Privacy Policy

How NotchBook handles your information, in plain terms and then at length.

NotchBook is a mobile application provided by ButterflyRay Limited, also trading as ButterflyRay ("ButterflyRay", "we", "us" or "our"). The App is distributed on the Apple App Store and on Google Play. This Privacy Policy explains what information we collect when you use the App, how we use and share it, and the choices and rights you have.

This Privacy Policy applies to the App and the related cloud services we provide. It does not apply to third-party services that have their own privacy policies. By using the App, you agree to the practices described here. If you do not agree, please do not use the App.

1. Who We Are

ButterflyRay Limited, a company registered in New Zealand, is the controller responsible for your personal information under this Policy. If you have any questions, you can contact us at support@butterflyray.com.

2. Information We Collect

Information you provide to us.

• Account information: an account is required to use the App. When you create one we collect your email address and password (stored in encrypted form by our authentication provider, never in plain text). You may also provide a display name and a profile picture.
• Your content: the habits you create and the days you mark them complete, your habit counts, targets, schedules and streaks; your task lists and the tasks on them, including titles, notes, due dates and completion state; the timers you create or customise, including their names, phases and durations; and your journal entries, including their text, dates, any mood or tags you attach, and any photos you add to them.
• Photos and images: the images you choose to upload — your profile picture, and, on a paid plan, photos attached to journal entries. We use your device's photo picker or camera and receive only the images you select — we do not browse or index your photo library. A photograph may carry metadata written by the camera, such as the date, the device and sometimes the location where it was taken; that metadata is uploaded with the file unless your device strips it first. Uploaded images are stored under your account in Firebase Cloud Storage.
• Profile and preferences: settings you choose in the App, including notification and reminder preferences and whether you opt in to receive marketing emails.
• Communications: information you provide when you contact us for support or feedback, including your email address and the contents of your message.

Information collected automatically.

• Log and diagnostic data: when you use the App, and particularly if an error occurs, we and our third-party providers may collect data such as your device Internet Protocol ("IP") address, device model and name, operating system version, app version and configuration, and the date and time of your use, together with related statistics.
• Usage and analytics data: information about how you interact with the App — which screens are opened, which features are used, and how often — collected through Google Analytics for Firebase to help us understand and improve the App. This is measured at the level of features and events. It does not include the text of your journal entries, the names of your habits, or the contents of your tasks.
• Crash data: diagnostic information generated if the App crashes, collected through Firebase Crashlytics, so we can find and fix the fault.

Purchase information. Paid plans are not yet available in the App and will be introduced in a later release; this paragraph describes what will happen when they are. When you subscribe or make an in-app purchase, payment is processed by the Apple App Store or Google Play under their terms. We do not receive or store your payment card details. We use RevenueCat to manage and verify purchases and subscriptions, and we may receive confirmation of your purchase, your subscription status and its renewal or expiry dates.

What we do not collect. NotchBook does not contain advertising and does not use advertising identifiers. We do not collect your contacts, your precise location or your health records; we do not access your photo library beyond the individual images you choose to upload; and we do not read data from other apps on your device.

3. How We Use Information

We use the information described above to:

• create and manage your account and authenticate you;
• provide the App's core features — tracking habits and streaks, keeping your task lists, running timers and storing your journal;
• back up your data and synchronise it across the devices you sign in on;
• store the images you upload and display them back to you in the App, including generating resized copies so they load quickly;
• send the reminders and notifications you have asked for;
• process subscriptions and in-app purchases, and give you access to the features they unlock;
• operate, maintain, secure and improve the App, and diagnose and fix problems;
• send you marketing emails where you have opted in (you can opt out at any time);
• communicate with you about support requests and important changes; and
• comply with our legal obligations and enforce our terms.

We do not use your content to train artificial intelligence or machine learning models, and we do not use it for advertising or profiling.

Where the law requires a legal basis to process your personal information (for example in the EEA or UK), we rely on performance of our agreement with you, your consent (for example for marketing emails and notifications), our legitimate interests in operating and improving the App, and compliance with legal obligations.

4. Your Journal, Habits, Tasks and Photos

We recognise that a journal is the most personal thing in the App, and that habits, tasks and the photos you attach to an entry can also reveal a great deal about your life. This section says exactly how they are handled.

• On your device first. Once you have signed in, the App works offline: your habits, tasks, timers and journal entries are written to your phone or tablet and are usable with no connection.
• And in our backend, so it can be backed up and synced. Cloud backup and sync is included with every account, within the limits of your plan, so your content is also stored in Google Firebase services operated on our behalf. It travels over an encrypted SSL/TLS connection and is encrypted at rest, and access is restricted by security rules so that your data is readable only through your own authenticated account. Anything not yet synced — offline changes, or content beyond your plan's limits — stays on your device, which also means we cannot recover it if the device is lost.
• Photos are stored under your account. Your profile picture, and — on a paid plan — the photos you attach to journal entries, are uploaded to Firebase Cloud Storage over an encrypted SSL/TLS connection, encrypted at rest, and served only through links scoped to your own account. Deleting a photo, or the entry it belongs to, deletes the stored file.
• It is not end-to-end encrypted. We hold the keys to the storage, which means our systems — and a small number of authorised personnel, for support and maintenance — have the technical ability to access your content. This is what makes it possible for us to restore your data if you lose your device. We access it only where necessary to operate the service, to respond to a support request you have made, to investigate abuse or a security incident, or where the law requires it.
• It is never public. NotchBook has no social features, no feed, no sharing and no public profiles. Nothing you write or upload is published, shown to other users, or indexed by search engines.
• Sensitive content is your choice. Because journal entries, habits and photographs may reveal information some laws treat as sensitive — health, beliefs, and so on — please only record and upload what you are comfortable storing under the terms described here.

5. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share information only as follows:

• Service providers. We use trusted third parties to operate the App on our behalf, including for authentication, cloud database and storage, analytics, crash reporting, and purchase and subscription management. These providers may access your information only to perform tasks for us and are obligated not to use it for their own purposes. Our providers are Google (Firebase Authentication, Firestore/Realtime Database, Cloud Storage, Analytics and Crashlytics, and on Android, Google Play Services) and RevenueCat.
• Payment processing. Purchases are handled by Apple or Google as described in Section 2.
• Legal and safety. We may disclose information where required by law, to enforce our terms, or to protect the rights, safety and security of ButterflyRay, our users or the public.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

6. Third-Party Services

The App uses third-party services that may collect information used to identify you. Their handling of your information is governed by their own privacy policies:

• Firebase Authentication, Database and Storage
• Google Analytics for Firebase
• Firebase Crashlytics
• Google Play Services (Android)
• RevenueCat (purchase and subscription management)
• Apple (App Store purchases, iOS)

The App may also contain links to sites that we do not operate. We are not responsible for the content or privacy practices of those sites, and we encourage you to review their privacy policies.

7. Cookies and Similar Technologies

The App itself does not use browser cookies. Third-party libraries used by the App may use device identifiers or similar technologies to operate their services, as described in their policies above. This website uses no cookies and no third-party trackers.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the App. When you delete your account (using "Delete Account" in Settings) or delete specific content, we delete or de-identify the associated personal information — including any images you have uploaded — within a reasonable period. Backups may retain deleted data for a limited period before they are rotated out. We may retain information for longer where we need it to comply with legal obligations, resolve disputes or enforce our agreements.

Content that has not been synced — changes made offline, or content beyond your plan's limits — is not held by us at all: it lives only on your device, and uninstalling the App removes it.

9. Data Security

We use commercially reasonable measures to protect your personal information. Data moving between the App and our backend travels over encrypted SSL/TLS connections; your journal entries, your other content and the images you upload are encrypted at rest by our cloud provider; and access rules scope your data to your own authenticated account. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and choosing a strong, unique password, and for keeping your own copies of anything you would be sorry to lose, including the originals of any photographs you upload.

10. International Data Transfers

We are based in New Zealand, and our service providers (including Google) may process and store your information on servers located in other countries. This means your information may be transferred to, and processed in, countries with data protection laws different from those in your country. Where required, we take steps to ensure appropriate safeguards are in place for such transfers.

11. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, update, delete or obtain a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Within the App you can:

• review and edit any habit, task, timer or journal entry, remove a photo you have uploaded, or delete any of them individually;
• delete your account and its associated data using "Delete Account" in Settings;
• turn notifications and reminders on or off;
• opt out of marketing emails by turning off that setting or using the unsubscribe link in any such email; and
• manage or cancel subscriptions through your Apple App Store or Google Play account settings.

To exercise any other right, contact us at support@butterflyray.com. We will respond as required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority. If you are a New Zealand resident, you may complain to the Office of the Privacy Commissioner. If you are a California resident, you have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them; we do not sell or share personal information as those terms are defined under that law.

12. Children's Privacy

The App's content is rated for general audiences and contains no age-restricted material. This content rating is separate from the requirements below, which apply because the App collects personal information and offers online and paid features.

An account is required to use the App, and account creation and the features that involve personal information — including cloud sync and backup, photo uploads and in-app purchases — are not intended for children under 13. We do not knowingly collect personally identifiable information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete it from our servers. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@butterflyray.com so that we can take appropriate action.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new Privacy Policy on this page and updating the effective date above, and we will give notice in the App of any material change. You are advised to review this page periodically. Your continued use of the App after changes take effect constitutes your acceptance of the updated Policy.

14. Contact Us

If you have any questions or suggestions about this Privacy Policy, contact us at support@butterflyray.com.