Who we are
Until is provided by Paul Stefan Chirita, trading as Appsolutely Handy, a Dutch sole proprietor (eenmanszaak), registered with the Dutch Chamber of Commerce under number 77361148. We are responsible for the personal data processing described here.
Our business address is Sibeliuspark 350, 5343 BM Oss, Netherlands. Contact us at contact@appsolutelyhandy.nl or +31 6 42877931 for privacy questions or requests.
This policy covers this website and the current connected Until beta. The app is not yet publicly released. The purchase section describes the launch purchase flow and applies when purchases are enabled.
Information we use
Your account and connection
We use your email address to send sign-in codes and provide account access. The service stores your display name, account identifier, invitations, pairing state and the device information needed for your connection. Your paired person sees your display name; the pairing response does not expose your email address.
Devices and delivery
The service stores a device identifier and public encryption/signing keys, routing identifiers, revision numbers, timestamps, object sizes, hashes and delivery receipts. These records reveal activity and size even when the underlying content is encrypted. When the launch allowance is enabled, the service also records completed-memory counts and collection-access decisions to apply the free allowance and shared unlock; it does not need the contents of a memory to count it. Providers also receive connection information, including IP addresses and technical request records.
Your local archive
Your phone holds protected keys and an encrypted archive of your authored moments, received encrypted contributions, opened memories and unfinished delivery or opening work. Your photos and archive use device storage. Email sign-in alone cannot restore missing keys.
Support
If you email us, we receive your address, message and any attachments you choose to send. We use them to answer the request and handle related follow-up. Please leave private moments out of screenshots unless they are necessary for the request.
Your moments and privacy
In the connected app, notes and photos are encrypted on your phone before cloud delivery. Their full-content keys are kept out of ordinary relay traffic and released during the deliberate, authenticated nearby opening flow. The service stores encrypted payloads and the metadata needed to deliver them.
Sealed previews intentionally reveal a rough text structure or a very coarse image to your paired person. After opening, the full memory can be read locally. A shared title and description for the next collection travel encrypted between the pair; later edits to an opened memory stay on the phone that made them.
The protocol has not received an independent cryptographic audit. Bluetooth reachability does not prove a specific distance. Ending a pair cannot instantly notify a disconnected phone or recall a key or opened copy that the other person already received.
The app has no advertising or optional usage-analytics SDK in its current connected implementation. We do not sell your personal data or use your moments in advertising. The separate local visual prototype is a demo with simulated accounts; it is not the connected service and its local demo content is not imported into a connected account.
Purchases and the shared unlock
When purchases are enabled, Apple handles payment through the App Store. We do not collect payment-card details. The planned unlock is a one-time purchase, with access shared across the connected pair.
RevenueCat is used to verify purchase status and make the correct access available. It processes an app customer identifier, store product and transaction identifiers, purchase/restore information, and entitlement status. The app and backend associate entitlement with the relevant Until account and pair so one purchase can cover both people. RevenueCat may receive technical app/device and connection information needed to operate its service.
We do not send RevenueCat the contents of your notes, photos, memory titles or descriptions, or private encryption keys. Apple and RevenueCat process their relevant records under their own policies and processing terms.
Restoring a purchase can restore eligible paid access. It does not restore an archive, encryption keys or memories from a lost or replaced phone. Account deletion and a refund request are separate actions; purchase records that Apple must retain remain subject to its obligations.
Optional arrival alerts
If you choose to enable arrival notifications, the app registers an Apple Push Notification service (APNs) token together with its account/device/session association and preference. Apple receives the token and generic notification payload needed to deliver an alert.
The payload contains the Until name and a generic arrival message. It does not contain your note, photo, sender name, preview or a content key. Alerts do not unlock moments or establish that a contribution is durably saved on a phone.
You can disable alerts in Until and manage notification permission in iPhone Settings. Device permission alone does not remove every server-side registration. When an in-app disable succeeds, its registration and queued work are removed; an alert already sent may still arrive.
Why we process information
| Purpose | Basis |
|---|---|
| Accounts, pairing, encrypted delivery and purchased access | Providing the service you request and performing our service contract with you.|
| Optional arrival alerts | Your choice to enable them. You can withdraw that choice in the app; declining alerts does not prevent foreground use.|
| Support, security and a working website | Responding to your service request and our legitimate interests in helping users, preventing abuse and operating a secure, reliable service.|
| Required records and lawful requests | Compliance with applicable legal obligations, where they require the processing.
We do not make decisions with legal or similarly significant effects about you through automated profiling. If a new optional processing purpose needs your consent, we will ask before enabling it.
Providers and international processing
- Supabase provides authentication, database records, private encrypted-payload storage and server functions. Our configured database region is Frankfurt. A regional database does not mean all provider operations or subprocessors remain in that region. Supabase privacy information.
- Resend delivers sign-in emails and processes the destination address, message and delivery information. Resend privacy information.
- Apple provides App Store payment and optional APNs delivery. Apple privacy information.
- RevenueCat processes purchase and entitlement information when purchasing is enabled. RevenueCat privacy information and processing terms.
- Zoho Mail provides the business mailbox used for support. Zoho privacy information.
- Cloudflare serves and protects this website. Cloudflare privacy information and processing terms.
Some provider processing may occur outside the European Economic Area, including in the United States. We do not promise EU-only processing. Applicable safeguards may include adequacy arrangements and Standard Contractual Clauses under the relevant provider terms. Contact us for information about the safeguards relevant to your data.
Keeping and removing data
On your phone: moments and keys remain in the local archive until you remove them or choose the relevant erase option. During unpairing or account deletion, you can choose to keep already opened memories on that phone. Kept memories can be read there without signing in. The app does not currently provide backup, archive export or replacement-phone recovery.
Delivery data: incomplete uploads become eligible for cleanup after 24 hours. Encrypted content acknowledged as durably saved by the recipient becomes eligible for cleanup after 24 hours. Unreceived published content does not currently have an automatic time-based expiry. Receipts and revision records remain while the pair needs them to synchronize. Actual deletion depends on successful cleanup; eligibility is not a guaranteed erasure deadline.
Leaving a pair or deleting an account: unpairing stops future sharing once the change is learned and requests cleanup of delivery data. Account deletion disables the account, ends the pair and starts removal of its service data. Background cleanup may continue after the request is accepted. Neither action erases the other person’s already opened copies.
Notifications: registrations are removed after a successful in-app disable, relevant session deletion, unpairing or account deactivation. Notification jobs expire for sending after 24 hours. An enabled worker prunes finished jobs older than seven days; a paused or failing worker can leave records longer.
Launch allowance and purchase access: free-use counters stay with an existing Until account when it changes partner. Collection-access records for a pair are removed with pair cleanup. Account deletion removes that account’s free-use counters and cached entitlement from our database. RevenueCat customer/purchase records and Apple payment records are separate; their retention and deletion follow the relevant provider processes and legal obligations.
Other records: invitations and account/pair metadata follow the account and pair lifecycle; expired invitations do not currently have a separate automatic age-based purge. Provider-managed backups and technical logs follow the relevant service rules. We do not promise immediate removal from every backup.
Support mail: we keep information as needed to answer the request and manage related follow-up, complaints, disputes or legal obligations. Contact us to request removal of records no longer needed. We can explain any applicable retention constraint when handling your request.
Your choices and rights
You can edit your profile name, cancel an invitation or request, unpair, and request account deletion in Until. Optional notifications can be switched off. These choices do not remove another person’s independently held, already opened copy.
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent where processing relies on it. These rights have conditions and limits; withdrawing consent does not change the lawfulness of earlier processing.
Email contact@appsolutelyhandy.nl. We may ask for limited information to verify and locate your records. Please do not send sign-in codes, private keys or your entire archive. The lack of a built-in archive-export feature does not remove rights you may have under data-protection law.
You can complain to your local data-protection authority or the Dutch Autoriteit Persoonsgegevens. See the European Commission’s information on your rights.
This website and updates
This site has no added analytics, advertising cookies, tracking pixels, contact forms, external scripts or third-party font requests. Clicking an email link opens your own mail application. We do not maintain a separate visitor-log archive.
Cloudflare receives technical connection and request information, such as IP address, requested page, browser information and time, to deliver and protect the website. These technical records are subject to its service and security retention rules.
We will update this policy as the service changes. The date at the top identifies this version. We will update the notice before public app launch to reflect the final production and purchase configuration, and seek a new choice if a change requires one.