Privacy Policy
Not legal advice; final text written from the build and
docs/compliance-review-2026-10.md(revision 2). Before publishing, fill in the[FILL: ...]items (name, address, email, app name, ICO number, EU representative) and check "Facts this policy depends on" at the end.
Semo ("the app", "we", "us") is run by [FILL: your full legal name, or company name and Companies House number], [FILL: postal address]. We are the "controller" of your personal data under UK data protection law (UK GDPR and the Data Protection Act 2018) and, for people in the EU/EEA, the EU General Data Protection Regulation (EU GDPR). ICO registration number: [FILL].
Privacy contact: [FILL: privacy@yourdomain]. EU representative (EU GDPR Art. 27): [FILL: representative's name, address and email]. We have not appointed a Data Protection Officer because the law does not require one for a service of our size.
Last updated: [FILL: publish date]. Version 1.0.
1. The short version
- Semo helps people aged 13 and over use chosen apps less. You tell an AI why you want to cut back. Later, when you open an app you chose to guard, a short AI chat asks you about it and can give you a timed pass.
- What you type is sent to our server and then to an AI service so it can reply. We tell you this, and ask you to agree, before anything is sent.
- You are chatting with an AI, not a person. It can get things wrong. It is not medical advice or therapy.
- You sign in with Apple, which gives us an email address (your real one, or Apple's private relay address if you choose "Hide My Email"). We use it for emails about your trial and subscription. Marketing emails only if you tick the box, adults only, and you can unsubscribe in one click. We do not ask for your name or phone number.
- We do not sell your data, show ads, or track you across other companies' apps and websites. Nobody trains AI models on your words.
- You can export or erase everything in the app at any time.
If you're 13 to 17
- An AI reads what you type so it can reply. We keep your goals and rules so it can remind you of them.
- We keep less about you than we keep about adults. We don't collect usage stats beyond what we need to fix crashes and check your subscription. We never keep full copies of your chats for review.
- If you're under 16 and you mention your health, sleep or mood, the AI can use it to answer you right then, but we don't save it, and your chat messages are deleted when each chat ends.
- You can delete everything any time: Settings > Privacy and data > Erase everything.
- If you're worried about anything, talk to an adult you trust. If you need help now, see section 2 ("If you mention self-harm").
2. What we collect and why
| What | Examples | Why |
|---|---|---|
| Email address (Sign in with Apple) | The email Apple shares with us: your real address or Apple's private relay address; whether you ticked the marketing box and when (adults only). | To send service emails about your trial and subscription (trial ending, renewal reminders), and marketing emails only if you ticked the box. Unticked means no marketing. Under-18s never get marketing. |
| Account identifiers | A random install ID made by the app, a user ID we assign, and an access token (we store only a one-way hash of it). | To create your account (not tied to your name) and keep your data separate and secure. |
| Age band | Under 13 / 13 to 15 / 16 to 17 / 18 or over, from your answer at setup or from the age range your iPhone shares with apps. Never your birth date. | To block under-13s and turn on teen protections. |
| Your goals and profile | Why you want to cut back, your goals, what tends to go wrong, the tone you picked, AI-written summaries of what you said. | To personalise the AI's replies and show you your goals. |
| Per-app rules and notes | Which apps you guard, what is fine or not in each, schedules. | So the AI applies your own rules. |
| Chat content | What you type to the AI and its replies; facts the AI noted from what you said. For 13 to 17 year olds, message text is deleted when each chat ends. | To run the conversations and remember context. |
| Pass history | Which app, the reason you gave, minutes granted, how the pass ended. | Timed passes, Insights, context for the AI. |
| Usage counts | Times you tried to open a guarded app, passes started and ended. | Stats, the weekly note, context for the AI. |
| App analytics | Screens and steps you reached (for example "paywall viewed"), how gates ended, app version, plan, country. Never anything you typed. Adults in the UK and US can switch this off. Adults in the EU only send it if they say yes. Under-18s: not collected, except crash and subscription events. | To see where people get stuck. Our own server only. |
| Error reports | The kind of error, where in the code, the app version, with personal details removed. | To fix bugs. |
| Feedback you send us (optional) | The message you type in Settings > Send feedback (or the link at the bottom of Today), up to 2,000 characters. With it: which screen you sent it from, app version and build, iOS version, light or dark setting, language and region, and whether you are under 18 (a yes or no, nothing finer). Never your chats, your reasons or a screenshot. If you are signed in, an adult and tick "You can reply to me by email", we may write back to the Sign in with Apple address we already hold; otherwise we cannot reply. Under-18s are never asked. | So we can read what to improve, and reply if you asked us to. Please don't include anything you wouldn't want us to see. |
| AI call records | Time, which model answered, speed, cost, which safety checks changed a reply. No sentences. | To keep the AI working and affordable. |
| Full conversation records (optional, adults only) | If you switch on "Help improve the app": the exact prompt, your message and the AI's reply for each turn. Off unless you turn it on. Never for under-18s. | To check how the AI responds and adjust our prompts. Never to train AI. |
| Purchase status | Whether you have an active subscription, from Apple's signed data. We never see your card or Apple Account details. | To unlock paid features. |
| Technical data | Your IP address reaches our server when the app connects. We use it in memory to limit abuse and do not store it. | Security. |
Stays on your phone: the apps you pick with Apple's Screen Time picker (Apple gives us opaque tokens, not names), your appearance setting, and your access token (in the iOS Keychain).
We never ask for: your name, phone, contacts, photos, location, Apple Health data, or what you do inside other apps.
Health, mood and sleep details
We don't ask about your health, but you might mention sleep, stress, anxiety or ADHD when explaining why you want to cut back. That is "special category" data.
- If you're 16 or over, we only keep and use it if you tick the separate box at setup, and only to personalise replies. Leave it out, edit it in "What I remember", or erase everything at any time. If you change your mind, erase your data; we cannot automatically remove only the health parts.
- If you're under 16, there is no box. Anything like that you mention is used only to write the reply in that moment. It is not saved to your goals or memory. (For all 13 to 17 year olds, chat text is deleted when the chat ends.)
If you mention self-harm
If something you type suggests you might hurt yourself, the app does not send it to the AI. It shows you where to get help straight away, and does not store what you wrote. For example: UK: Samaritans 116 123, or Childline 0800 1111 if you're under 19. US: call or text 988. EU: 112, or 116 111 for young people. The full list is at [FILL: yourdomain]/ai-safety.
Voice input
The microphone button uses Apple's speech recognition (on your device where possible). We never receive or store audio, only the text.
3. Our legal bases
| Purpose | Legal basis (UK GDPR and EU GDPR) |
|---|---|
| Your account, the interview, gate chats, passes, memory, insights, weekly note, and sending what you type to our AI providers so they can reply | Contract (Art. 6(1)(b)). Apple also requires your explicit permission before anything goes to an AI service; we ask at setup. |
| Health, mood or sleep details (16 and over) | Explicit consent (Art. 9(2)(a)), with its own tick. |
| Age band | Legal obligation and legitimate interests: to keep under-13s out and protect teens. |
| Subscription checks | Contract. |
| Security, abuse prevention, error reports | Legitimate interests (Art. 6(1)(f)). |
| Feedback you choose to send | Legitimate interests (Art. 6(1)(f)): you chose to write to us and we use it to improve the app. A reply by email, if you ask for one: consent (Art. 6(1)(a)), by the tick. |
| App analytics, UK and US adults | Legitimate interests, with an off switch. |
| App analytics, EU adults | Consent (Art. 6(1)(a)), because EU law requires consent to store analytics data on your device. |
| "Help improve the app" (adults) | Consent (Art. 6(1)(a) and, for any health details, 9(2)(a)). |
| Answering requests and complying with the law | Legal obligation (Art. 6(1)(c)). |
4. The AI: who receives your words
- The route. The app sends what you type, plus the context needed to reply (your goals, your rules for that app, recent pass reasons and simple usage numbers), to our server in London. It forwards the request to OpenRouter, Inc. (US), which passes it to the AI model.
- The model. Normally DeepSeek V4.1 Flash. It was built by DeepSeek, a Chinese company, but we don't use DeepSeek's own service: the model runs on US servers run by Together AI and DeepInfra, and DeepSeek never receives your words. If those servers are down, Anthropic's Claude (US) replies instead. Nothing is sent to China.
- Not kept, not used for training. We only use AI providers that keep nothing after replying (zero data retention) and do not train on prompts. OpenRouter keeps request records (time, model, cost), not your words.
- What it is used for. Only to write replies, note facts you stated, and write your weekly note.
- What we look at. Numbers about AI calls, not sentences. We read conversation text only: (a) for adults who switched on "Help improve the app", in our own admin dashboard, to check how the AI responds; (b) to find your account when you ask us to by email (section 9). We never paste your words into other AI tools.
- The AI can be wrong. It can misunderstand you, cannot see inside other apps, and cannot check what you tell it.
- Decisions. The AI can give a pass of 1 to 30 minutes or decline. It only declines because of a rule you set, and you can always change your rules, pause guarding, or open the app another way. These decisions do not have legal or similarly significant effects on you.
- If you say no. If you don't agree at setup, nothing is sent and the AI features cannot run. You can switch the AI off later in Settings > Use AI; gates then give a short fixed pass and send nothing.
5. Who we share data with
Only service providers who process it on our instructions under a written contract, and Apple as an independent company. Never sold, never for advertising. The current list is at [FILL: yourdomain]/sub-processors.
| Recipient | What for | What they get | Where |
|---|---|---|---|
| Fly.io, Inc. | Hosts our server and database | Everything in section 2 | Servers in London, UK (US company) |
| OpenRouter, Inc. | Routes AI requests | Text you type to the AI, context, replies | US |
| Together AI and DeepInfra (through OpenRouter) | Run the AI model | Same, not kept after the reply | US |
| Anthropic, PBC (through OpenRouter, backup) | Backup AI model | Same, only when the main model is down | US |
| Vercel Inc. | Hosts our website | Website visits only | US / global |
| Apple Inc. | App Store, payments, refunds, age range, notifications, Screen Time, speech recognition | Under Apple's own privacy policy | Worldwide |
We may disclose data if the law requires it. If the business is sold, your data may move to the new owner under this policy, and we will tell you first.
6. How long we keep data
| Data | How long |
|---|---|
| Account content | Until you erase it (deleted immediately), or 12 months after you last used the app |
| Chat message text, 13 to 17 year olds | Deleted when each chat ends |
| App analytics and error reports | 90 days |
| AI call records (no text) | 90 days |
| Feedback you send us | Until you erase your account (deleted immediately), or 12 months after you last used the app; read only by us, never by an AI service, never used to train a model [CHECK: owner to confirm a fixed review-and-delete period] |
| Full conversation records ("Help improve the app", adults) | 90 days, or sooner if you turn it off and ask, or erase |
| Backups | 14 days, then overwritten |
| Messages suggesting self-harm | Never stored |
| AI providers | Not kept after the reply |
| Email address and marketing choice | Until you erase your account (deleted immediately), or 12 months after you last used the app |
| Send log (which email, when, delivered) | 12 months |
| Emails you send us | 12 months after our last reply |
Because accounts are not tied to your name, if you delete the app without exporting, we cannot find or restore your account.
7. International transfers
Our database is in London. People in the EU: the EU recognises the UK as giving adequate protection (adequacy decision renewed until 2031). OpenRouter and the AI providers are in the United States, and Fly.io is a US company. These transfers are protected by the EU Standard Contractual Clauses (for EU data) and the ICO's UK Addendum (for UK data) in our providers' data processing agreements, or by the EU-US Data Privacy Framework and UK-US data bridge where a provider is certified. You can ask us for a copy.
8. Children and teens
- Semo is for people aged 13 and over. At setup you choose your age band; iPhones that share an age range with apps are checked too, and the lower age wins. Under-13s cannot create an account, and if we learn someone under 13 is using the app we delete the account.
- 13 to 17 year olds get teen protections automatically: no analytics beyond crash and subscription events, no "Help improve the app", no full conversation records, extra AI safety rules, teen helplines, chat text deleted when each chat ends, and (under 16) no saving of health details.
- In the US, Apple may ask a parent to approve downloads and purchases for a minor, and we respect Apple's age and consent signals.
- A parent or guardian can contact us about a child's account; see section 9.
9. Your rights
You have the right to: be informed; access your data; have it corrected; have it erased; restrict or object to its use; data portability; withdraw consent at any time; and safeguards against solely automated decisions. US residents have equivalent rights and we honour them the same way.
In the app:
- Access and portability: Settings > Privacy and data > Export everything we hold about you.
- Erase: Settings > Privacy and data > Erase everything.
- Correct: edit your goals, rules and apps, or Settings > What I remember.
- Switch off the AI: Settings > Privacy and data > Use AI.
- Marketing emails: untick the box in Settings, or use the unsubscribe link in any marketing email (one click, applied straight away). Service emails about your own subscription cannot be switched off while you have a trial or subscription.
- Analytics and "Help improve the app" (adults): Settings > Privacy and data.
By email: [FILL: privacy@yourdomain], or via our EU representative. We reply within one month. Accounts are not tied to your name, so we will usually ask you to use the in-app tools, which only work on your own device. If you cannot, we will ask for details only the account holder would know. A parent asking about a child's account: we will help, and for teenagers we will usually involve the teen too.
Complaints: tell us first if you can. You can complain to the UK Information Commissioner's Office (ico.org.uk/make-a-complaint, 0303 123 1113) or, in the EU, to the data protection authority where you live or work.
10. Security
HTTPS for all connections; access tokens in the iOS Keychain and stored by us only as hashes; an encrypted database volume; access limited to the operator; tests that what you type never appears in our logs. If a breach puts you at high risk we will tell you, and we will tell the ICO (and EU authorities where needed) within 72 hours where the law requires.
11. US residents
We do not sell or share personal data for targeted advertising. Washington and Nevada residents: see our Consumer Health Data Privacy Policy at [FILL: yourdomain]/health-data.
12. Our website
Our website uses no cookies and no analytics. Our host (Vercel) processes your IP address briefly to deliver pages and stop attacks.
13. Changes
If we change this policy in a way that matters, we will tell you in the app first and, for any new use that needs consent, ask again. Earlier versions: [FILL: yourdomain]/privacy/history.
14. Contact
[FILL: name], [FILL: address], [FILL: privacy@yourdomain]. EU representative: [FILL].
Facts this policy depends on (owner checks before publishing; delete from the public page)
- Email: sending service named in
sub-processors.md, its DPA saved, and the sign-in email and marketing choice are erased by Settings > Erase everything (seedocs/launch/email-setup.md). - App Store territories include the EU/EEA. An EU representative is appointed and named above; trader status is declared in App Store Connect.
- Backend env:
LLM_ZDR=true,LLM_DATA_COLLECTION=deny, provider pin to Together and DeepInfra (defaults);LLM_TRACE=fullonly if the adult opt-in is live (it only writes full traces for opted-in users), otherwisemeta;TRACE_FULL_ALL=false;RETENTION_DAYS=365,SCHEDULED_PURGE_HOURS=24,SCHEDULED_BACKUP_HOURS=24,SCHEDULED_BACKUP_KEEP=14,EVENTS_RETENTION_DAYS=90,TRACE_RETENTION_DAYS=90. - OpenRouter account: prompt logging off; providers that may train or retain blocked.
- Fly.io volume encryption on.
- UI changes U1 to U15 and backend items B6 to B9 in
docs/compliance-review-2026-10.mdsection 8 have shipped (age bands, teen mode, under-16 health minimisation, EU analytics opt-in, merged export, Use AI switch). In particular, the backend must refuse full traces for any teen band, whatever the switch says. - The owner reads full traces only in the admin dashboard (or with Claude on commercial terms), never through a consumer AI account.