Privacy policy

Who we are

Altiora Holdings Ltd (company number 17109594), Flat 9, 42 Gannet Apartments, Shearwater Drive, London NW9 7GF, is the controller of your personal data.

We have not appointed a Data Protection Officer, because we are not required to. Privacy questions go to hello@nothingunsaid.app and are handled by a named person in the team.

What we collect

• Account details: your name, email address and, if you add one, your birthday.
• Check-ins: when you check in, how often you have chosen to check in, how many you can miss before delivery, any pauses, and your check-in history.
• Your messages: the letters, voice notes, videos, photos and documents you write or upload, and the titles and notes you give them.
• Recipients: the names, email addresses and phone numbers you give us for the people who should receive a message, and the people in your Family & Friends group.
• Device and delivery data: push notification tokens, app version and device type, so reminders reach you.
• Support and website: emails you send us, and basic analytics about how this website is used.

Why we use it, and our lawful basis

• To run the service you signed up for — your account, your check-ins, storing your messages and delivering them when your threshold is missed. Lawful basis: performance of our contract with you.
• To contact the recipients you choose, when a delivery is triggered or you invite someone to your group. Lawful basis: our legitimate interest in carrying out the instruction you gave us. Recipients can object at any time.
• To keep the service secure and prevent abuse. Lawful basis: our legitimate interests.
• To send you service messages such as check-in reminders. Lawful basis: performance of our contract.
• To send marketing, only if you ask for it, such as the Android waiting list. Lawful basis: your consent, which you can withdraw at any time.

Sealed sections: what even we cannot read

When you seal part of a message, the key that unlocks it is wrapped using the answers you set, and the plain key is discarded. We hold only the questions and hints, never the answers.

That means we cannot open a sealed section, and neither can anyone who compromises our systems. It also means the content is lost for good if nobody can answer the questions. We cannot reset, recover or bypass them.

Message content that you do not seal is encrypted in transit and at rest, but our systems can decrypt it in order to deliver it.

If someone named you as a recipient

Someone who uses Unsaid gave us your contact details so a message could reach you, or so you could join their Family & Friends group. We got your details from them, not from you.

We hold your name and contact details, and a record of any message sent to you. We use them only to deliver what that person asked us to deliver.

You can ask us to remove you at any time by emailing hello@nothingunsaid.app. If you do, we will tell the person who named you that they need to choose someone else.

Family & Friends groups

A group shows whether each member is on track with their check-ins. It never shows the content of anyone's messages, and it does not share anyone's location.

Each person controls whether their own status is shared, and can switch it off without leaving the group.

We do not infer anything about your health

A missed check-in means a check-in was missed. We do not treat it as information about your health, we do not draw conclusions about your wellbeing, and we do not use it for anything except the delivery rule you set.

Who else handles your data

• Amazon Web Services, our hosting provider, in their London region.
• Our email delivery provider, for reminders, invitations and message delivery notifications.
• Apple, if you subscribe. Apple is the seller and handles your payment; we never see your card details.
• Google Analytics, which measures how this website is used.

Where your data is kept

Your account, check-ins and messages are stored in the United Kingdom, in AWS's London region.

Some of our suppliers may access data from outside the UK for support. Where they do, we rely on the UK Extension to the EU–US Data Privacy Framework where the supplier is certified, and on the ICO's International Data Transfer Agreement otherwise.

How we keep it safe

• Everything travels over encrypted connections, and message content is encrypted at rest with keys held in AWS Key Management Service.
• Sealed sections go further: their key is wrapped with your answers and the plain key is thrown away, so nobody at Unsaid can open them.
• Each message's encryption is bound to your account and that message, so a stored file cannot be decrypted into someone else's message.
• Access to production systems is limited to the people who need it, requires multi-factor sign-in, and is logged.
• Passwords are stored hashed, never in readable form, and signing in on a new device does not reveal your messages to anyone else.
• Backups are encrypted and kept in the UK, and deleted data is removed from them within 35 days.
• We keep systems patched and review our dependencies for known vulnerabilities.

If something goes wrong

If a breach puts your rights at risk, we will tell the ICO within 72 hours of becoming aware of it, and we will tell you without undue delay where the risk to you is high.

If you think you have found a security flaw, email hello@nothingunsaid.app with the details. We will confirm we have it, keep you updated, and we will not pursue anyone who reports a problem responsibly and does not access other people's data.

What you can do

• Use a password you do not use anywhere else, and keep a lock on your phone.
• Choose sealed-section questions only the right person can answer, and that they will still know in years to come.
• Keep your recipients' email addresses current: a message can only be as reliable as the address it is sent to.

How long we keep it

• Your account and messages: until you delete them or close your account.
• Check-in history: 24 months, so you can see your own record and we can explain a delivery.
• Delivered messages: erased 12 months after delivery. A record that a message was delivered, to whom and when: 6 years.
• Recipient records: until you remove them, or the recipient asks to be removed.
• Backups: deleted data disappears from encrypted backups within 35 days.

Deleting your account

You can delete your account in the app. Deleting it erases your messages, attachments, photos, recipients and check-in history.

Deletion cannot be undone, and any message that had not been delivered will never be delivered.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

Email hello@nothingunsaid.app and we will respond within one month.

Complaints

If you are unhappy with how we have handled your data, tell us first at hello@nothingunsaid.app. We will acknowledge your complaint within 30 days and tell you the outcome as soon as we can.

You can also complain to the Information Commissioner's Office at ico.org.uk, or call 0303 123 1113. You do not have to come to us first, but it usually gets a faster answer.

Children

Unsaid is for adults. You must be 18 or over to hold an account. We do not knowingly collect data about children, and we will delete any account we find belongs to one.

Cookies and analytics

This website uses Google Analytics to count visits and see which pages are read. It sets cookies, so we ask for your consent before it runs, and you can decline without losing anything on the site.

If you would rather not be counted at all, email hello@nothingunsaid.app and we will tell you how to opt out.

Changes to this policy

If we change anything significant we will tell you in the app or by email before it takes effect. The date at the top shows when this version was published.