Privacy policy

What stays on your phone, on every plan

These never leave your phone, and neither does what you do with them. The phone checks this before anything is sent.

• One-time codes. On Android 15 and later, Android hides these from apps like ours in the first place.
• All SMS, whoever sent it. We never ask for the SMS permission.
• Apps that skip judging. Banking apps we recognise start on this list, and you can add or remove any app.
• That list itself. It doesn't sync, because it would show which banks you use.
• The list of apps on your phone. We use it on the phone to suggest Whens and to find the app you name.
• Ongoing, media and progress notifications. There is nothing to judge, so they are never sent for judging.

Your Whens still act on all of these, because Whens run on the phone. They keep working with no connection.

What reaches us on Free, or with judging off

Nothing from your notifications. Your history stays on your phone, for 7 days on Free. What reaches us is:

• Your account. Your email address, and your name if you sign in with Google.
• Your plan. Whether you are on Free, on a trial or on Plus, and when it renews or ends.
• Your devices. A random ID the app creates, the phone model and the app version.
• Your Whens. Each sentence, the rule made from it, whether it is on and how often it has fired. This backs them up so they can follow you to a new phone.
• The sentences you type. When you write a When, the sentence goes through our servers to our AI provider, only to turn it into a When. Nothing is saved until you check it.

What also reaches us on Plus, with judging on

We ask you before judging starts. You can turn it off whenever you like, and Plus stays active.

• Notifications to judge. The app name, title and text of each notification your Whens didn't already handle. These go through our servers to our AI provider, which answers with a category. We don't store the text at this step.
• Your history. What came in and whether it was hidden, shown or shown first, including its title and text, so that every device you sign in on has it.
• How you treat notifications. What you open, swipe and ignore, and what you mark as wrong or as mattering.
• A review each night. Once a night, our AI provider reads your day, including what was hidden and what you marked, and writes your guide for the next day. A guide has instructions for judging, patterns your phone applies by itself and suggested Whens.

If you turn judging off, nothing from your notifications reaches us, the nightly review stops and nothing it learned acts on your phone.

Who can see it

• Our servers. They run on Cloudflare, which also sends our sign-in emails.
• Anthropic, our AI provider. Its Claude models write Whens from your sentences, judge notifications and do the nightly review. Anthropic doesn't train its models on this without permission and deletes it within 30 days. Anthropic can keep content it flags for up to 2 years.
• Our team, through a dashboard. It shows accounts, plans, devices and counts. It never shows the text of your notifications or your sentences. When a suggested When reaches a person for review, its words are blanked.
• Google Play and RevenueCat, if you subscribe. Google Play takes the payment and RevenueCat manages the subscription. Neither sees your notifications.
• Google, if you sign in with Google. It tells us who you are.

Other users never can. A person reviews every guide we publish for everyone, and a guide carries no account, device ID or personal words from anyone. We don't sell your data.

These companies may handle your data outside your country.

How long it stays

• Whens, history and your guide. Until you delete them or your account.
• Sign-in. A sign-in code lasts 10 minutes. You stay signed in on a device for 90 days after you last used it.
• After you delete something. It leaves our servers straight away. Copies in our backups and with Anthropic usually clear within 30 days.
• Flagged content. Anthropic can keep it for up to 2 years, as above.
• Totals. Totals with nothing tying them to a person can stay, such as what we spent on AI on a given day.
• Payments. Google Play keeps its own payment records, under Google's terms.

We keep nothing else tied to you for security or legal reasons. If that ever has to change, we'll say so here.

How to download or delete it

In the app, go to Settings and choose Download or delete my data. It asks for your phone's lock first, because the file holds private messages.

• Download a copy saves one file with your account, Whens and history. It leaves out SMS, one-time codes and apps that skip judging, because we never had them.
• Delete my history clears synced history and what judging learned, on every device and on our servers. It keeps your account, plan and Whens. On Free, your history lives only on your phone, so this never touches a server.
• Delete my account removes everything, including your record with RevenueCat. You can also do this without the app, on the delete your account page.

Deleting your account doesn't stop charges from Google Play. If you have Plus, cancel it there as well.

This website

It has no analytics and sets no cookies. It loads its fonts from Google Fonts, so Google sees your IP address when a page opens. Cloudflare serves the site.

If you join the early list, we keep your email and use it only to tell you when WhenThen is ready. Write to us and we'll remove it.

The delete page keeps your sign-in only in the open tab, and it is gone when you close the tab. To stop abuse, we count sign-in and early list tries by email and by IP address for about an hour.

If this changes

We'll update the date at the top, and we'll tell you in the app before a change affects what reaches us.

Talk to us

Write to hello@whenthen.msomu.com with any question about your data.