DVTD Privacy Policy

The app records this as you use it

• Which cards you have drawn, and when

• Which cards you marked completed or skipped

• Which decks you have marked as favourites

• Your notification preferences, chosen times, and time zone

• Whether you have an active subscription, and which plan

• A push notification token, if you allow notifications

We do not collect

• Location data

• Contacts, photos, or anything else on your device beyond what you record in the app

• Advertising identifiers. There is no advertising in DVTD, and we do not sell or share data with advertisers

• Analytics about your behaviour inside the app beyond what is listed above

We do not use your recordings to train artificial intelligence models, and we do not licence them to anyone who does.

2. Recording other people

This is the part that matters most, so please read it.

When you record someone in DVTD, you are creating a recording of another person's voice. Before you do, DVTD asks you to confirm that they know you are recording and are happy for you to keep it. That confirmation is stored against their entry.

That tick box is not a legal formality we invented. In Australia, laws about recording conversations differ between states and territories, and in some circumstances recording a person without their knowledge is a criminal offence. You are responsible for having their permission. We cannot verify it for you.

If you are recording a child, you must be their parent or legal guardian, or have that person's permission.

If someone you have recorded asks for their recordings to be deleted, contact us at [PRIVACY EMAIL] and we will remove them, whether or not they are the account holder.

3. Sharing an archive with another person

DVTD lets you invite one or more other people into an archive so you can both listen and record. If you do this:

• They can hear every recording and read every note in that archive, including ones made before they joined

• They can add their own recordings

• They cannot delete anything. Only the person who created the archive can do that

• You can remove their access at any time. Recordings they made stay in the archive

Invitations work by a six character code that expires after seven days and can be used once. Anyone who has the code can join that archive, so treat it like a password.

4. Where your data is held

Your account details, card history and written notes are stored in a Postgres database hosted by Supabase in [REGION]. Recordings are stored in Supabase's file storage in the same region, in a private bucket. They are not publicly accessible, and playback works through short-lived links generated only for people with access to that archive.

We use these third parties, and only these:

Provider What they handle Where Supabase Database, accounts, file storage [REGION] RevenueCat Subscription status United States Apple / Google Payment processing Per their own terms Expo Push notification delivery United States

We never send your recordings, notes, or the names of people you record to RevenueCat, Apple, Google or Expo. RevenueCat receives an anonymous account identifier and what you bought. Push notifications contain a prompt to open the app, never the content of a card or an answer.

If your data is transferred outside Australia, it is to the providers listed above for the purposes described.

5. How long we keep it

Your recordings do not expire when your subscription does. If you stop paying, you lose the ability to draw new cards, but everything you have already recorded stays in the app and stays readable. We built the system that way deliberately. It is a promise, not a temporary policy.

We keep your data until you ask us to delete it.

Deleting things

• A single answer: delete it in the app. The recording is removed from storage at the same time.

• A person's whole archive: contact us at [PRIVACY EMAIL].

• Your entire account: contact us at [PRIVACY EMAIL]. We will delete your account, your recordings, your notes and your history within 30 days.

One thing to be aware of: if you share an archive with someone else and then delete your account, we will contact the other person before removing recordings they rely on, because those recordings may be the only copy of something that matters to them.

Backups are retained for up to 30 days after deletion, after which deleted data is gone from those too.

6. Security

• All traffic between the app and our servers is encrypted in transit

• Recordings sit in a private storage bucket and are never publicly listable

• Database access is enforced row by row, so one account cannot read another's data even if the application code were wrong

• Passwords are hashed, never stored in a readable form

No system is perfect. If we ever become aware of a data breach that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

7. Your rights

Under the Australian Privacy Act 1988 and the Australian Privacy Principles, you can:

• Ask what personal information we hold about you

• Ask for a copy of it

• Ask us to correct anything wrong

• Ask us to delete it

• Complain if you think we have mishandled it

Email [PRIVACY EMAIL]. We will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

If you are in the UK or EU, you have equivalent rights under the UK GDPR and GDPR, including data portability and the right to object to processing. The same email address applies.

8. Children

DVTD is intended for adults. You must be 16 or older to hold an account.

The Raising deck is designed for a parent to use with their child. In that case the account belongs to the parent, and any recording of a child is made by their parent or guardian. We do not knowingly allow anyone under 16 to create an account.

If you believe a child has created an account, contact [PRIVACY EMAIL] and we will remove it.

9. Subscriptions

Subscriptions are billed by Apple or Google, not by us. We never see your card details. RevenueCat tells us only whether your subscription is active and when it expires.

Cancel any time through your App Store or Google Play account. Cancelling stops future billing and ends access to drawing new cards. It does not delete your recordings.

10. Changes to this policy

If we change this policy in a way that materially affects how we handle your recordings, we will tell you in the app before the change takes effect, not just quietly update this page.

11. Contact

[LEGAL ENTITY NAME] [ADDRESS] [PRIVACY EMAIL]