Privacy Policy

and then… · Virgos Ventures Ltd.

Effective date: 4 October 2026. Last updated: 4 October 2026.

Your journal is stored in the app on your device. We do not operate a server that stores your journal, and you do not need an account with us. The app does not use AI to read your entries, and we do not use your journal to train AI models.

There are important exceptions to local storage: your phone can back up app data, maps use external services, and you can save or share copies yourself. The app also sends limited usage analytics when Share app usage is enabled. If you contact us or make an optional support payment, information is handled as described below.

1. Who we are and what this policy covers

Virgos Ventures Ltd. ("we", "us" or "our") provides the and then ... mobile app. This policy covers the app and related support communications. It does not cover browsing andthen.today or our other apps.

We are responsible for personal information we handle as a controller, including support correspondence and business records relating to the app.

• Postal address: 71-75 Shelton Street, London, Greater London, WC2H 9JQ, United Kingdom
• Privacy and support email: hello@andthen.today

2. Information kept on your device

The app stores information you choose to create or add, including:

• Your assembled sentences, additional writing, dates and times, and unfinished drafts or edits.
• Photos, videos, sound recordings, drawings and handwriting.
• Saved places and coordinates, people labels, moods and tags.
• Preferences, reminder settings, local progress and information used to organise and find your moments.
• A local record of an optional support payment and information needed to finish or avoid processing the same purchase twice.

The app uses this information to provide the features you request: recording, displaying, editing, searching, organising, exporting and sharing your moments. Search, memory suggestions and connections between entries are calculated on your device. They do not involve sending your writing to an AI service or to us.

Journal content can include sensitive information, depending on what you write or attach. We do not receive a copy through ordinary journaling, and we cannot remotely read, correct, export or delete your local journal for you.

3. Device permissions and local features

You can decline optional permissions and change them in your device settings. A feature that needs a permission may then be unavailable; you can still use the remaining journal features.

• Items shared into the app: when you use another app’s Share action to send supported media or location pins to and then ..., the app stages local copies and adds them to a new or in-progress entry after opening and unlocking. Pending deliveries and imported files remain in app-owned storage until processed or deleted. The app does not fetch remote media or resolve shortened links as part of this import.
• Photos and videos: the app accesses media you select through the device's picker or otherwise authorise, and copies selected attachments into app storage. Choosing a cloud-backed item in a system picker may cause your device's media provider to download it.
• Camera and microphone: these are used for photos, videos and sound recordings you choose to make. Camera setup can request both permissions because it supports video with sound; a photos-only option is available if microphone access is declined. We do not record in the background.
• Location: the place editor can request a foreground location fix when you open it to add a new place, or when you use a current-location control. Map browsing has a separate current-location action. The app does not continuously track your movements or collect location in the background. A place becomes part of your journal when you save it; simply centring the browsing map does not attach your location to an entry.
• Biometrics and PIN: biometric verification is performed by your device. The app receives the authentication result, not your face or fingerprint template. A protected PIN verification record is kept in device secure storage, separately from journal exports.
• Clipboard: when you open the details menu, the app can check which types of content are available. It reads clipboard content only after you choose Paste. It does not continuously monitor your clipboard.
• Reminders and widget: reminders are scheduled locally. The Home Screen widget shows an authored invitation and appearance preferences, not your saved moments, photos or writing.

The app does not request access to your address book or calendar. People labels are journal content, not an uploaded contacts list.

4. Maps and place search

Map features use Apple MapKit on iOS and Google Maps on Android. Place searches use Apple's search service or Android's device geocoding service.

When you search for a place, the search text is sent to the relevant provider. Displaying or moving a map can send the map area, coordinates and technical request information to that provider, including when the map shows a place saved in your journal. This can happen without granting GPS permission. Declining location permission does not make map loading or place search offline.

Providers can also process network and device information. Google's Maps SDK documents collection of IP addresses, device and SDK information, SDK crash information, a pseudonymous SDK identifier and, depending on use, map interactions. These are separate from any analytics operated by us. See Google's Maps SDK disclosure, Google's Privacy Policy and Apple Maps & Privacy.

We do not send your journal writing, photos, recordings or moods as part of a place-search request. You can journal without adding places or using map features.

5. Phone backups

Phone backup is enabled by default in the app. This allows your moments and attachments to be included in backups or supported device transfers managed by your operating system and backup provider, such as Apple or Google. We do not operate those backups or hold a recovery copy.

Actual backup depends on your device settings, provider, available storage and scheduling. The app's switch indicates backup eligibility, not that a complete backup has succeeded. Android cloud backup has a per-app size limit, so a journal with media may exceed it.

You can change this under Settings → Privacy → Phone backup. Turning it off requests exclusion from future backups. On iOS, Apple treats the exclusion setting as a preference, not an absolute guarantee. Switching it off does not erase older backups. Manage existing copies through your backup provider or device settings.

App PIN and biometric protection do not travel with your journal. Set them up again on a restored or replacement device. Backup security and retention depend on your provider and settings; the app does not add its own end-to-end encryption to those backups.

6. Saving and sharing copies

Complete export

Settings → Privacy → Save creates a complete, free journal archive, including attachments, moments in the Bin, drafts, retained edits and relevant preferences. It can also include received moment files retained from earlier app versions. The archive is not encrypted by the app. Your app PIN does not protect the exported file.

You choose where to save or send it. A destination such as a cloud drive, email app or messaging service may store or transfer the file under its own privacy terms. We do not receive it unless you deliberately send it to us.

Sharing a moment

The normal Share action creates a single image of the entire saved entry, including content below the screen, its date, writing and visible attachments, tags and drawings. Video and audio appear as static representations; their original files are not sent separately. The image is accompanied by an app-credit message and website link.

Sharing is not currently selective: review the whole entry and the destination before sending it. Names, locations and other private information visible on the page can appear in the shared image. Complete journal exports contain original attachments, which can also retain embedded metadata such as capture time or location.

The receiving app or person controls the copies they receive. Editing or deleting the original in and then ... does not update, erase or revoke those copies. We cannot recall them.

7. Optional support payments

Optional, one-time support payments are processed by Apple App Store or Google Play. The store handles your payment method and billing information. We do not receive your full card details.

The app receives product, transaction and payment-status information needed to complete the purchase and display a local thank-you. Store purchase services can also check or finish an outstanding transaction when the app starts or resumes. Your journal is not sent with a payment, and there is no app-operated purchase-validation server.

We receive the sales, settlement, tax or transaction reports the stores make available to developers and use them for accounting, payment enquiries and legal obligations. The stores retain their own records under their policies. Deleting app data does not cancel a payment or erase a store's transaction records.

8. Analytics, diagnostics and contacting us

We collect limited information about how the app’s features are used. This excludes your name, email address and journal content. A randomly generated identifier lets us understand usage across visits without knowing who you are.

The app uses PostHog in the United States to produce usage statistics, understand which features people use, identify where interactions fail and improve the app. Share app usage is on by default in the current version. You can turn it off under Settings → Privacy → Share app usage.

The app sends a restricted set of action events, such as opening the app, saving a moment, adding a type of detail, using search or handing an export to the share sheet. Events include the interaction time, app version, platform, a random visit identifier and a random analytics identifier that links visits. For example, an event can say that a mood was added, but never which mood.

Analytics excludes your writing, selected sentence words, mood values, tags, names, dates entered for moments, locations, search queries, media, filenames, clipboard contents and purchase details. There is no session replay, screen recording, automatic interaction capture or crash reporting. IP/geolocation enrichment is disabled, although the receiving network service necessarily sees the connection's source IP address. We do not sell your personal information or use your journal for targeted advertising.

Turning usage sharing off drops unsent events, cancels pending requests and forgets the local analytics identifier. Turning it back on creates a new identifier without uploading past actions. Opting out does not erase events already received by PostHog. Delete All also resets the analytics preference and identifier; collection returns to its default On setting on a subsequent app load. Previously uploaded events follow the retention and deletion arrangements below.

Apple, Google and device providers can collect their own usage and diagnostic information under their settings and policies. Their developer consoles can make reports available to us. Map-provider diagnostics are described in section 4. These services mean that "local journal" does not mean "no network requests or technical data collection anywhere".

If you email us, we receive your email address, message, email metadata and any attachments or device details you include. We use them to answer you, investigate the reported problem and manage the enquiry. Please send only what is needed and remove private journal content from screenshots where possible. You do not need to send us your complete journal to ask for help.

Google hosts our support email and handles messages and attachments so that we can receive and answer your enquiries. Access to support material is limited to people and providers who need it for those purposes.

9. Purposes and legal bases

Where UK or European data protection law applies to information we handle, our legal bases are:

• Providing requested services: information necessary to deal with an app or payment request is used to perform our agreement with you, or to take steps you request before entering it.
• Support and troubleshooting: our legitimate interests in answering enquiries, fixing faults and providing a reliable app, balanced against your rights. Where an enquiry concerns performance of our agreement, that performance can instead be the applicable basis.
• Business records and legal requests: compliance with applicable accounting, tax and other legal obligations. Handling a dispute can also involve our legitimate interest in establishing or defending a legal claim.
• Usage analytics: our legitimate interest in understanding how the app is used and improving its features and reliability, where permitted by applicable law. We limit the information collected, exclude journal content and direct identifying details, and provide a simple way to stop future collection under Settings → Privacy → Share app usage. This interest must be balanced against your privacy rights. Where applicable law requires consent for an analytics activity, that requirement still applies.
• Optional processing that requires consent: your consent, where we separately ask for it. Accepting the Terms of Service or reading this policy is not consent to unrelated processing.

Permissions on your phone control access to device features. They do not give us general permission to use your journal for other purposes. If we need your consent, withdrawing it will not affect processing that was lawful before withdrawal.

We do not make automated decisions about you that have legal or similarly significant effects. Local organisation and suggestions do not determine access to employment, insurance, credit or comparable services.

10. Who can receive information and where it is handled

Information can be handled by the map, operating-system, app-store and backup providers described above; destinations you choose for exports and shares; PostHog for the usage analytics described above; and our email/support provider. The relevant service terms and privacy arrangements also apply to information handled by each provider. Where a provider processes information for its own purposes, its privacy policy describes those uses.

We may disclose information we actually hold to professional advisers, or where necessary to comply with law, respond to a valid legal request, or establish or defend legal rights. This does not give us access to a journal stored only on your device.

Virgos Ventures Ltd. is based in the United Kingdom. Usage events are sent to our PostHog US project. We handle support and business information in the United Kingdom. Google hosts our support email using international infrastructure, so support messages may also be handled outside the United Kingdom.

PostHog and Google state that they participate in the EU–US Data Privacy Framework and its UK Extension. These frameworks provide recognised transfer protections for information covered by their certifications. Their published arrangements also describe standard contractual clauses for transfers where required. The protection that applies depends on the provider, service and transfer. Details are available in PostHog’s Privacy Policy, PostHog’s Data Processing Agreement and Google’s data-transfer frameworks. Contact us if you would like further information about a transfer involving information we handle.

App stores, maps, your chosen backup service and sharing destinations can process information in other countries under their own arrangements. This policy does not promise that all information stays in your country.

11. How long information is kept and how to delete it

• Local journal: kept until you delete it or remove the app's data. Deleting a saved moment normally moves it into the local Bin, where it remains until restored or permanently deleted. To remove it permanently, use Delete forever or empty the Bin. Complete exports include Bin contents. You can also use Settings → Privacy → Delete All for the app's complete deletion flow. This removes journal content, drafts, retained edits, app-owned attachments and temporary copies, and resets app settings and protection. Phone backup returns to its default On setting after a complete reset. Change it again if you want future backups excluded.
• Temporary files: the app creates working copies for capture, import, export and sharing. Cleanup depends on the operation and app lifecycle; we do not promise instantaneous removal after a share. The complete deletion flow includes temporary copies held by the app.
• Exports, recipients' copies and phone backups: remain until deleted from their respective destinations or expired by the provider. Deleting an entry, using Delete All, or uninstalling does not erase these copies. Restoring an older backup can restore previously deleted content.
• Usage analytics: We currently apply no automatic expiry or scheduled deletion to usage events already received by PostHog. We intend to retain these events indefinitely solely for statistical analysis to understand use over time and improve the app, subject to PostHog’s service arrangements and applicable rights to deletion. We use random identifiers instead of names or email addresses, limit access to the information, and do not use it to make decisions about individual people or target advertising. Local opt-out and Delete All do not delete those server-side events. Contact us about applicable rights to information we hold; because events use random identifiers and no account identity, we may be unable to locate your events from your name or email alone. We will explain any identification limits and consider information you can provide without asking for your journal.
• Support correspondence: kept while we handle your enquiry and necessary follow-up. Afterwards, we retain only what is needed for an outstanding complaint, dispute or applicable legal obligation, and remove material when that need ends.
• Accounting and legal records: kept for the periods required by the laws applying to the record, or for as long as needed to resolve a relevant legal claim. We restrict use of records retained for these purposes.
• Store and provider records: retained under the relevant provider's policy. Our local deletion tools cannot erase those records.

We cannot restore lost local content unless you have a usable export or device backup. Local deletion is not a guarantee of forensic erasure from your device or storage media.

12. Security

The app uses private application storage and the protections your device provides. You can add an app PIN or device biometrics to limit access through the app.

The app lock is an access control, not separate encryption of journal files. It does not protect an exported file, a recipient's copy or a backup held elsewhere. Keep your device and its operating system secure, and store exported archives somewhere private. No storage or transmission method can be guaranteed completely secure.

13. Your privacy rights

Depending on the law that applies, you may have rights to access, correct, delete or receive a portable copy of information, restrict processing, withdraw consent, and complain to a regulator. You can use the app's editing, Save and deletion features for the journal on your device. Contact us for requests about information we hold, such as support correspondence.

You can object to processing based on our legitimate interests. You can stop future app-usage collection at any time under Settings → Privacy → Share app usage. For other objections or requests concerning information already held, contact us and explain your circumstances. We will consider the request under applicable law.

We may need limited information to verify a request, but will not ask for your full journal merely to identify you. We respond within the time required by applicable law and will explain if a right is subject to a lawful exception. We do not penalise you for exercising applicable privacy rights.

You can complain to the UK Information Commissioner's Office, or to the relevant data protection authority where you live or work. In the EEA, you can find your authority through the European Data Protection Board. You do not have to contact us first.

14. Age requirements

The app is intended for people aged 13 or older, subject to higher local requirements described in the Terms of Service. It is not directed at children under 13. We do not knowingly collect personal information from children under 13 through support or other channels we operate.

If you believe a child under 13 has sent us personal information, contact us so we can investigate and remove information we should not retain. We cannot remotely inspect or erase a child's local journal. A parent or guardian can use the device's controls and the app's deletion tools.

Where local law requires parental authorisation for a young person's use or for particular consent-based processing, that requirement still applies. This policy does not itself obtain or verify parental authorisation.

15. Changes and contact

We will update the effective date when this policy changes. We will give an appropriate notice of material changes through the app or another suitable channel, and seek consent before new processing where the law requires it. Publishing a revised policy does not itself authorise an upload of your journal or a new use of sensitive information.

For privacy questions or requests, contact hello@andthen.today, or write to Virgos Ventures Ltd., 71-75 Shelton Street, London, Greater London, WC2H 9JQ, United Kingdom.