Privacy Policy

1. Who is the data controller

The data controller for App a Day is:

If you are in the European Economic Area, the General Data Protection Regulation (GDPR) gives you the rights described in section 9. You can exercise them by emailing us at the address above.

2. What data we collect

We collect the minimum data needed to verify your subscription. Specifically:

We do not collect, and the app does not request permission to access:

• Your name
• Your email address
• Your phone number
• Your contacts or address book
• Your precise or coarse location
• Your photos, videos, or other files
• Your microphone
• Your camera
• Your calendar or reminders
• Your health or fitness data
• Your advertising identifier (IDFA / GAID)
• Your browsing history
• Crash or performance data sent to third parties
• Any other personal data not listed in the table above

3. How and why we use it

We use the device identifier and subscription status for one purpose only: to determine whether your device is currently entitled to the paid features of App a Day, and to unlock them if so. Concretely:

• When the app starts, it asks the App Store or Google Play directly, on your device, whether your store account has an active subscription to App a Day.
• The app tells our server the answer and, if there is one, which product it is — so the server knows which tier of features to unlock.
• If there is no active subscription, we show the paywall. Ideas already delivered to you stay readable.

We do not use the identifier to build a profile of you, to target advertising, to retarget you across other apps or websites, to personalise content, to make automated decisions that produce legal or similarly significant effects, or for any purpose outside what is described in this policy.

4. Legal basis for processing (GDPR)

If you are in the European Economic Area, our legal bases under the GDPR are:

• Performance of a contract (Art. 6(1)(b) GDPR) — processing the device identifier and subscription status is necessary to deliver the App a Day service you have subscribed to.
• Legitimate interests (Art. 6(1)(f) GDPR) — keeping server access logs is necessary to operate, secure, and debug the service, and to prevent abuse. We balance this against your rights and conclude the intrusion is minimal because logs are short-lived and not used to profile you.
• Legal obligation (Art. 6(1)(c) GDPR) — keeping billing records for the retention period required by applicable tax and accounting law.

We do not rely on consent for any processing. Where consent would otherwise be required (for example, under the ePrivacy Directive for non-essential cookies or trackers), we have engineered the service not to need it.

5. Service providers

We share the minimum data necessary with the following third-party processors. Each is bound by a contract that limits what they can do with your data.

We do not sell, rent, lease, or otherwise commercially share personal data with anyone outside the list above. We do not allow our processors to use the data for their own purposes.

6. How long we keep it

• Device identifier and current subscription status: kept for as long as your subscription is active. If you cancel and do not reactivate within 90 days, the record is deleted.
• Billing records (invoice metadata, transaction IDs, amounts, dates): kept for up to 7 years after the last transaction, as required by applicable tax and accounting law, then deleted.
• Server access logs: retained for up to 30 days, then deleted or fully anonymised.
• Backups: encrypted and held in the same region as primary data. They are aged out on the provider's standard rolling schedule (typically 30 days) and are not used to restore deleted records.

7. How we protect it

We take reasonable technical and organisational measures to protect the data we hold. These include:

• HTTPS for all traffic between your device, the app stores, and our servers.
• Encryption of the database at rest using industry-standard provider-managed encryption.
• Encrypted, regional backups.
• Restricted access to production systems on a least-privilege basis.
• Separation of subscription and analytics data so that a single identifier cannot be linked to anything else.

No system is perfectly secure. If we become aware of a personal-data breach that is likely to result in a high risk to your rights, we will notify you and the competent supervisory authority in accordance with applicable law.

8. International transfers

Our servers and database are located in the European Union. When we share data with the processors listed in section 5, that data may be transferred to and processed in countries outside the EEA — in particular, the United States, where Apple and Google are headquartered.

Where this happens, we rely on the European Commission's Standard Contractual Clauses (or other lawful transfer mechanism recognised under GDPR) to ensure your data remains protected to GDPR standards. Apple and Google both participate in the EU–US Data Privacy Framework.

9. Your rights

Subject to applicable law (including GDPR if you are in the EEA), you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten") of your data, subject to the retention rules in section 6.
• Restriction of processing in certain circumstances.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, where processing is based on consent (we currently do not rely on consent, but if we ever do, you can withdraw it).
• Lodge a complaint with your local data protection authority. We would prefer you write to us first so we can try to resolve it directly.
• Cancel your subscription in your phone's subscription settings at any time. The app never makes you email support to leave. Cancelling stops future renewals; it does not refund the current period.

To exercise any of these rights, email info@devmul.com. We will respond within 30 days. We may need to verify your identity before acting on a request — typically by asking you to confirm control of the device in question — so we do not delete or export the wrong record.

10. Children

App a Day is not directed at children under the age of digital consent in their country (13 in most jurisdictions, 16 in some EEA member states), and we do not knowingly collect personal data from them. Because we do not ask for any personal information, we have no practical way to tell a child's device from an adult's. If you believe a child has signed up using your device and you would like the record deleted, email info@devmul.com and we will action the request.

11. Changes to this policy

We may update this policy from time to time. When we make a material change we will update the "Effective" date at the top and, where appropriate, surface a notice inside the app before the change takes effect. Past versions of this policy are available on request.

12. Contact us

If you have any questions about this policy, want to exercise your rights, or want to report a concern, please contact us:

We read every message that lands in this inbox and aim to reply within a few working days.