This privacy policy explains what personal data the RemindMe mobile app (the “App”) collects, how it is used, who it is shared with, and what rights you have. The App is published on Google Play under the package name uk.co.j5soft.remindme2c.
We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who is the data controller?
The data controller for the personal data described in this policy is:
James Jefferson
Unit 1, Southmead Industrial Estate, Didcot OX11 7PL
Email: [email protected]
If you have any questions about this policy, or want to exercise your rights under UK GDPR (Section 8 below), email the address above.
We do not have a Data Protection Officer (DPO). UK GDPR does not require a DPO for an app of this scale and purpose.
2. What data do we collect?
| Category | What | Source | Why |
|---|---|---|---|
| Account identifier | Firebase UID, email address, display name | You, via Google Sign-In | To create your account and authenticate every request |
| Reminder content | The title, optional details, schedule, icon, and accent colour of each reminder you create | You, via the App | Required to deliver the reminders you ask for |
| Device information | Firebase Cloud Messaging (FCM) push token, device timezone, device model | Your device, on first sign-in and on every sync | Required to wake your device when a reminder is due, and to deliver reminders at the correct local time |
| User preferences | “Confirm before stop” toggle, default timezone behaviour, home timezone, FCM payload-privacy mode | You, via Settings in the App | To respect your stated preferences |
| Subscription state | The Google Play product ID, purchase token, subscription state (active, in grace period, cancelled, expired), expiry timestamp, and auto-renewal flag for any premium subscription you purchase | Google Play, via the Play Billing Library + the Play Developer API | To enforce free-tier limits and grant premium features |
| Audit log | A record of every subscription-state change we observe (when, source, raw response we received from Google) | Google Play, via our Real-Time Developer Notifications integration | For dispute resolution and debugging billing issues |
| Free-tier counters | The total number of “disposable” reminders you have created since signing up, and the number of “long-term” recurring reminders currently active | Computed from your usage | To enforce the free-tier limits of 30 disposable reminders and 5 active long-term reminders |
We do not collect:
- Your real name (beyond the display name you’ve given Google for sign-in)
- Your phone number
- Your location (we use the device’s timezone setting, which is a region code like
Europe/London, not a coordinate) - Your contacts
- Your browsing or app-usage history
- Advertising identifiers
- Analytics events or telemetry beyond what’s needed for billing reconciliation
We have no third-party advertising, no third-party analytics (no Firebase Analytics, no Google Analytics, no Mixpanel, no Amplitude, no Crashlytics, no SDK that phones home).
3. Why do we collect each category, and what is the legal basis?
UK GDPR requires us to identify a lawful basis for each category of processing.
| Category | Lawful basis (UK GDPR Art 6) |
|---|---|
| Account identifier, reminder content, device information, user preferences | Contract (Art 6(1)(b)) — we need this to provide the service you signed up for |
| Subscription state, audit log | Contract — we need this to enforce paid features you’ve purchased — and Legal obligation (Art 6(1)(c)) — UK accounting and consumer-protection law requires us to keep records of transactions |
| Free-tier counters | Legitimate interest (Art 6(1)(f)) — we have a legitimate interest in enforcing the free-tier limits we’ve published |
4. Who do we share your data with?
Your data is shared with the following processors (UK GDPR Art 28). All have their own privacy commitments; we have data-processing agreements in place either explicitly or via their standard terms.
| Processor | What we share | Why | Where |
|---|---|---|---|
| Google Firebase Authentication | Email, display name | To sign you in via Google | US (with Standard Contractual Clauses in place) |
| Google Firebase Cloud Messaging | FCM token, the title and details of a reminder when it fires (subject to your FCM payload-privacy preference — see Section 6) | To wake your device when a reminder is due | US |
| Google Play Billing | Purchase token, product ID | To verify any premium subscription | Routed through Google Play; subject to Google’s privacy policy |
| Google Cloud Platform (Cloud KMS, Pub/Sub, Compute) | Encrypted reminder content (no plaintext), subscription audit data | Hosting infrastructure, key management | europe-west2 (London) |
| Cloudflare | TLS-encrypted traffic between your device and our servers | Tunnel / CDN; does not see decrypted content | Cloudflare’s global network |
We do not sell your personal data to anyone, ever. We do not share your data for marketing, advertising, or profiling purposes.
We do not provide your data to government, law enforcement, or other third parties except where required by a valid UK court order or equivalent legal process. We commit to challenging overbroad requests and notifying you (where legally permitted) if your data is the specific subject of a request.
5. International transfers
Some of the processors above (Google Firebase, Google Play Billing) operate from the United States. We rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (which the UK government has adopted via an adequacy regulation) as the legal basis for these transfers.
The bulk of your encrypted reminder content is stored in the UK (Google Cloud europe-west2, London).
6. How is your reminder content protected?
This section describes the technical protections specifically applied to the title and details of your reminders, because they are the most sensitive data the App handles.
- At rest: Each reminder’s title and details are encrypted with AES-256-GCM under a per-user Data Encryption Key (DEK). Each user’s DEK is in turn wrapped by a Key Encryption Key (KEK) held in Google Cloud KMS. An attacker who obtains a copy of our database file alone cannot decrypt your reminder content — they would additionally need access to the Cloud KMS key, which is held under separate access controls.
- In transit (device ↔ server): TLS 1.2+.
- In transit (server → FCM): When a backup notification fires from our server (because the device-scheduled alarm didn’t deliver), we send the reminder’s title and details to Google Firebase Cloud Messaging, which then forwards the data to your device. By default, this means the reminder title and details pass through Google Firebase as plaintext (over TLS, but readable to Firebase). You can opt into a privacy mode (
id_only) under App Settings, which causes the server to send only the reminder ID over Firebase; your device then fetches the title from our server over TLS. This trades latency for not exposing reminder text to Firebase. Default is the convenient mode; the choice is yours. - In server logs: We have a server-side filter that redacts reminder titles, details, and notes from all log records before any log is written. We cannot accidentally log reminder content even when debugging.
- At our staff’s discretion: Our operators can technically decrypt your reminder content if they have access to both the database and the Cloud KMS key. This is not zero-knowledge encryption. We make this explicit so you understand the trust model: you are trusting that our staff will not arbitrarily decrypt your data outside of the operational paths described in this policy (e.g., responding to a deletion request, debugging a specific user-reported issue with your consent).
7. How long do we keep your data?
| Data | Retention |
|---|---|
| Account, reminders, preferences | For as long as you have an account |
| Subscription state and audit log | For as long as you have an account, plus 7 years after account deletion as required by UK accounting law (financial records — anonymised wherever possible after account deletion) |
| Soft-deleted reminders (you tapped Stop or Delete on a one-time reminder) | 30 days after deletion (this is the “grace period” — undo / accidental-deletion recovery) |
| Hard-deleted reminders (auto-archived recurring reminders) | Deleted from our database 60 days after they were archived |
Account itself (when you delete your account via Settings → Delete account) |
Soft-deleted immediately; hard-deleted 30 days later, at which point all encrypted reminder content becomes cryptographically unrecoverable (we destroy your per-user DEK as part of the hard-delete) |
8. Your rights
Under UK GDPR you have the following rights, regardless of whether you are in the UK at the time you exercise them:
| Right | How to exercise |
|---|---|
| Access — request a copy of the personal data we hold about you | Email [email protected]. We will respond within one month |
| Rectification — correct inaccurate data | Most data can be corrected directly in the App; for anything you can’t reach, email [email protected] |
| Erasure (“right to be forgotten”) — delete your data | Tap Settings → Delete account in the App, email [email protected], or use the dedicated account-deletion page |
| Restriction — limit how we process your data | Email [email protected] |
| Portability — get a machine-readable copy of your data | Email [email protected] |
| Object — object to processing based on legitimate interests | Email [email protected] |
| Withdraw consent — where processing relies on consent | You may withdraw at any time without affecting the lawfulness of prior processing |
| Complain — to a supervisory authority | UK: the Information Commissioner’s Office (https://ico.org.uk) |
We do not perform automated decision-making or profiling that has legal or similarly significant effects on you.
9. Children
The App is not directed at children. We do not knowingly collect personal data from anyone under the age of 13 (the UK age of digital consent under the Data Protection Act 2018). If you believe a child has created an account, please contact [email protected] and we will delete the account.
10. Security incidents
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours and you without undue delay, as required by UK GDPR Art 33 and 34.
11. Changes to this policy
If we make material changes to this policy, we will update the date at the top, push an in-app notification, and post the updated policy at this URL.
12. Contact
For any question about this policy, your data, or to exercise any of the rights listed in Section 8:
Email: [email protected]
Postal: Unit 1, Southmead Industrial Estate, Didcot OX11 7PL
This privacy policy was last reviewed by a UK-qualified legal professional on {{REVIEW DATE — DO NOT REMOVE OR PUBLISH UNTIL REAL}}.