Privacy Policy

Section 1The short version

• The application collects nothing. On Android it holds no internet permission, so the operating system will not give it a network socket. Your documents, your file names, your questions, your answers and your use of the application cannot reach us, in any form, because there is no route by which they could.
• We hold no account for you. There is no registration, no email address, no password and no profile.
• We cannot open your vault, recover your PIN, or decrypt your backup. No mechanism to do so exists.
• Google Play, not the application, handles distribution and payment. It installs the application, delivers its on-device AI model, sells subscriptions and, only if you have allowed your device to share diagnostics with app developers, may pass us crash reports. Google handles that information under its own privacy policy (section 8).
• This website collects the minimum a website must: server and security logs generated by our hosting provider, and whatever you choose to send us through the contact form or by email.
• We use no analytics service and no advertising. There is no tracking pixel, no fingerprinting script and no behavioural profiling on this site.
• We do not sell or share personal information, as those terms are defined under United States state privacy laws, and we have not done so in the preceding twelve months.

Section 2Who we are, and what this covers

This Privacy Policy is issued by Reticenda (we, us, our). You can reach us at the addresses in section 24. For the purposes of the European Union and United Kingdom General Data Protection Regulations, and of similar laws elsewhere, we are the controller of the personal data described here.

It covers:

• the website at reticenda.com and every page on it (the Website); and
• the Reticenda mobile application, in every version and on every platform (the Application).

It does not cover anything else. In particular it does not cover Google Play or any other application distribution platform, the operating system on your device, your device's manufacturer, any third-party application or storage location you use to bring a document to Reticenda or to keep one that has left it, or any website we link to. Those are governed by their own policies, and we have no control over them.

Your use of the Website and the Application is also governed by the Terms of Use. Where a term is defined there and used here, it carries the same meaning.

Section 3Definitions

In this policy:

• Personal information and personal data mean information that identifies, relates to, describes, or could reasonably be linked with a particular individual or household. The two terms are used interchangeably.
• Process means anything done with personal information — collecting, storing, using, disclosing, erasing, and anything in between.
• Vault means the encrypted store the Application keeps on your device, including the documents you put into it and everything derived from them.
• Document Content means the documents you place in the Vault, the text extracted from them, your questions, the answers returned to you, file names, case names, tags, parties, dates, notes, Seals, settings, and anything else describing what your Vault contains.
• Service provider, processor, sell, share and sensitive personal information carry the meanings given to them by the privacy laws described in sections 16 to 18.

Section 4The application: what it does not collect

We receive no Document Content. Not in identifiable form, not in pseudonymised form, not in aggregate, and not as a count.

This is not a commitment about our conduct. It is a consequence of how the Application is built, and it can be verified by you, or by anyone you ask to check it on your behalf:

• On Android, the Application does not declare the android.permission.INTERNET permission. An application that does not hold it is not placed in the operating-system group that permits socket creation, and the kernel refuses any attempt to open a network connection — from our code or from any third-party library within the Application.
• Where a third-party component bundled in the Application would otherwise declare network or network-state permissions of its own, those declarations are removed when the application manifest is assembled, so the installed package holds neither.
• Automated checks fail the build if the internet permission appears in any shipping manifest, and the released package is verified against the manifest that build actually produced. A test run on a real device fails if the installed package requests either permission.
• The Application's own About screen reads its permission list from the operating system rather than from a list we wrote, so it would report the presence of a network permission in the same terms it currently uses to report its absence.

Instructions for verifying this yourself are published on this site and require no tools of ours.

What this means in practice

What the Application asks Android for

The Application does not request internet access, location, contacts, microphone, phone, SMS, calendar, or access to your other files. You choose each file it opens through Android's own file picker, one choice at a time.

What leaves the device, and only when you choose

Document Content leaves the Vault's encryption only if you export it, save a Seal, write a backup, or share a file yourself, to a place you pick. From then on it is governed by that place. Backups are encrypted with a passphrase you choose. Android's cloud backup and its device-to-device transfer are both switched off for the Application, so the Vault is never copied into your Google account's backup and is not moved when you set up a new phone; the Application's own encrypted backup is the only way to move it.

Because we hold no Document Content, a request from any person or authority directed at us cannot produce it. If your documents are sought, the request must be made to you, where the protections available to you under your own law and professional obligations apply.

Your own responsibilities as a controller

If you use the Application in the course of a profession, the Document Content you place in the Vault will frequently be personal data belonging to other people — your clients, their counterparties, patients, third parties named in correspondence. In respect of that data you are the controller, and we are not a processor of it, because we never receive it and could not act on it. In particular, we are not your processor, service provider, sub-processor or HIPAA business associate. Your obligations to those individuals are yours, and this policy does not modify, reduce or discharge them. See also section 4 of the Terms of Use.

Section 5The website: what is collected automatically

The Website is hosted on Cloudflare Pages and delivered through Cloudflare's network. Like every web server, that infrastructure processes information necessarily transmitted by your browser in order to return a page to it and to keep the service available.

This information is generated and held by our hosting provider acting on our instructions. We do not combine it with any other data, do not use it to build a profile of you, and do not attempt to identify you from it. We use no web analytics product, no tag manager, no advertising network, no social-media pixel, no session recording and no device-fingerprinting script. Fonts and every other resource are served from this site itself. There is no third-party JavaScript on this site other than the bot-protection widget on the contact page described in section 6.

Section 6The contact form and email

If you write to us through the form on the contact page, we process what you put into it:

• the name you give;
• the email address you give;
• the topic you select;
• the message you write; and
• the language version of the site you wrote from.

The submission is handled by a small serverless function running on Cloudflare's network under our account. It sends your message by email, through our own mail server, to our mailbox, with your address set as the reply address so that we can answer you. It is not written to any database, log or analytics store belonging to this Website. It then exists as an ordinary email in our mail system, for as long as section 13 provides. The same applies if you email us directly at one of the addresses in section 24.

To distinguish a person from an automated script, the form is protected by Cloudflare Turnstile. Turnstile is designed as a privacy-preserving alternative to conventional challenges: it does not require you to solve a puzzle and is not used to track you across websites. It runs only on the contact page, and may place or read a short-lived token or cookie there strictly for that purpose.

Section 7Cookies and local storage

This Website sets no advertising, analytics or tracking cookies, which is why it shows you no cookie banner. Only the following may be present:

The only cookies present are either strictly necessary for delivering and securing the service you requested, or remember a choice you made yourself (your language). No consent is required for them under Article 5(3) of the ePrivacy Directive or its national implementations, or under comparable laws elsewhere. If we ever introduce a cookie that is not of that kind, we will ask for your consent before setting it, and this section will say so.

The Application itself sets no cookies of any kind and has no browser component.

Section 8Google Play: distribution, the model download, purchases and crash reports

The Application is distributed through Google Play. The following is handled by Google, under the Google Privacy Policy and the Google Play Terms of Service. Google is an independent controller of it, and we do not control it.

Installing and updating. Google Play processes your Google account, device and installation information to install and update the Application.

Delivering the AI model. After you agree in the Application, Google Play downloads the Application's AI model to your device, in the same way it delivers an application update. The download contains only the model. No information about your documents, questions or answers is part of it.

Purchases and subscriptions. Subscriptions are sold, billed, renewed, changed and cancelled through Google Play. We do not receive, process or store your payment card details, billing address or Google account credentials. Through the Google Play Console we receive the records Google provides to developers about purchases, for example order identifiers, the product bought, price, country or region, dates, and renewal, cancellation and refund status. We use these records only to manage subscriptions, for accounting, tax and legal compliance, and to prevent fraud. Within the Application, your entitlement is resolved by the Google Play billing client on your device: the Application learns only whether a subscription is active and when it ends, and that result never travels to us. Nothing in any of this identifies what you keep in your Vault.

Crash and performance reports. If you have allowed your device to share usage and diagnostics data with app developers, Google may send us, through the Google Play Console, crash and "application not responding" reports and performance statistics about the Application. These typically include the device model, Android version, Application version and technical details of the error. The Application does not add Document Content to these reports. You can turn this sharing off in your device's Google settings. We use these reports only to find and fix defects.

Ratings and reviews. If you post a public review in Google Play, it is public and governed by Google Play's terms. We may reply to it.

Section 9Why we process information

We do not use your information for profiling, behavioural advertising, automated decision-making with legal effect, or training any machine-learning model. We do not use the contents of messages you send us for any purpose other than answering them and the purposes listed above.

Section 10Legal bases

Where the European Union or United Kingdom General Data Protection Regulation applies, we rely on the following legal bases under Article 6(1). Where another law requires a legal basis (for example, Brazil's LGPD), we rely on its equivalent basis.

We do not intentionally collect special-category data under Article 9. Please do not include it in a message to us. If you do, we rely on Article 9(2)(f) where the information is necessary for legal claims, and otherwise delete it.

Section 11Who else receives information

We do not sell personal information, share it for cross-context behavioural advertising, or disclose it to data brokers. Personal information is disclosed only to the following categories of recipient, and only for the purposes described:

Each processor is engaged under a written contract that requires it to process personal data only on our documented instructions, to keep it confidential, to apply appropriate security measures, and to delete or return it at the end of the engagement.

Section 12International transfers

Our hosting provider operates global infrastructure, and our mail server and the providers we rely on may be located outside your country. Personal information processed under this policy may therefore be transferred to and processed in the United States and other countries whose data-protection laws differ from those of your own.

Where personal data is transferred out of the European Economic Area, the United Kingdom, Switzerland, or another country whose law restricts such transfers, we rely on one or more of the following safeguards:

• the Standard Contractual Clauses adopted by the European Commission (and, for the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner's Office), or the equivalent standard clauses recognised by the law that applies, incorporated into our contracts with the relevant processors;
• an adequacy decision, or certification by the recipient under the EU–US Data Privacy Framework and its UK Extension and Swiss–US counterpart, where the recipient maintains a current certification; or
• your explicit consent, or the necessity of the transfer for the performance of a contract with you, where no other mechanism is available and the law permits it.

You may request a copy of the relevant safeguard by writing to [email protected]. Document Content is never transferred anywhere by us, because it never leaves your device unless you move it yourself.

Section 13How long information is kept

When a retention period ends, information is deleted or irreversibly anonymised. Where deletion is not immediately possible — for instance in a backup that is cycled on a schedule — the information is isolated from further processing until deletion occurs.

Section 14Security

Regarding the Website and the small amount of personal information we hold:

• All traffic is served over HTTPS with TLS, and the site sets HTTP Strict Transport Security, a strict Content Security Policy, X-Content-Type-Options, Referrer-Policy: no-referrer, a restrictive Permissions-Policy and frame-ancestor restrictions.
• The contact form is rate-limited and bot-protected, and its handler validates input and discards anything malformed rather than storing it.
• Access to our mailbox is restricted to the people who need it and is protected by multi-factor authentication.
• We hold no payment data, no passwords of yours, and no Document Content, which is the most effective security measure available for any of them.

Regarding the Application, the security architecture is described on the security page and summarised here: everything at rest is encrypted on the device (AES-GCM) under a key that is derived in part from your PIN and protected by the device's secure hardware; Android's cloud backup and device-to-device transfer are disabled for the Application; and the Application holds no network permission, so it cannot transmit Document Content itself.

If you believe you have found a vulnerability, write to [email protected]; we acknowledge reports within five business days. Where a personal-data breach occurs and the law requires notification, we will notify the competent supervisory authority within the period that law sets (72 hours under the GDPR), and affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Section 15Your rights, generally

Whatever country you are in, you may write to [email protected] and ask us to:

• confirm whether we hold personal information about you, and give you a copy of it;
• correct anything that is inaccurate or incomplete;
• delete what we hold;
• restrict what we do with it, or object to our doing it;
• provide it in a portable, machine-readable form; or
• withdraw a consent you previously gave, without affecting anything done before you withdrew it.

We respond within 30 days, or sooner where the law that applies to you sets a shorter period, and tell you if we need longer, why, and for how long the law allows. We do not charge for this, and we do not discriminate against you for exercising a right. To protect you, we may need to verify that a request is genuinely yours — usually by replying to the address the information is associated with, and never by asking you for more sensitive information than we already hold.

Section 16Europe, the United Kingdom and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the rights set out in section 15 as they are conferred by Articles 15 to 22 of the GDPR or the UK GDPR, or by the Swiss Federal Act on Data Protection, and in addition:

• The right to object to processing based on legitimate interests, at any time and on grounds relating to your particular situation. Where you object, we stop unless we can demonstrate compelling legitimate grounds that override your interests.
• The right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. We take no such decisions.
• The right to lodge a complaint with a supervisory authority in the country of your habitual residence, place of work or place of the alleged infringement — in the United Kingdom, the Information Commissioner's Office, and in Switzerland, the Federal Data Protection and Information Commissioner. You are not required to contact us first, though we would welcome the chance to put something right.

We respond within one month, extendable by up to two further months where a request is complex, in which case we tell you within the first month.

Providing personal information to us is never a statutory or contractual requirement. You may use the Application without giving us anything at all; the only information we receive is what you choose to send, and what Google Play provides as described in section 8.

Section 17United States residents

This section applies if you are a resident of California, Colorado, Connecticut, Virginia, or any other state with a comprehensive consumer privacy law in force. Where a state law grants you a right not listed here, we honour it.

Categories collected, and their sources

In the preceding twelve months we have collected the following categories of personal information, as those categories are defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act:

Sale, sharing, and sensitive information

We have not sold personal information, and have not shared it for cross-context behavioural advertising, in the preceding twelve months, and we do not do so now. We do not sell or share the personal information of consumers we know to be under 16 years of age, because we do not knowingly collect it at all. We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit under the CCPA regulations.

Your rights

• To know what personal information we have collected, the categories of source, the business purpose, and the categories of third party to whom it was disclosed.
• To access the specific pieces of personal information we hold about you, in a portable form.
• To delete personal information we have collected from you, subject to the exceptions the law provides.
• To correct inaccurate personal information.
• To opt out of sale or sharing. There is nothing to opt out of, because we do neither — but the right exists and we honour any signal asserting it.
• To limit the use of sensitive personal information. We collect none.
• To appeal a refusal, where your state's law provides an appeal. Write to [email protected] with the word "appeal" in the subject and we will review and respond, giving written reasons if we maintain the refusal, together with a means of contacting your state Attorney General.
• To be free from discrimination for exercising any of these rights. We offer no financial incentive programme of any kind.

We respond within 45 days, extendable once by a further 45 days where reasonably necessary, in which case we tell you. To exercise a right, write to [email protected]. An authorised agent may act on your behalf with written permission signed by you, which we may ask to see, and we may ask you to confirm the agent's authority directly.

California "Shine the Light". We disclose no personal information to third parties for their own direct-marketing purposes, so there is nothing to report under California Civil Code section 1798.83.

Nevada. We do not sell personal information as defined by Nevada Revised Statutes chapter 603A, and we have no such sales for you to opt out of.

Section 18Other countries and regions

Wherever you live, you have at least the rights in section 15, and we honour any additional right that the data-protection law of your country gives you. Without limiting that, and in addition:

• Canada. Under the Personal Information Protection and Electronic Documents Act and provincial laws, including Québec's Act respecting the protection of personal information in the private sector, you may access and correct your personal information and withdraw consent. You may complain to the Office of the Privacy Commissioner of Canada or to the privacy commissioner of your province, including the Commission d'accès à l'information du Québec.
• Brazil. Under the Lei Geral de Proteção de Dados (Law No. 13,709/2018), you have the rights in its Article 18, including confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about the entities we share data with, and revocation of consent. We answer a complete access request within 15 days. You may petition the Autoridade Nacional de Proteção de Dados (ANPD).
• Mexico, Argentina, Chile, Colombia, Peru and the rest of Latin America. You may exercise your rights of access, rectification, cancellation and opposition, and any other right your national law provides, by writing to [email protected], and you may complain to your national data-protection authority.
• Australia and New Zealand. We handle personal information consistently with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and with the New Zealand Privacy Act 2020. You may complain to the Office of the Australian Information Commissioner or to the New Zealand Privacy Commissioner.
• Asia. Where Japan's Act on the Protection of Personal Information, South Korea's Personal Information Protection Act, Singapore's Personal Data Protection Act, India's Digital Personal Data Protection Act, or a comparable law applies to you, you may exercise the rights it grants by writing to [email protected].
• Africa and the Middle East. Where South Africa's Protection of Personal Information Act, Nigeria's Data Protection Act, Kenya's Data Protection Act, the United Arab Emirates' or Saudi Arabia's Personal Data Protection Law, Türkiye's Law No. 6698, or a comparable law applies to you, you may exercise the rights it grants in the same way, and complain to the competent regulator.

If a law that applies to us requires us to appoint a local representative or to register with an authority, we will do so and list the details in this section.

Section 19Children

The Website and the Application are intended for professional and adult use. They are not directed to children, and the Terms of Use require users of the Application to be at least 18 years old. We do not knowingly collect personal information from anyone under 18.

If you believe a child has provided us with personal information, write to [email protected] and we will delete it promptly.

Section 20Do Not Track and Global Privacy Control

We do not track you across websites, so there is nothing for a Do Not Track header to switch off. We nonetheless honour the Global Privacy Control signal as a valid opt-out of sale and sharing under the laws that recognise it. Since we neither sell nor share personal information, giving effect to the signal changes nothing about how this site behaves — which is the position we would rather be in.

Section 21Automated decision-making

We make no decisions about you by automated means that produce legal effects or similarly significantly affect you. The Application's processing of your documents, including its on-device AI, happens entirely on your device, under your control, produces no decision about any person, and is never seen by us.

Section 22Links to other sites

This site links to a small number of external resources, such as Google Play. We do not control them and are not responsible for their content or their privacy practices. This site sets a no-referrer policy, so following a link from here does not tell the destination where you came from.

Section 23Changes to this policy

We may update this policy to reflect a change in what we do, in the law, or in the providers we rely on. When we do, we revise the dates at the top of this page and keep the previous version available on request.

Where a change materially reduces your rights or materially expands how we use personal information, we will give notice before it takes effect — prominently on this page, in the Application or its release notes, and, where we hold an address for you and the change affects you, by email. If the Application ever gained the ability to send information over a network, that would be a material change, and you would be told before it happened. Continuing to use the Website or the Application after a change takes effect means you accept the revised policy; if you do not, stop using them and ask us to delete what we hold.

Language

This policy is published in several languages for convenience. The English version governs, and in the event of any discrepancy between a translation and the English text, the English text prevails — except where the mandatory law of your country requires otherwise, in which case that requirement prevails to the extent of the conflict.

Section 24How to contact us, and how to complain

For any question about this policy, or to exercise any right in it:

You may also use the contact form.

If you are not satisfied with our response, you may complain to your data-protection supervisory authority (sections 16 and 18) or, in the United States, to your state Attorney General. We would ask for the opportunity to resolve it first, but you are not obliged to give us one.