers an update to the App Privacy labels and to the Play Data Safety form at the next release.

34. Where to write

Both roles

Rights requests, questions about a card, complaints about how any of this has gone: one address takes all of them, and the company answers rather than a ticketing system.