Sanctuary

Privacy policy

Last updated: [to add on publishing]

Founder draft, not legal advice. Written from the app's architecture for review by a UK data-protection specialist before it is published. Highlighted items are still to be filled in.

The short version

Sanctuary keeps your words on your phone. There is no account, no server, and nothing is sent anywhere. We do not track you, we collect no data about you, and we have nothing to sell. Everything below explains this in more detail, but that is the whole of it.

Who we are

Sanctuary is provided by AiTomatic Ltd (registered as AITOMATIC LTD, company number 16057949, registered in England and Wales), [registered office address], the data controller for the purposes of UK GDPR and the Data Protection Act 2018. You can contact us at [contact email]. [ICO registration number, once registered]

What Sanctuary does with your information

Sanctuary helps you speak or type your thoughts and gently sorts them into tasks and notes. All of this happens on your device:

Your voice. When you hold the button and speak, your phone records audio only for as long as you are speaking, and transcribes it on the device using Apple's on-device speech recognition. The audio is never written to a file and is never sent anywhere. Only the text transcript is kept, and only if you choose to keep it.
Your words, tasks and notes. Transcripts and the tasks or notes they become are stored in a small database on your phone. You can edit them, let them go one at a time, or remove them all.
A soft sense of how you are (optional). If you turn it on, Sanctuary reads a gentle sense of your mood from your words, to shape your day a little. This is health-related information, so it is off by default and only ever happens with your explicit consent. Turning it off removes any mood Sanctuary has noticed. It is never shown to anyone and never leaves your phone.
Energy check-ins, your garden and your settings. Small pieces of information you choose to set, kept on your phone to shape the experience.

We do not collect names, email addresses, accounts, advertising identifiers, location, contacts, or any analytics. Sanctuary has no idea who you are.

Where your information is, and who can see it

Everything is stored on your device, in the app's own private area, protected by your phone's built-in encryption. There is no Sanctuary server. We cannot see your words, and neither can anyone else. There are no third-party companies, software kits, or advertising networks involved, so nothing is shared with anyone. Your information is not used for any automated decision that has a legal or similarly significant effect on you.

Your information is not transferred outside the UK, because it never leaves your device.

Why we are allowed to do this (lawful basis)

Consent is our lawful basis under Article 6(1)(a) of the UK GDPR. You start each ramble, and nothing is processed without your action.
For the optional mood sense, which is special-category (health-related) information, our condition under Article 9(2)(a) is your explicit consent, given through the opt-in toggle in Settings. When the toggle is off, no mood is read, stored, or used, and any previously noticed mood is removed.

You can withdraw consent at any time by turning the toggle off, or by deleting your information or the app.

How long we keep it

Because everything is on your device, you are in control of how long it stays:

Rambles are capped at the most recent 500, with the oldest quietly removed after that. You can also remove any ramble yourself at any time. Removing a ramble never removes the tasks it created.
Conversations in Talk are capped at the most recent 200.
Tasks, notes and other items are kept until you remove them. There is no automatic deletion in this version.
Deleting the app removes everything it ever held.

Your rights

Under UK data protection law you have the right to access, correct, delete, restrict, and port your information, and to object to its use. Because your information lives on your device, you can exercise most of these immediately, without asking us and without proving who you are:

Access and portability: Settings includes an export that gives you everything Sanctuary holds, as a single file (a full copy, a shareable copy with contact and card numbers removed, or spreadsheets).
Erasure: let any item go for good, or delete the app to remove everything.
Correction: edit anything directly.
Withdraw consent: turn off the mood toggle.

If you ever feel we have not respected your rights, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would rather you told us first, at [contact email], so we can put it right.

Children

Sanctuary is intended for general audiences [confirm minimum age, e.g. 13+, and match the App Store age rating]. We do not knowingly collect information from children, and in any case we collect no information about anyone, on or off the device.

Changes to this policy

If we change how Sanctuary handles information, we will update this policy and the in-app transparency screen, and note the date above. Material changes that affect your information will be made clear in the app.

A note on honesty

Sanctuary is a wellbeing and organisation tool, not a medical device or a substitute for professional care. This policy describes only what the app does today. Where something is planned but not yet built, we do not claim it here.