privacy policy.

the short version

• your words are scrambled on your phone before any copy of them reaches us. what we store is unreadable on its own.
• we also hold the key, tied to your account. that is the only reason signing in on a new phone brings your history back. it also means we could technically unscramble it — so we will not tell you that we cannot.
• we can still see the shape of your use — when you saved something, how much, which device, whether you pay. just never the words.
• your list lives on your phone. the backup is a spare copy, not the real one.
• we do not sell your data, show ads, or hand anything to advertisers.
• no one else can see your history. there is no feed and no sharing.
• you can take everything out, and you can delete everything.

what we keep

your account

your email address, the display name you picked, and an account identifier. alongside that we keep the practical details of running the service: basic device and app information, login and sync timestamps, and whether your subscription is active.

we do not collect your contacts, your photos, your location, advertising identifiers, or any readable version of what you write.

your history, scrambled

your entries and your thread names are backed up as scrambled text. the scrambling happens on your phone, before anything is sent, so nothing readable ever travels.

the shape around it is still visible to us, and you should know that. we can see which account and device saved something, when it happened, how many events there are, what platform and app version you are on, whether syncing is up to date, and whether you are paying. what we cannot see is the part that matters: the words, and what you called the thread.

the key, and who has it

the key that unscrambles your history is made on your phone. a copy is also kept on our servers, attached to your account. this is deliberate, and it is the honest catch: because we hold the key, it is technically possible for us to unscramble your entries. we do not, and access to that storage is restricted — but you should judge us on what is possible, not on a promise.

we chose it that way on purpose. the alternative is a recovery code you have to keep forever, and the day you lose it your entire history is gone with it. for an app whose whole point is a record you can trust to still be there years from now, quietly losing everything is the worse failure.

if you want a record no one but you can ever read, this trade-off may not suit you. that is a fair reason not to use recommit, and we would rather say it here than bury it.

crash reports

when the app breaks we get a report about what broke, plus basic counts like “someone saved an entry”. these never contain your words, your thread names, or anything you wrote.

what we never get

• where you are, who your contacts are, your photos, or your health records.
• advertising identifiers, or anything that would let someone profile you.
• your card details — those go straight to google play, never to us.
• anything at all if you never make an account: the app works fully offline.

getting your history back

sign in on the new phone. that is the whole process — your history comes back on its own, because the key is attached to your account rather than to a code you had to keep safe.

there is no recovery code, and nothing for you to write down and lose. if you forget your password, you reset it by email like anything else.

who processes what

• supabase — accounts, encrypted backup storage, and the key store described above.
• google sign-in — if you choose to sign in with google rather than a password.
• google play, through revenuecat — payment and subscription status. they receive a purchase identifier, never your ledger.
• resend — the emails the app has to send you: verification, and password resets.
• vercel — hosting for this website.
• sentry — crash diagnostics.
• posthog — structural product analytics.
• google workspace — the support inbox, if you email us.

each processes data only on our instructions. your entries and thread names are encrypted before they leave your phone, so none of these ever receive a readable word of your ledger — supabase alone stores the encrypted ledger and the key beside it, which is the arrangement described above.

recommit is on android first. there is no apple involvement at launch; when an iphone version arrives, this list will be updated before it ships.

legal basis and your rights

we process account data to provide the service you asked for, and diagnostics on the basis of legitimate interest in keeping the app working. you may request access, correction, export or deletion of your data at any time.

export and deletion are both built into the app — settings › export data, and settings › delete account. you can also write to support@recommit.app.

deleting your account

deleting removes your account, your escrowed key and your encrypted ledger from recommit's active systems straight away. there is no grace period and no way for us to undo it.

we will not claim that every trace vanishes in the same instant, because that would not be true. limited security logs and routine backups age out on their own schedule, and google keeps its own record of any purchase you made, for as long as their rules require. neither contains anything readable from your ledger.

the copy on your phone is yours — remove the app and it goes with it.

retention

your encrypted ledger is kept until you delete your account. operational diagnostics and delivery records are retained only for their documented operational periods, then deleted or anonymised.

children

recommit is not intended for children under 13, and we do not knowingly collect their data.

changes

if this policy changes materially, the app will say so before the change takes effect. the date at the top always reflects the current version.

contact

recommit, the United Kingdom — support@recommit.app