Faffalot Plus Privacy Policy

Last updated: 13 October 2026

1. Who we are and what this policy covers

Faffalot Plus is provided by Faffalot Designs Ltd, a company registered in Scotland, company number SC891783. Our registered office is 3 Queen Street, Edinburgh, Scotland, EH2 1JE.

This policy covers Faffalot Plus and enquiries you send us about it. It does not cover the separate Faffalot and Faffalot Shower apps or general browsing of our website.

Faffalot Designs Ltd is the data controller for personal information processed on our behalf to operate subscriptions and handle support. This means we are responsible for deciding why and how that information is used, even where a service provider processes it for us.

Contact: fiona@faffalot.com

2. Your tasks and routines

The optional display name, preferences, tasks, routines, schedules, appointments, completion history and progress you enter or generate in the app are stored locally on your device.

The app does not upload that content to us, RevenueCat, an app backend, an AI service or an advertising service. We do not operate a cloud database of your tasks or routines.

You do not need a Faffalot account or to give us an email address to use Plus. Your Apple Account is used separately for App Store purchases.

“Help me” supports manual task breakdown; it does not send tasks to an AI service. “Faffalytics” displays progress from locally stored history.

Local storage does not mean information can never leave your device. Device backups, notifications, diagnostics and information you choose to send us are explained below.

3. Subscriptions: Apple and RevenueCat

Apple processes App Store purchases and payments under its own terms and privacy arrangements. RevenueCat helps us verify purchases, restore subscriptions and determine whether Plus access is active.

RevenueCat processes a generated customer identifier, purchase and subscription records, receipt or transaction information, and technical information. Depending on the SDK and what is available, this includes Apple’s vendor-scoped device identifier (IDFV), app/build version, operating system, device model, locale and App Store region. Its servers also receive the IP address used to connect.

These identifiers are not your name or a Faffalot email login, but they can distinguish a device or customer and may be personal data. IDFV is different from Apple’s advertising identifier.

The app communicates with RevenueCat at startup, when checking or refreshing subscription access and, when needed, for pricing, offer eligibility, purchases and restoration. RevenueCat does not receive your display name, task content, routines, appointments or progress from the app.

We can access subscription records and associated identifiers through RevenueCat for subscription administration and support. This does not give us access to the contents of your local tasks or routines. We do not receive your full payment card details through this integration.

Our lawful basis for information necessary to provide and verify your subscription is performance of our contract with you. Where necessary, we rely on legitimate interests to prevent misuse and resolve technical problems, and legal obligations for records the law requires.

RevenueCat acts as our processor for subscription data handled on our behalf and uses service providers to operate its systems.

4. Expo Insights and app-launch analytics

Expo Insights has been excluded from new iOS and Android builds prepared for this release. The updated app therefore does not use that component to send app-launch analytics to Expo.

This change does not remove the information processed by Apple or RevenueCat as described elsewhere in this policy.

Older test builds may contain different components. Updating to the latest build applies the change; it does not delete any information previously transmitted by an older build.

5. Notifications, backups and local records

Notifications

Appointment and routine reminders are scheduled locally through your device’s operating system. The current app does not register new installations for Expo remote push notifications.

Appointment titles may appear in notification previews, on your lock screen or on linked devices, depending on your settings. You can control notification permissions and previews in your device’s Settings.

Turning notifications off within Faffalot Plus cancels scheduled routine and appointment reminders. Your saved appointments and routines remain stored in the app.

An installed notification component may communicate an updated device push token and associated installation/application identifiers to Expo if an installation retains previously enabled remote-push registration. This was not found active for a fresh installation of the inspected app, but historical installations have not been fully verified. This is separate from the Expo Insights component excluded from new builds.

Device backups

Device backups may include some local app information, including tasks, routines and progress, depending on your settings. Backups are handled by your device or backup provider; Faffalot Plus does not provide its own cloud synchronisation.

Local storage

The highest XP total is also stored in the device’s secure Keychain storage and may survive deleting and reinstalling the app. Other local content uses ordinary app storage; we do not claim that all app content has separate app-level encryption.

Diagnostic logs

The updated app’s diagnostic logging uses fixed messages rather than logging appointment titles, appointment identifiers, scheduling times, notification-response contents or XP values. Raw error objects and RevenueCat SDK log messages have also been removed from application logging. No separate production service uploading application console logs was found in the inspected app.

6. Apple diagnostics and TestFlight

Apple may process download statistics, diagnostic and usage information through its platform services. If you use a TestFlight version, Apple also handles testing information such as crash reports, usage and feedback submitted by testers. Apple may make relevant reports available to us under those arrangements.

You can review diagnostic-sharing settings under Settings → Privacy & Security → Analytics & Improvements. TestFlight has separate testing arrangements.

Apple’s privacy information:

https://www.apple.com/legal/privacy/

TestFlight privacy information:

https://www.apple.com/legal/privacy/data/en/test-flight/

7. Support correspondence

If you email us, we receive your email address and the information you choose to include, such as your name, message or screenshots. The app does not automatically attach your tasks, appointments or diagnostic logs to support emails.

We use correspondence to answer questions, resolve problems and deal with complaints. Our lawful basis is our legitimate interest in providing support and maintaining the app, while respecting your privacy. Where necessary, processing also supports our contract with you or meets a legal obligation.

Our email provider processes correspondence to deliver and store it. Please avoid sending sensitive information that is not needed to explain the issue.

We do not add you to an email marketing list.

8. Advertising and other processing

The inspected native app has no enabled advertising, advertising tracking, general screen-tracking service or AI request flow. No separate remote crash-reporting service or upload of application console logs was found.

We do not sell your personal information or use your task content for advertising. Subscription access decisions use purchase status; we do not profile your task content to make decisions with legal or similarly significant effects.

9. Processing outside the UK

RevenueCat processes subscription information in the United States and uses service providers listed in its Data Processing Addendum. Its agreement provides contractual safeguards for relevant UK international transfers, including the UK Addendum to Standard Contractual Clauses.

You can read about these arrangements or contact us to request information about the applicable safeguards:

https://www.revenuecat.com/dpa

Apple handles information under its own international processing arrangements.

Our support email provider may process correspondence outside the UK, depending on its services and hosting arrangements. Where information is transferred on our behalf, we are responsible for ensuring applicable transfer requirements are met.

The possible historical Expo push-registration processing described in section 5 may also involve processing outside the UK. Excluding Expo Insights from new builds does not, by itself, establish that all historical push-registration processing has ended.

10. Retention and deletion

Information on your device

Local tasks and preferences remain on your device until changed or removed. Deleting the app generally removes ordinary local app storage, but does not necessarily remove the Keychain XP record or copies in device backups. Apple’s “Offload App” option may retain app data.

We cannot remotely retrieve or delete your locally stored task content. Backup copies must be managed through your device or backup provider.

Subscription records

Subscription records do not disappear merely because you cancel your subscription or delete the app. We retain records processed on our behalf only as needed to administer and restore purchases, resolve disputes, prevent misuse and satisfy applicable legal requirements. We delete or anonymise records when they are no longer needed for those purposes.

Apple controls retention of records it holds under its own privacy arrangements.

Support correspondence

We keep support correspondence only as long as reasonably necessary to handle the enquiry, related follow-up, complaints and legal requirements, and review whether it remains necessary.

Requesting deletion

For deletion of information held on our behalf, contact us. We may need limited information to locate the relevant subscription record because the app does not use named accounts. We will request only what is necessary.

Deleting a subscription record is separate from cancelling Apple billing, and may affect restoration if it removes information needed to recognise access.

11. Your rights

Depending on the circumstances and applicable law, you may have rights to:

• Access your personal information.

• Correct inaccurate information.

• Request deletion.

• Restrict processing.

• Object to processing based on legitimate interests.

• Receive or transfer certain information.

• Withdraw consent where processing is based on consent.

Email fiona@faffalot.com to make a request. We normally respond within one month, subject to lawful extensions. We may need to verify your request proportionately.

You can complain to the UK’s Information Commissioner’s Office:

https://ico.org.uk/make-a-complaint/

12. Children

Faffalot Plus is intended for users aged 13 or over, as stated in its terms. Users under 18 should have a parent or guardian’s permission, and purchases must be authorised by the Apple Account holder.

The app does not ask children to create a Faffalot account or submit their name or email to us. Subscription identifiers and technical information may still be processed as described above. A parent or guardian can contact us with privacy concerns.

13. Changes to this policy

We will update this policy if our processing changes and revise its date. We will bring material changes to your attention through the app where appropriate and obtain consent where required.