Privacy Policy

What we collect

All of it comes from you, and all of it is used to run the service you signed up for.

What you give us when you make an account

• Your email address. It is how you sign in, how the weekly question reaches you, and how the digest comes back. If you sign in with Apple and choose to hide your address, we receive Apple's private relay address instead and that is all we ever see.
• Your name. It goes on your answers so your family knows who wrote them. It is shown to the people in your own circles and to nobody else.
• An account identifier we generate, and, if you sign in with Apple, the stable identifier Apple gives us for you. That identifier lets us recognize you on your next sign-in. It cannot be used to look you up in any other app.

What you give us when you answer

• What you write. Your answers, and any questions you add to a circle's queue.
• Photos you attach to an answer, and a profile picture if you set one. We do not accept video.
• Audio, if you answer by voice. A voice answer is kept as the recording you made. We do not transcribe it - nothing we run turns your recording into text, on our servers or on your phone. We never ship your voice to a transcription company, and no third party hears it. If we ever add transcription it will run on your own device, never on our servers or anyone else's - your phone would turn the recording into text and send us the text alongside it, and we would say so here before it happened.

What your device gives us

• A push notification token, if you turn on notifications. We store it so we can tell your phone that a question opened or a digest is ready. It is meaningless to anyone but Apple's notification service.
• Device details, on the way to a purchase in the iPhone app. When the app contacts RevenueCat - see The website and the app for exactly when - RevenueCat's software sends an identifier Apple gives this app on your phone, your phone's model, its iOS version, your preferred languages and your App Store country. RevenueCat holds these on our behalf; we do not store them ourselves.
• The IP address you sign in from. Your account keeps the address of your current and previous sign-in, on the web and in the app alike, as part of its sign-in record. It is there to be looked at if we ever need to investigate something going wrong with an account. We do not use it to work out where you live, and it goes when your account goes.

What we keep if you subscribe

• A record of your subscription. The plan, whether you bought it on our website or in the iPhone app, its price, whether it is active, cancelled, refunded or expired, the dates of the period you have paid for, and the reference numbers Stripe or Apple gives the purchase. We keep it so the service knows what your account has paid for. Your card details are not part of it.

What we do not collect

We want to be specific rather than reassuring, so here is the list. We do not collect your location, health or fitness data, your contacts, your calendar, your browsing or search history, or financial information such as your card or bank details. Neither the app nor the website asks your device where it is. On the website, Stripe takes the payment and handles your card details directly. In the iPhone app, Apple takes the payment from your Apple account. Either way, your card details never reach the app, and they never reach us.

Who can see your answers

While a question is open, your answer is yours. Nobody else in the circle can read it yet.

When the question closes, the answers become readable by the people in that circle. The digest email follows the close - sometimes right behind it, sometimes later, depending on the rhythm the circle is set to. So if you open the app after the deadline you may find the answers already there before the email arrives. It is the same moment either way: the question closes, and the circle can read what everyone wrote.

Answers stay readable to that circle afterward. That is the point of the product - the archive is the thing you are building, and a family should be able to go back and read 2015 in 2035.

Two honest exceptions. Our staff - which today means one person, the founder - can technically reach the database, and does so only to fix something that is broken or to answer a support request you sent us. And we will disclose information if a valid legal process requires it, which has never happened.

How we use it

• To run the weekly cycle: send the question, take your answer, close the question, send the digest.
• To show your family your answers, and to keep them readable in the archive.
• To send you service email - a question, a digest, a reminder that a question closes soon, a receipt, a password reset.
• To send push notifications, if you turned them on.
• To take payment for a subscription: through Stripe on the website, or through Apple in the iPhone app, with RevenueCat telling us when an App Store subscription starts, renews or ends.
• To count subscriptions - how many people subscribe, renew and cancel. For purchases made in the iPhone app, RevenueCat does this counting for us, from its purchase records.
• To answer you when you email support.
• To keep the service working and secure - fixing errors, preventing abuse.

That is the complete list. We do not use your answers to train machine-learning models, and we do not read them to build a profile of you.

What we never do

• We never sell your personal information, and we never share it with data brokers.
• We never show you advertising, and we do not work with ad networks.
• We do not track you across other companies' apps and websites, and we do not let anyone else do it through us.
• The iOS app contains no advertising, tracking or crash-reporting code from another company. The one piece of another company's code in it is RevenueCat's, which handles subscriptions bought in the app. What it receives is set out below, and it is never anything you write.

The website and the app

The two are not identical, and it would be dishonest to describe them as one thing.

The website measures its own traffic using a tool called Ahoy that runs on our own servers - not a service we send your visits to. It records which pages were viewed and a handful of in-app events, and it sets a first-party cookie so that several page views in a row can be counted as one visit. In these traffic records the IP address is masked before it is stored, and we never look up a location from it. (The sign-in addresses described above are a separate thing, kept on your account rather than in the traffic records.) That is the extent of it: no third-party analytics, no advertising pixels, no session recording.

Email. We keep a record of the messages we send you, and we note when you click a link in one, so we can tell whether the weekly question is actually arriving. Links in our email carry a tag identifying which message they came from, which is how that click gets counted. We do not use invisible tracking pixels to detect whether you opened an email.

The iOS app has no analytics. It talks to our servers, to the storage that holds your photos and recordings, and to Apple - for notifications, Sign in with Apple and purchases. It starts talking to RevenueCat, which handles subscriptions bought in the app, only when a purchase is involved, as the next paragraph sets out.

The app starts contacting RevenueCat only when you open the screen where Family is sold, tap Restore Purchases, or when the Apple account on that phone has already bought Family in the app, so that what you buy lands on your account. If none of those has happened on that phone since the app last started up, the app does not contact RevenueCat at all. When one does, the app tells RevenueCat the account number of whoever is signed in and, as RevenueCat's software does with every request, an identifier Apple gives this app on your phone, your phone's model, its iOS version, your preferred languages, your App Store country and the app's version - but not your name, not your email address, and nothing you write. Like any server, RevenueCat also sees the internet address each request comes from. When you buy or restore a subscription, RevenueCat receives Apple's record of the purchase as well. After that, the app keeps RevenueCat's record for that phone up to date, checking in again whenever you come back to it, until the app is fully closed (swiped away, or shut down by your phone) - even if you sign out and someone else signs in. Once sign-out has finished, RevenueCat's check-ins from that phone carry its device details under a new anonymous number, and they do not name the next person who signs in unless one of those things happens for them too.

You can use the service entirely by email if you prefer. Answering by replying to the weekly question works, and it is how several members of the original family circle have always used it.

Where your information lives

On servers in the United States. If you are writing to us from outside the US, your answers are stored in the US.

We use a small number of companies to run the service. Each one is listed with exactly what it touches, so you can see the shape of it rather than take our word for it:

• Heroku - runs the application and the database.
  Data accessed: everything stored in the account - your name, email address, answers, and account records.
• Amazon Web Services (S3) - stores the files you upload.
  Data accessed: photos, profile pictures, and voice recordings.
• Stripe - takes payment for subscriptions bought on our website.
  Data accessed: email address, billing details, and card information, which goes to Stripe directly and never reaches us.
• RevenueCat - keeps track of subscriptions bought in the iPhone app, and tells us when one starts, renews or ends.
  Data accessed: your account number with us, which the app first gives it when you open the screen where Family is sold, tap Restore Purchases, or when the Apple account on that phone has already bought Family in the app; with that and every later request until the app is fully closed, an identifier Apple gives this app on your phone, your phone's model, its iOS version, your preferred languages, your App Store country, the app's version and the internet address the request comes from; and, for anything you buy in the app, Apple's purchase receipts and transaction ids, the product, its price and currency, the dates of the period paid for, and whether the subscription is active, cancelled, refunded or expired.
• Resend - delivers our email.
  Data accessed: email address, and the contents of the messages we send you - which for a digest means the answers inside it.
• Apple - delivers push notifications, handles Sign in with Apple if you use it, and takes payment for subscriptions bought in the iPhone app.
  Data accessed: your device's notification token and the short text of a notification; for sign-in, the identifier Apple gives us and the address, real or relayed, that you chose to share; for a purchase in the app, the payment itself, which Apple takes from your Apple account under its own privacy policy and never shows us.

Apple and Stripe handle a payment under their own privacy policies, as any payment processor does. RevenueCat processes your information on our behalf, to provide in-app purchases for us, under a data processing agreement. That agreement also lets RevenueCat use the data to keep its own service secure, to meet its legal obligations, and to build and improve its service, but not to serve any of its other customers. The rest may use your information only to provide their part of the service to us. There is nobody else on this list: no advertising network, no data broker, and no analytics company watching how you use the service. Apple, Stripe and RevenueCat also report to us on the subscriptions they handle - how many people subscribe, renew and cancel.

How long we keep it

Your answers stay until you delete them or delete your account - keeping them is the product. Server logs are kept briefly, for days rather than months, and are used to diagnose problems. Billing records are kept as long as tax and accounting rules require.

If something goes wrong

We protect your family's answers as carefully as we know how. If despite that there is ever a breach affecting your personal information, we will tell you - not bury it, not wait to see whether anyone notices.

We will notify the people affected without unreasonable delay after we discover it, as Tennessee law and any other applicable law require. We will tell you what happened, what of yours was involved, and what we are doing about it, in the same plain language as the rest of this page.

Deleting your account

In the app: go to Profile, then Delete Account. It asks you to confirm, and then it is done. Deleting your account removes your profile, your answers and any transcripts, your photos and audio, your notification tokens, and your sign-in records. It is permanent. There is no undo and no grace period, so if you want to keep what you wrote, save it first.

On the website: open Account settings from your account page and use Cancel my account at the bottom. It asks for your current password, and then it is done - the same deletion, in the same words, as the one in the app.

If you would rather we did it: email us at support@answers2answers.com from the address on your account and we will delete it. We aim to do it within a few days and will write back when it is done. This is also the way through if your account is linked to Apple, because Apple has to confirm that deletion itself and only the app can ask it to.

If you subscribe, deleting your account cancels a subscription you bought on our website. It does not cancel one you bought in the iPhone app: Apple keeps charging for it until you cancel it in Settings, so cancel it there first. Apple and RevenueCat each keep their own record of an in-app purchase after your account is gone, and RevenueCat's is filed under your account number.

If you would rather have your information than erase it, ask us and we will send you a copy of what we hold.

Children and family circles

This is a product for families, and children answering questions alongside their parents is one of the things it is for. We have tried to write this section the way it actually works rather than the way these sections usually read.

You must be at least 13 years old to hold an account of your own. For a younger child, a parent or guardian creates and controls the account, holds its password, and stays responsible for how it is used. The account belongs to the adult; the child answers through it.

Because the adult holds the account's password, they can sign into it and read that account's own answers whenever they like, including before a question has closed. That is not a special parental power - it is how every account works, since your own answers are always visible to you. What the adult does not get is any earlier view of what other people in the circle wrote; those still wait for the close, the same as for everybody else.

A parent can delete the account, and everything the child wrote in it, at any time.

We do not knowingly let a child under 13 hold an account of their own. If you believe one does, write to us and we will remove it.

Changes to this policy

If we change this policy in a way that matters, we will email the address on your account at least 30 days before it takes effect, and the effective date at the top of this page moves to the new date.

Smaller corrections - a typo, a sentence made clearer, a service renamed - move only the last-updated date. The effective date stays where it is, because nothing about what we actually do has changed, and it should not look as though you agreed to something new when you did not.

We will not quietly start doing something this page says we do not do.

Contact us

Write to support@answers2answers.com. A person reads it. We aim to respond within 30 days, and usually a great deal sooner.

Answers to Answers is operated by
Thede Technologies, LLC
Knoxville, Tennessee, United States

The Terms of Service cover the rest of the arrangement, including how a dispute gets settled.