My Word

Draft for publication. This page describes the My Word product as implemented in the app. Items marked needs confirmation are not yet decided or verified and must be confirmed before you treat this policy as final.

Privacy Policy

Operator: MY WORD APP LTD · Company number 17476778 · United Kingdom
Privacy contact: info@myword-app.com
Website: myword-app.com
Effective date: not yet adopted

1. Who is responsible

The controller of personal data for My Word is MY WORD APP LTD, a company registered in the United Kingdom, company number 17476778.

Registered office: required before publication — do not invent this address.

Privacy enquiries: info@myword-app.com. That email is the everyday contact. It is not a substitute for a registered office on company communications that require one.

If you are in the United Kingdom, you can complain to the Information Commissioner’s Office (ICO). Whether MY WORD APP LTD has paid the data protection fee, and any ICO registration number: needs confirmation.

2. What My Word does

My Word is a goal and accountability app. You create Challenges, track Wins and Slip-ups, and optionally involve other people. A Pledge is optional, private, and not a debt. “Support My Word” is a separate optional contribution.

My Word does not provide medical, nutritional, psychological, or financial advice. It does not read Apple Health, Google Fit, contacts, or location.

3. Information My Word uses

3.1 Account and authentication

Sign-up asks for a display name, email address, and password (at least 6 characters). Authentication is handled by Supabase Auth. The app stores the display name in your account metadata and in a profile. Sign-in uses email and password. Password reset and email change are available in the account settings. Apple sign-in and Google sign-in are not implemented. The app does not ask for your age or date of birth.

3.2 Profile and photos

Profiles store a display name (unique without regard to capital letters). A deleted display name is reserved so it cannot be reused. On web, a profile photo can be stored as image data on your profile. On the current iOS and Android build, photo picking is not available. People who can see your profile in the product may see that photo.

3.3 Challenges, Wins, Slip-ups, and history

A Challenge can include the title, the words you typed, dates, repeat pattern, required Wins, Slip-up allowance, outcome, and status. Check-ins record Wins and Slip-ups and can include a note. Progress is self-reported.

3.4 Friends, invitations, and Joint Challenges

My Word does not offer a public directory of all users. Invitation links use tokens. People you invite, or who join a Joint Challenge with you, can see Challenge progress according to the product rules. Pledge amounts are not shared with followers. Share actions use the device share sheet and can include the Challenge title and a link, not the Pledge.

3.5 Pledges, settlements, and Support My Word

A Pledge is optional. No card payment is taken when a Challenge is created. If a Challenge is unsuccessful, you may be invited to honour an amount, choose a lower amount, or settle at £0. Card payments are processed by Stripe. My Word stores amounts, statuses, and Stripe identifiers (such as PaymentIntent ids). Card numbers and CVCs are entered in Stripe’s fields and are not stored as card numbers in My Word’s own tables. Currency for these flows is GBP.

Whether a stored Stripe webhook payload contains card brand, last four digits, billing details, or email: needs inspection of a redacted payload before claiming a specific shape.

Stripe’s own systems hold the payment method. Those records are not deleted by My Word’s account-deletion function.

3.6 Analytics and Secret Sauce

Product analytics can store event names, properties, platform, app version, and sometimes Challenge ids. Some analytics rows keep a record after account deletion with the user id cleared. The “Secret Sauce” setup step stores a variant and related Challenge-shape fields linked to your account; those rows are removed when the profile is deleted (cascade). There is no advertising SDK and no crash-reporting SDK such as Sentry or Firebase Crashlytics in the app package.

3.7 Device storage, notifications, and feedback

Auth sessions are persisted on the device. Notification preferences can be stored. Local reminders may be scheduled on iOS and Android after permission is granted. Feedback can include text, platform, app version, and an optional screenshot stored in private cloud storage under your user id.

3.8 Reports and blocks

Where enabled in the product, you can report content and block another person. Reports are read by MY WORD APP LTD at info@myword-app.com. The target is an initial response within 3 business days. That is a first reply, not a promise of resolution in that time.

4. Why this information is used

Purpose Examples
Provide the service Account, Challenges, progress, invitations, Joint Challenges, local reminders
Optional payments Pledge settlement and Support contributions through Stripe
Financial records Amounts, statuses, Stripe identifiers; anonymised archive rows where the schema copies them
Product analytics Secret Sauce, funnels, usage events
Support and safety Feedback, reports, blocks
Security Auth sessions, access controls, webhook signature checks
Display-name integrity Reservation of a name after deletion

Lawful basis for each purpose under UK GDPR: needs legal confirmation — this page does not assign contract, legitimate interests, or consent.

5. Who receives information

Recipient Role
Supabase Database, authentication, file storage, Edge Functions
Stripe Card payment processing for Pledges and Support
Apple / Google App store distribution and operating-system services (for example notification permission)
People you invite or join with Challenge progress you have given them access to; not your Pledge amount

My Word does not sell personal data. No advertising or data-broker SDK is installed in the inspected app package. Processor contracts and a full subprocessor list: needs confirmation.

6. International transfers

Production database hosting has been recorded as Central EU for the production Supabase project. Stripe, Apple, Google, backups, logs, and transfer safeguards (for example adequacy decisions or standard contractual clauses): needs confirmation.

7. Security

This policy does not claim named certifications (for example SOC 2 or ISO 27001) that are not evidenced in the product repository.

8. How long information is kept

No retention period is configured in the app schema as a scheduled deletion job. How long each category of information is kept: undecided — pending legal and accounting review; this page does not state three years or six years as a product period.

What account deletion does in the product database is summarised in the Delete account page.

9. Account deletion

In the app: Settings → Account → Delete Account. You must confirm. People who cannot sign in can email info@myword-app.com from the address on the account and ask for deletion. See Delete your account for what is removed and what can remain.

10. Your rights

If UK GDPR applies, you may have rights including access, correction, erasure, restriction, objection, and portability, and rights in relation to automated decision-making. How each right is exercised, response times, and identity checks: needs confirmation. Requests can be sent to info@myword-app.com.

11. Children

The minimum age is 18. My Word is not directed at children. The sign-up form does not yet ask for age. How 18+ will be enforced before store submission: needs confirmation. Parents who believe a child has created an account can write to info@myword-app.com.

12. Changes

How changes to this policy will be notified: needs confirmation.

What still needs confirming before treating this as final