Privacy Policy

Geoffrey Pascoe ("we", "us", or "our") operates the Digby website and Android application (together, the "Service").

This Privacy Policy explains what personal information we collect, how we use and protect it, where it is stored, and the rights available to you.

We are based in Australia, and our application infrastructure is hosted in Finland.

We aim to handle personal information in accordance with applicable privacy laws, including, where applicable, the Australian Privacy Act 1988 and Australian Privacy Principles ("APPs"), the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and applicable United States privacy laws.

1. Information we collect

1.1 Information about your account

Depending on how you use the Service, we may collect:

• your name;
• email address;
• authentication information;
• account and subscription information;
• reminder and application preferences; and
• information necessary to provide and secure your account.

1.2 Information you choose to store about other people

The main purpose of the Service is to help you maintain personal and professional relationships.

You may therefore choose to enter information about people you know. This may include:

• name;
• nickname;
• company;
• role or job title;
• location;
• birthday;
• email address;
• telephone number;
• messenger username;
• LinkedIn URL;
• Instagram handle;
• your relationship to the person;
• how and when you met the person;
• freeform notes; and
• records of when you contacted the person.

Some of this information may constitute personal information or personal data relating to people other than the account holder.

You are responsible for ensuring that you have an appropriate basis for entering and using information about other people and that your use of the Service is lawful.

We do not independently obtain this information about your contacts. It is information that you choose to enter or import into your account.

1.3 Contact imports

The Service may allow you to import information for an individual contact using your device's contact picker.

The Service does not require access to or upload your entire device address book.

When you use the contact picker, we receive only the information that you choose to import for that individual contact.

1.4 Contact history and reminders

The Service records information about when you indicate that you have contacted a person.

We use this information to calculate when reminders should be provided according to the preferences you configure.

1.5 Subscription information

If you use Premium, we may receive and store information necessary to manage your subscription, such as:

• whether your account has an active Premium entitlement;
• subscription status;
• subscription start and expiry dates;
• the platform through which you purchased Premium;
• customer, subscription, and transaction identifiers issued by the payment provider; and
• information necessary to verify and manage your entitlement.

Where Premium is purchased on the web, the purchase is processed by Paddle.com, which acts as our reseller and Merchant of Record. Paddle collects the payment and billing information needed to complete your purchase, such as your name, email address, billing country or postcode, and payment method details.

Where Premium is purchased through Google Play, payment processing is handled by Google Play.

We do not receive or store your full payment card details from Paddle or Google Play.

1.6 Technical information

We may collect limited technical information necessary to operate, secure, and troubleshoot the Service, including:

• IP address;
• browser type and version;
• operating system;
• device information;
• application version;
• timestamps;
• authentication and security logs; and
• other information contained in technical logs.

We may also process a device or notification token required to deliver push notifications to your Android device.

1.7 Website analytics

We use Cloudflare Web Analytics to understand how visitors use and experience the web version of the Service and to monitor website performance.

Cloudflare Web Analytics is designed as a privacy-focused analytics service. It does not use cookies or local storage to collect analytics information and does not fingerprint individual visitors for analytics purposes. Cloudflare states that Web Analytics does not collect visitors' personal data for analytics. (Cloudflare Web Analytics)

Analytics information may include aggregated or statistical information such as page views, page URLs, referring information, country, and website performance metrics.

We use this information to understand usage of the website, identify performance problems, and improve the Service.

Cloudflare may process information as necessary to provide its services.

2. How we use personal information

We use personal information to:

• provide and operate the Service;
• create and manage accounts;
• manage Free and Premium plan entitlements;
• process and administer Premium subscriptions;
• store and display information you choose to enter;
• maintain your contact records;
• calculate contact reminders;
• provide birthday and other reminders;
• record your contact history;
• send notifications you have requested;
• maintain the security of the Service;
• detect and prevent abuse;
• diagnose and fix technical problems;
• understand how the web version of the Service is used;
• improve the Service; and
• comply with applicable legal obligations.

We do not sell your personal information.

We do not use information about your contacts for targeted advertising.

We do not use contact information stored in your account to send marketing messages to those people.

3. Legal bases for processing

Where the GDPR or UK GDPR applies, we process personal data on one or more of the following legal bases:

Performance of a contract

We process information that is necessary to provide the Service you have requested, including storing your account and contact information, providing reminders, and managing your Premium subscription.

Legitimate interests

We may process information where necessary for our legitimate interests, such as maintaining security, preventing abuse, troubleshooting, understanding Service usage, and improving the Service, provided those interests are not overridden by your rights and interests.

Our use of privacy-focused website analytics is intended to help us understand and improve the Service without creating individual advertising or behavioural profiles.

Consent

Where required, we may ask for your consent to process particular information or to perform particular activities.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred before the withdrawal.

Legal obligations

We may process information where necessary to comply with a legal obligation.

4. Information about other people

Because the Service is designed to help you maintain relationships, you may store information about people who do not themselves have an account with us.

We process this information to provide the Service.

You should only enter information about another person where you have a lawful basis to do so and should avoid entering information that is unnecessary, excessively sensitive, or unrelated to the purpose of maintaining your relationship with that person.

If you believe that we hold information about you because another person has entered it into the Service, you may contact us using the details below.

5. Who we share information with

We do not sell, rent, or trade your personal information.

We may provide personal information to service providers that process information on our behalf where necessary to operate the Service.

These currently include:

Hetzner

We use Hetzner to host the Service and its database.

Our application data is hosted on Hetzner infrastructure located in Finland.

Firebase Cloud Messaging

We use Google Firebase Cloud Messaging ("FCM") to deliver push notifications to Android devices.

FCM may process information such as a device or notification token and information necessary to deliver a notification.

We do not use FCM as the database for your contact records.

Paddle

We use Paddle.com Market Limited ("Paddle") as our reseller and Merchant of Record for Premium subscriptions purchased on the web. Paddle processes payments, calculates and collects applicable taxes, issues receipts and invoices, and handles refunds for web purchases.

We provide Paddle with information needed to link a purchase to your Digby account, such as your account email address and an account identifier. Paddle sends us information about your subscription, such as its status, billing dates, and identifiers.

Paddle processes payment and billing information as an independent controller under its own Privacy Policy.

Google Play

Where you purchase Premium in the Android app, Google processes the payment through Google Play Billing under Google's Privacy Policy.

We receive a purchase token and subscription information from Google Play, which we use to verify your purchase and manage your Premium entitlement.

Cloudflare

We use Cloudflare Web Analytics for website analytics and may use Cloudflare infrastructure to provide security and other technical services for the web version of the Service.

Cloudflare Web Analytics is designed not to use cookies, local storage, or individual fingerprinting for analytics purposes. (Cloudflare Web Analytics information)

Cloudflare may nevertheless process limited technical and network information as necessary to provide Cloudflare services.

Other disclosures

We may also disclose information where:

• required or authorised by law;
• necessary to comply with a valid legal process;
• necessary to protect the security or rights of the Service, its users, or others; or
• necessary as part of a merger, acquisition, restructuring, sale of assets, or similar transaction.

We do not otherwise disclose your contact records to third parties for their own marketing purposes.

6. International data transfers and storage

The Service is operated from Australia, while the application's primary database and application infrastructure are hosted in Finland.

Some service providers, including Cloudflare, Google, and Paddle, may process information in countries other than Australia or Finland as necessary to provide their services.

Your information may therefore be stored or processed outside the country in which you live.

If we transfer personal information to a country outside Australia, the European Economic Area, or the United Kingdom, where applicable, we will use appropriate safeguards required by applicable law.

Where Australian privacy law applies, we will take the steps required by the Australian Privacy Principles in relation to applicable overseas disclosures.

7. Data retention

We retain personal information for as long as reasonably necessary to provide the Service, maintain your account, meet our legal obligations, resolve disputes, enforce our agreements, and maintain security.

Downgrading from Premium does not by itself cause your contacts or other stored account data to be deleted. If your account exceeds the Free Plan's contact limit after downgrading, your existing contacts will remain stored, but your ability to use certain account functionality may be restricted as described in our Terms of Service.

When you delete your account, we will delete or de-identify your account information and contact records within a reasonable period, subject to:

• information that we are legally required to retain, such as subscription and transaction records needed for tax and accounting purposes;
• information reasonably necessary for security or fraud prevention; and
• information contained in backups, which may remain for a limited period before being overwritten or securely deleted.

Cloudflare Web Analytics retains unsampled beacon data for seven days and subsequently retains aggregated data for longer-term analytics, according to Cloudflare's current documentation. (Cloudflare Web Analytics FAQ)

8. Security

We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure.

However, no internet service or method of electronic storage is completely secure. We therefore cannot guarantee absolute security.

If we become aware of a security incident that requires notification under applicable law, we will make the notifications required by that law.

9. Your rights

Depending on where you live and which privacy laws apply, you may have rights including the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information;
• request restriction of certain processing;
• object to certain processing;
• request a copy of information in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a relevant privacy or data-protection regulator.

We may need to verify your identity before fulfilling a request.

Some rights are subject to exceptions or limitations under applicable law.

10. European Economic Area and UK users

If the GDPR or UK GDPR applies to our processing of your personal data, you may exercise the rights described in Section 9.

You may also complain to a data-protection supervisory authority.

For users in the European Economic Area, you may contact the supervisory authority in the country where you live, work, or believe a violation occurred.

For users in the United Kingdom, you may contact the UK Information Commissioner's Office (ICO).

If you have a privacy concern, we encourage you to contact us first so that we can attempt to resolve it.

11. Australian users

Where the Australian Privacy Act 1988 and Australian Privacy Principles apply to us, we will handle personal information in accordance with those requirements.

You may request access to or correction of personal information we hold about you and may make a privacy complaint using the contact details below.

Because our application infrastructure is hosted in Finland and some third-party services may process information internationally, personal information may be stored or processed outside Australia.

12. California users

If California privacy law applies to us and to your information, you may have additional rights under applicable California privacy laws, which may include rights to:

• know or access certain personal information we collect;
• request deletion of personal information;
• request correction of inaccurate personal information;
• opt out of certain sales or sharing of personal information;
• limit certain uses of sensitive personal information where applicable; and
• receive equal treatment for exercising applicable privacy rights.

We do not sell personal information.

We do not share personal information for cross-context behavioural advertising.

Our use of Cloudflare Web Analytics is for website analytics and is not intended to sell or share personal information for targeted advertising.

If you wish to exercise a California privacy right, contact us using the details below.

We will not discriminate against you for exercising privacy rights that apply to you.

13. Cookies and similar technologies

The web version of the Service may use cookies and similar technologies necessary for:

• authentication;
• maintaining sessions;
• security; and
• operating the Service.

Cloudflare Web Analytics itself does not use cookies or local storage to collect analytics metrics. (Cloudflare Web Analytics)

14. Children's privacy

The Service is not intended for children under 18.

We do not knowingly collect personal information from children under the applicable minimum age.

If you believe that a child has provided personal information to us, please contact us so that we can investigate and, where appropriate, delete it.

15. Your choices

You can control the information you provide to the Service.

You are not required to enter information about a contact unless you want the Service to use that information.

You can edit or delete contact records through the Service where those features are available.

You can also disable push notifications through the Service or your device settings.

16. Account deletion

You may delete your account through:

Settings → Delete account, in either the Digby web app or the Digby Android app.

Alternatively, you may request account deletion by contacting:

hello@friendswithdigby.com

Deleting your account will generally result in deletion of the account information and contact records associated with it, subject to the retention provisions described above.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

When we make changes, we will update the "Last updated" date at the beginning of this policy.

If we make a significant change to how we process personal information, we may provide additional notice through the Service.

18. Contact us

If you have questions about this Privacy Policy, wish to exercise a privacy right, or want to make a privacy complaint, contact:

Geoffrey Pascoe

Email: hello@friendswithdigby.com

Website: https://friendswithdigby.com

We will consider and respond to privacy requests and complaints in accordance with applicable law.