Privacy Policy

MorrowNest lets you write letters, record voices and keep photos and short videos that stay sealed until a date, a birthday or an age you choose. This policy explains what happens to your data while you do that.

• We collect only what the app needs to work: your account, your date of birth, the people you add, and the keepsakes you create.
• The content of a keepsake is encrypted on our servers. Once it is sealed, no one can open it early, not even you. Our staff tools cannot show it. It is not end-to-end encrypted, and the section on encryption says what that means.
• We do not sell your data and we do not show advertising.
• Analytics is optional, only for adults, and only if you agree. Nothing is tracked for anyone under 16.
• Our servers for the live service are in the European Union.
• You can export or delete your data in the app at any time.

The controller of your personal data under the General Data Protection Regulation (GDPR) is:

AppMinds.dev Inc. ("we", "us"), registered in the Philippines (SEC registration no. 2026070257796-63) Behind Aya's Swiss Bakery, Sto. Niño, Puerto Galera, Oriental Mindoro 5203, Philippines Email: hello@appminds.dev

We have not appointed a data protection officer, because we do not carry out the large-scale monitoring or sensitive-data processing that would require one. Privacy requests go to the email address above. [CONFIRM: DPO assessment with counsel; and, because we are established outside the EU, an EU representative under Article 27 GDPR, to be named here once appointed.]

This policy covers the MorrowNest apps for iOS and Android, the website at morrownest.app [CONFIRM: domain not yet registered], the recipient pages that open a shared keepsake, and our support channels.

Account and sign-in

• Your email address and, if you give it, your name.
• How you sign in: a one-time code sent to your email, Sign in with Apple, or Google. From Apple or Google we receive an account identifier, your email address (or Apple's private relay address) and your name if you share it. We never see a password, because there are no passwords.
• Technical session data that keeps you signed in: session identifiers, the approximate time of sign-in, your device's browser or app type, and your IP address.

Profile

• Your date of birth, which we ask for when you sign up. We use it to apply the age rules in the section on children and teens, and to compute age-based unlock dates.
• Your language, time zone and notification preferences.
• Whether your account is a full account, waiting for a parent's approval, or a receive-only account created by a parent.

People you add

Every user has a private address book of people. For each person you choose what to enter: a display name, a relationship label, a date of birth, an email address, a photo, a language and a time zone. The relationship label is private to you. See "Other people's data" below.

Your keepsakes (capsules), journal and replies

• Content: letters and notes, photos, voice notes, short videos, captions, journal entries, replies, and the small "Then and now" context card that can be added when you seal (the date, a coarse city, the weather, ages, and optional lines such as a song). This is encrypted before it is stored.
• Details needed to run the service: the title and label of a keepsake (encrypted with a key tied to your account, so that you can always see them), who it is for, how it unlocks, its delivery time and visibility, its state, counts of items by type, and who added each entry.
• City and weather: if you choose to add a "Then and now" card, we turn your approximate location into a city name and ask a weather service for the conditions. We discard the exact coordinates immediately and keep only the city. City names come from a geocoder (Photon, run by us on our own servers in production) and the weather from Open-Meteo (Switzerland and EU).
• Photos: we remove location and camera data (EXIF) from stored photos.

Connections and invitations

When you connect with someone through an invite link, QR code or short code, we store that the two accounts are connected and which of your people entries each side linked. We do not let anyone search for users, and we do not read your contacts.

Push notifications

If you allow notifications, your device's push token (from Apple or Google), your device type, app version and language. Notification text can include a sender's name or a keepsake's title when you chose "Announced" visibility. It never contains sealed content.

Purchases

We do not receive your card or payment details. Apple and Google process the payment. Through RevenueCat we receive your purchase and subscription status, the product, the dates (start, renewal, expiry, trial), the store and a store-side transaction identifier. We identify you to RevenueCat by your MorrowNest account ID only.

Analytics (optional, adults only)

If you are 16 or older and agree in the app, we use PostHog (EU region) to count which features are used, so we can improve the app. We configure it not to record the content of what you write. You can turn it off in Settings at any time. We collect nothing for analytics from anyone under 16.

Technical logs and error reports

Our servers keep short-lived technical logs (time, request, status, IP address) to run the service, stop abuse and fix faults. Our servers also send error reports (stack traces and the type of request, no keepsake content) to PostHog's error tracking in the EU.

Messages you send us

If you write to support, we receive your email address, your name if you give it, the topic and your message.

MorrowNest is built around people other than you: a child, a partner, a friend, your future self. When you add someone to your address book, or write something for them, you give us personal data about them: their name, their date of birth and email address, photos of them, and what you write about them.

• Your responsibility. Only add people you have a good reason to include, and only add data you are comfortable with them knowing you hold. A parent adding their own child's details is the normal case. Do not upload another person's data for purposes unrelated to a keepsake you are making for them or about them.
• Our role and legal basis. We handle this data only to provide the service you asked for: storing it, keeping it sealed, and delivering it on the day. Our legal basis is our legitimate interest in providing that service to you (Article 6(1)(f) GDPR), balanced against the interests of the people concerned: the data is private to your account, is not used for analytics or advertising, and is shown only to the recipient it is meant for.
• Recipients. When a keepsake opens, we send it to the person it is addressed to. If they have a MorrowNest account linked to you, it arrives in the app. If you gave only an email address, we email that address a private link that does not expire. You can revoke or resend that link. Opening is recorded so that we can tell you that "Daniel opened your keepsake".
• People who are not users can ask us about data we hold on them (see "Your rights"). We will tell you if the request concerns something you added, to the extent the law allows, but we may need to act on it regardless.
• After delivery a keepsake belongs to its recipient as well. They keep their copy even if you later delete your account.

MorrowNest uses server-side envelope encryption. In plain terms:

• Every keepsake (and every person's journal) gets its own random encryption key. Text and media are encrypted with AES-256-GCM before they reach our database or file storage. The keepsake keys are themselves wrapped by a master key that is kept in our server secrets, separate from the database.
• Sealed entries stay locked: no one can open them early, not even you. The rule is enforced in one place in our server code and covered by automated tests. Neither the author, a co-parent, the recipient nor our staff can read sealed content through the app or through any admin tool. There is no "override" button. Our admin panel shows account and subscription state and delivery problems, never content.
• This is not end-to-end encryption. Our servers must be able to decrypt a keepsake on the day it opens, so our systems hold the keys. That means someone with complete access to our production infrastructure could, in theory, technically get to your data. We protect against this with access controls, separation of keys and data, audit trails and a small number of people with access. We do not claim that this is impossible, only that no product feature and no support process allows it.
• Media is processed on our servers (for example to resize photos and convert audio and video), then stored encrypted again.
• Connections between your device and our servers use TLS.

• To provide MorrowNest (create your account, store, seal and deliver your keepsakes, send you sign-in codes and the notifications you asked for, handle your connections and your subscription): performance of our contract with you, Article 6(1)(b) GDPR.
• To use your date of birth for the age rules and to protect children: our legal obligations and our legitimate interest in protecting minors, Article 6(1)(c) and (f).
• To keep the service safe and working (rate limiting, abuse prevention, fixing errors, backups): legitimate interest, Article 6(1)(f).
• Optional analytics (adults only): your consent, Article 6(1)(a). You can withdraw it at any time without affecting anything else.
• Notifications on your device: the permission you give on your device, together with our contract with you. You can switch each category off in Settings, or in your device settings.
• Handling other people's data you ask us to deliver: legitimate interest, as described above.
• Answering your messages and requests: legitimate interest and, where you ask about your rights, our legal obligations.
• Accounting and legal claims: legal obligation (for example tax and commercial record keeping) and legitimate interest in defending claims.

We do not use your data for advertising, we do not sell it, and we do not make decisions about you by automated means that have legal or similarly significant effects.

MorrowNest is rated 12+ in the app stores and is not directed at young children. Because many keepsakes are about a child, we apply these rules, based on the date of birth given at sign-up:

• 16 and older: a full account.
• 13 to 15: the account is created as "pending parent approval". It can only connect with a parent, who has to approve it. This is how we obtain a parent's consent for a teen's use of the service. After approval the account is a full account, but with no analytics.
• Under 13: a child cannot sign up on their own. A parent can create a receive-only account for their child through the parent's own invite, so that the child can receive keepsakes that were made for them. When the child turns 13 the 13-to-15 rules apply, already approved because the parent linked it. At 16 the account becomes a full account, and the parent is told.
• No analytics and no tracking for anyone under 16. We do not show advertising to anyone.
• Information about a child that a parent adds. A parent can keep a person entry for their child with the child's name, date of birth, photos and the letters and memories written for them. That information is provided and controlled by the parent. It is private to the parent (and a co-parent they invite), is encrypted as described above, and is shown to the child only when keepsakes open. A child's journal entries made by a parent are never visible to the child.
• If you are a parent and believe a child has created an account without your involvement, or you want to see or delete a child's data, contact us at hello@appminds.dev. We will help once we are satisfied that you are the parent.

We use a small number of service providers (processors) who work on our instructions under a data processing agreement. We do not allow them to use your data for their own purposes.

• Hosting and storage. Our servers, database, file storage and backups run on rented infrastructure in the European Union, at Hetzner Online GmbH in Germany or Finland. Production data is stored in the EU. Development and staging environments may be hosted elsewhere and contain only test data, never customer data.
• Resend (Resend, Inc., United States; we use its EU region) delivers our transactional email: sign-in codes, reveal links, notifications and replies to support. It sees the recipient's address, the email text and delivery status.
• RevenueCat, Inc. (United States) manages in-app purchases and subscription status across Apple and Google. It receives your account ID and purchase information, never keepsake content.
• Apple and Google operate the App Store and Google Play, process your payments (they are independent controllers of that data), provide Sign in with Apple and Google sign-in, and deliver push notifications through the Apple Push Notification service and Firebase Cloud Messaging.
• PostHog (PostHog, Inc.; EU cloud, Frankfurt) receives optional analytics events from adults who agreed, and technical error reports from our servers.
• Weather and location lookups for the optional "Then and now" card, as described above: Open-Meteo (Switzerland and EU) for weather, and a Photon geocoder that we host ourselves in production, so no third party sees the location there.
• Our internal tools (such as our code and issue hosting) hold no customer data and are not processors.
• Authorities and advisers. We disclose data if the law requires it, to establish or defend legal claims, or to professional advisers bound by confidentiality. Because sealed content cannot be opened by our tools, we will not be able to provide it to anyone before it opens.
• Other people in the app. A recipient sees what was sent to them, and a connected person sees a keepsake's title and countdown only if the author chose "Teaser" or "Announced" visibility.

If we sell or reorganise our business, the data may move to the new owner, bound by this policy.

Our production data stays in the EU. Some providers named above are based in, or have group companies in, the United States (Resend, RevenueCat, Apple, Google and PostHog's parent company). Where personal data is made available to them, we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework, together with additional safeguards. Resend is used through its EU region; RevenueCat is based in the US. [CONFIRM: DPF certification and signed data processing agreements per provider.] You can ask us for a copy of the safeguards at hello@appminds.dev. Our own company is established in the Philippines; personnel there may access EU-hosted data only for support and operations, under the same safeguards.

• Account, profile, people, connections: until you delete your account.
• Keepsakes: until they are delivered or you delete them. A sealed keepsake is kept until its unlock day. After delivery, the recipient has their own copy. Deleted keepsakes go to a trash for a restore period of 30 days, then are permanently removed.
• Journal entries: until you delete them or your account.
• Reveal links for email recipients stay valid until you revoke them or the keepsake is deleted.
• Notifications and push tokens: push tokens until you sign out of the device or the token becomes invalid.
• Sign-in codes: minutes. Session records: until they expire or you sign out. Rate-limit counters: up to 24 hours.
• Server logs: 14 days.
• Purchase records: as long as your account exists and for the period tax and accounting law requires us to keep invoices and transactions. [CONFIRM: statutory period in the Philippines and any EU country concerned.]
• Support messages: 24 months after the matter is closed.
• Analytics events: 12 months, and deleted when you withdraw consent or delete your account where technically possible.
• Backups: we keep encrypted off-site backups for 30 days. Data you delete disappears from live systems at once and from backups when they expire. If we ever restore a backup, we first re-apply all deletions made since.

You can delete your account in the app (Profile, Privacy and security). We ask one question first: "Deliver pending gifts anyway?" The default is yes.

• If you say yes, we keep only what each pending keepsake needs for delivery (the encrypted content, who it is for, and when it opens) and delete everything else about you, including your profile and your journal. Those keepsakes are still delivered on their day, as you promised the recipients. Once delivered, they belong to the recipients.
• If you say no, pending keepsakes are deleted with your account.
• Keepsakes that were already delivered stay with their recipients. A co-parent keeps access to the child's archive and to entries already written; neither co-parent can remove the other's entries.
• We cannot delete data we must keep by law, such as purchase records, and backups age out as described above.

Under the GDPR you have the right to:

• access the data we hold about you and receive a copy (Article 15). In the app, "Export all my data" gives you a zip with JSON and media for your opened and draft content, and metadata only for sealed keepsakes, because sealed content cannot be opened early;
• correct inaccurate data (Article 16);
• erase your data (Article 17), subject to the limits described above;
• restrict processing in certain cases (Article 18);
• receive your data in a portable format (Article 20);
• object to processing based on our legitimate interests (Article 21), and withdraw consent at any time, for example for analytics;
• not be subject to automated decisions with legal or similarly significant effects (Article 22). We do not make any.

To use these rights, use the settings in the app or write to hello@appminds.dev. We answer within one month. We may ask you to confirm who you are. If you have a complaint, you can contact the data protection supervisory authority in your country. For users in the Philippines this is the National Privacy Commission. [CONFIRM: competent EU authority, to follow from the Article 27 representative's seat once appointed.] We would appreciate the chance to put things right first.

Users in the United Kingdom, Switzerland, Brazil and other regions may have similar rights under local law; you can use the same contact.

• The apps do not use cookies. They store a session token and your settings on the device.
• On the website and recipient pages we use only strictly necessary storage: a session cookie when you sign in, and a cookie or local storage entry that remembers your chosen language. These do not need consent.
• The landing page, this policy, the terms and the support page contain no advertising or tracking scripts and load no third-party resources.

Besides encryption: sign-in by one-time code, Sign in with Apple or Google (no passwords to leak); optional Face ID or fingerprint app lock; rate limits on sign-in and sharing; strict separation between our application, database and key storage; and monitoring. If a personal data breach puts your rights at risk we will notify the authority and, where required, you, as the GDPR provides.

We will update this policy when the service or the law changes. The date at the top shows the last substantive change. If a change matters to you, for example a new kind of data use, we will tell you in the app or by email before it applies and, where needed, ask for your consent again.

Privacy questions and requests: hello@appminds.dev Post: AppMinds.dev Inc., Behind Aya's Swiss Bakery, Sto. Niño, Puerto Galera, Oriental Mindoro 5203, Philippines

General help: the support page.