Legal
Draft for legal review
PADS is private by default. This policy explains plainly what stays on your phone, what leaves it, and what we can and can’t see.
Last updated: [publication date] · Applies to: the PADS app and pads-app.com
This summary is to help you. The full text below is what applies.
On this page
1. Who we are
2. What this policy covers
3. Information that stays on your phone
4. Information that leaves your phone
5. Health and other sensitive information
6. How we use information
7. What we never do
8. Who we share information with
9. International transfers
10. How long we keep information
11. Keeping information safe
12. Your rights
13. Children
14. Changes to this policy
15. Contact and complaints
PADS is provided by [Company legal name], a company registered in [England and Wales] under company number [number], with its registered office at [registered address] (“we”, “us”).
We are the controller of the personal information described in this policy. You can contact us about privacy at [[email protected]]. [If appointed: name and contact details of our Data Protection Officer or UK/EU representative]
This policy explains how we handle personal information when you use the PADS app, visit pads-app.com, or contact our support team. It covers people who use PADS for themselves, people who act as mentors, and website visitors.
PADS is designed so that most of what you write never reaches us in a form we can read. This policy is honest about what we can and can’t see.
Most of PADS works entirely on your phone. The following is stored on your device, encrypted, and we have no access to it:
Your account. To back up your data and connect with a mentor, PADS uses an account. We hold [email address and/or account identifier], the date you created your account, your device type and app version. [Developer to confirm exact fields]
Encrypted backup and sync. If you turn on backup or use more than one device, your data is encrypted on your phone before it is sent. We store it, but we cannot read it. We can see limited technical details needed to run the service, such as [the size of the encrypted data and when it was last updated].
Sharing with a mentor. When you share an item or a Catch-up with your mentor, it is encrypted so that only you and that mentor can read it. We can see that a mentorship exists between two accounts and the permission you chose, but not the content of what you share or the comments on it. Invitation links are single-use and expire.
Talk to someone. PADS opens WhatsApp, Signal or your phone with your message ready. The message is sent by that app, under that app’s own privacy policy. We do not receive it.
Crash reports and diagnostics. [Either: PADS does not send crash reports or analytics. Or: if you agree, PADS sends anonymous crash reports that never include your entries. Developer to confirm and name the provider.]
When you contact support. If you contact us, we receive your name, email address, the topic, your phone model if you give it, and your message. Please don’t include private entries, health details or your recovery phrase.
When you visit our website. Our web host and content delivery network record standard server logs (IP address, browser type, pages requested and the time) to keep the site secure. These are kept for [30 days]. The website sets no cookies for visitors; see our Cookie policy.
Moods, notes and some goals can reveal information about your health or other sensitive matters. The law treats this as special category data. We have designed PADS so that this information stays encrypted and unreadable to us.
Where we would ever process special category data in a readable form (for example, if you choose to include it in a support message), we rely on your explicit consent, which you can withdraw at any time. We will never use AI to read your private entries without your separate, informed consent.
We use a small number of trusted service providers who process information on our behalf and only on our instructions:
Our service providers may store information outside the UK or Australia. Where they do, we use recognised safeguards such as the UK International Data Transfer Agreement or adequacy regulations, and we take reasonable steps under Australian Privacy Principle 8. Your entries are encrypted before they leave your phone, wherever they are stored. [List countries once providers are confirmed]
PADS encrypts data on your device, encrypts anything synced or shared before it leaves your phone, can lock with your fingerprint or phone PIN, and hides its content in your recent apps. We limit access to our systems to the people who need it and use secure connections throughout.
Your recovery phrase protects your data on a new phone. Because we cannot read your data, we cannot recover it without your phrase. Keep it safe; we will never ask you for it.
Under UK data protection law you have the right to access your information, correct it, delete it, restrict or object to how we use it, move it to another service, and withdraw consent at any time. If you live in Australia, the Australian Privacy Principles give you rights to access and correct your information.
Much of this you can do yourself in the app, including deleting your account. For anything else, email [[email protected]]. We will reply within one month. Because most of your data is encrypted on your phone, we may only be able to provide what we hold in readable form.
PADS is intended for people aged [16] and over. We do not knowingly provide accounts to anyone younger. If you believe a younger person has an account, contact us and we will delete it.
If we make important changes, we will tell you in the app or on this page before they take effect. The date at the top shows when this policy was last updated.
If you have a concern, please contact us first at [[email protected]] so we can try to put it right.
You can also complain to the Information Commissioner’s Office in the UK (ico.org.uk) or, in Australia, the Office of the Australian Information Commissioner (oaic.gov.au).
Email [[email protected]], or write to [Company legal name], [registered address].
