Privacy Policy

Summary of Key Points

ClanIt is a zero knowledge app. Everything you store in the app is encrypted on your device before it leaves your device. We store only encrypted data that we have no ability to read. The personal information we hold is a display name you choose, basic device information needed to run the Service, the identifiers that link your account to a subscription sold by Apple or Google, a private log of actions taken on your own account, and technical diagnostic records of the requests your device makes to our servers. We collect no email addresses and no card or payment details, and we hold no sensitive personal data in readable form. Paid subscriptions are sold by Apple through in app purchase on iOS and by Google through Google Play on Android, and the store collects your payment details directly from you.

1. What Information Do We Collect?

We collect the minimum information necessary to operate the Service, described below.

Display name

When you first register, Apple or Google may pre fill your name. Whatever you submit at that point is what we store as your display name. You can change it at any time within the app. Your display name is visible to your Clan Contacts and Clan Members, and is used in clan activity entries to record who performed an action within a clan.

Account identity

You sign in with Sign in with Apple on iOS or Sign in with Google on Android, which gives us an opaque identifier for your Apple or Google account; that identifier is what your ClanIt account is keyed to. An account on one platform is never linked to an account on the other. On iOS we also hold, encrypted at rest, the Sign in with Apple token that lets us withdraw ClanIt’s access to your Apple identity when your account is permanently deleted, so that ClanIt no longer appears in your Apple account afterwards. On Android we hold no Google token: we verify the identity token Google issues at sign in and keep only the identifier. We never receive your Apple or Google password. Apple gives us no email address, and the email address carried in the Google sign in token is discarded and never stored.

Device information

For each device you register, we store a device identifier, your device name, and your device model so you can identify and manage your registered devices within the app. We also store the technical credentials needed to operate your device securely: a public key used to seal your encryption keys to that device, attestation identifiers and counters that prove your app is genuine, a record that a PIN has been set, a record that you have acknowledged on that device that we cannot recover your encrypted content, your private key escrow held as ciphertext, and, if you enable notifications, a push notification token for the push service of your platform, Apple Push Notification service on iOS or Firebase Cloud Messaging on Android. We hold your sessions only as hashed values, never as usable tokens. We do not collect browser type, operating system version, carrier information, or any other device data beyond this and the app version described under diagnostic records below. We do not store IP addresses as part of your account. Like any internet service, our hosting infrastructure may process a network address while a request is in transit to deliver it, protect the Service, and apply rate limiting, but it is never recorded against your account or used to build a profile of you.

Subscription identifiers

Every account starts on the free tier. If you subscribe to a paid tier, the subscription is sold by Apple through in app purchase on iOS or by Google through Google Play on Android (see Section 12). To link your account to that subscription and to keep your tier correct, we hold: your subscription tier, your ClanIt account identifier as the store carries it, which Apple calls the app account token and Google the obfuscated account identifier, the store’s identifier for your subscription, which is Apple’s original transaction identifier or Google’s purchase token, the type and date of the most recent notification the store sent us about it, the end date of the current period where the store reports one, any tier change the store has scheduled for the end of the period, whether a downgrade cooling off period is running, and whether we have sent you a storage warning. We also keep a copy of each subscription notification the store sends us, stored as it was sent. We do not receive or store your card details, your billing address, or the email address on your Apple or Google account.

The app account token, or on Android the obfuscated account identifier, is your ClanIt account identifier, which the app sends to the store when you buy a subscription. The store carries it on the purchase and returns it on every later notification, which is how a notification is matched to your account without any further lookup. It is the only value about you that we send to Apple or Google in connection with a purchase.

User activity

We keep a private log of actions taken on your own account, such as profile changes, subscription changes, and deletion requests. Each entry records an event name, a timestamp, and related identifiers. This log is visible only to you within the app and contains none of the content you store.

Clan and sharing structure

Sharing in ClanIt happens through clans, and the structure of that sharing is held by us in readable form so that it can be enforced: the name you give each clan, who owns it, who its members are, the permissions set on it, which tiles and items are shared into it, the invitations sent and pending, the contact links between you and the people you have connected with, and any short lived share token you generate to form one. Each clan also carries an activity log of what has happened within it, naming the tile concerned and the display name of the member who acted, which every member of that clan can read. None of this includes the content of what is shared, which remains encrypted. Clan names are visible to the members of that clan and to us, and never appear in a notification.

Diagnostic records

Each request your device makes to our servers produces one diagnostic record so we can operate, secure, and troubleshoot the Service. The record holds your account identifier, your device identifier, the route called and the operation on it, the response status and any error code, how long the request took, and the version of the app that made it. It never records the body of a request or response, your content, your keys, or your credentials. These records are held by our hosting provider and are used only to investigate faults, security events, and support tickets. They are not used to profile you or to analyse your behaviour.

Support messages

If you contact us through the in app support feature, the messages you send and our replies are stored in plain text so we can respond. We do not ask for or require any personal information in support messages. See Section 13 for full details.

We do not collect email addresses, card or payment details, or location data, and we hold no sensitive personal information in readable form. Any sensitive details you choose to store are kept as encrypted content that we cannot read. Apart from the subscription information Apple or Google sends us, we collect no data from third parties.

2. How Do We Process Your Information?

We process your information solely to operate the Service:

1. Your display name allows other users you have connected with to identify you within the app.

2. Your account identity allows us to sign you in, and, on iOS, to withdraw our access to your Apple identity when you delete your account.

3. Your device information allows us to manage which devices can access your encrypted data and allows you to manage your own device list.

4. Your subscription identifiers allow us to apply the tier you have paid for, to keep it aligned with what your store reports, and to answer Apple when it asks us about a refund you have requested.

5. Your activity log allows you to see what has happened on your own account.

6. Your diagnostic records allow us to keep the Service running, detect abuse, and investigate a problem you report.

7. Your support messages allow us to respond to your query.

We do not use your information for marketing, advertising, profiling, or any purpose beyond operating the Service.

3. What Legal Bases Do We Rely On?

If you are located in the EU or UK, the GDPR and UK GDPR require us to explain the legal bases we rely on to process your personal information. We rely on the following:

1. Performance of a contract: we process your display name, account identity, device information, subscription identifiers, activity log, and support messages because it is necessary to provide the Service you have contracted with us to receive.

2. Legitimate interests: we keep diagnostic records because we have a legitimate interest in keeping the Service secure, reliable, and available, and in defending it against abuse. This processing is minimal, records no content, and does not override your rights.

3. Legal obligations: we may process your information where necessary to comply with our legal obligations, such as to cooperate with a law enforcement body or to exercise or defend our legal rights.

If you are located in Canada, we may process your information based on express or implied consent, or as otherwise permitted by applicable law.

4. When and With Whom Do We Share Your Personal Information?

We do not sell your personal data. We do not share your personal data with any third party for marketing or advertising purposes.

To be clear about what "personal information" means in this section: it refers only to the limited account level information described in Section 1. It does not refer to the content you store in the app. Your tile items, notes, and attachments are encrypted on your device before they leave your device. We have no ability to share your content in readable form with anyone under any circumstances.

There are three situations in which account level information leaves us: a purchase, an Apple refund request, and a business transfer.

Purchases

When you buy a subscription, the app sends the store, Apple or Google, your ClanIt account identifier described in Section 1, so that the store can return it to us with the purchase and with every notification about it. Nothing else about you is sent. The store collects your payment details directly from you as the seller of the subscription, and we never receive them.

Apple refund requests

If you dispute a subscription charge with Apple, Apple requests information from us to decide the refund. We automatically provide Apple with limited account facts: how long your account has existed, expressed only as one of Apple’s broad tenure ranges, whether your account is active, that the paid service was delivered and working, that the free tier exists as sample content, and the app account token. Because ClanIt is a zero knowledge service, we hold no usage, consumption, or lifetime purchase figures, and we declare these to Apple as not held. No content, documents, names, or usage behaviour is ever sent, and we state no preference on whether the refund is granted. This information is sent only to Apple, only to inform its decision on your own refund request, and within the response window Apple requires, which is why it is sent automatically. Google makes no such request: a refund decided by Google reaches us only as a notification that the subscription has been refunded or revoked, and nothing about you is sent to Google in return.

Service providers

Microsoft hosts our infrastructure and our diagnostic records. Apple delivers sign in, in app purchase, push notifications, and wallet passes on iOS, and Google delivers sign in, Google Play billing, push notifications through Firebase Cloud Messaging, and Google Wallet passes on Android, as described in Sections 6 and 12. Cloudflare serves this website and our domain, so it handles the network address of anyone reading these pages in the ordinary course of serving them and holds nothing about your ClanIt account. They process data only on our instructions, except where Apple or Google acts in its own right as the seller of your subscription.

Business transfers

We may share or transfer your account level information in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business. Your encrypted content would transfer as opaque encrypted data that the acquiring party would have no ability to read.

5. How Long Do We Keep Your Information?

We keep your information for as short a time as required to operate the Service. We retain your account information only for as long as your account is active. When you delete your account, all information we hold about you is permanently deleted, including the copies of the notifications Apple or Google sent us about your subscription. Three records are the exception, none of which holds your content. The diagnostic records described in Section 1 are removed when they reach the end of the retention period set with our hosting provider rather than being deleted individually with your account. Our administrative audit log records any action an operator took on your account, such as repairing a tier or deleting the account at your request, against your account identifier, and keeps that entry for 365 days. A subscription notification that Apple or Google sends after your account is gone can no longer be matched to an account; it is held, carrying only your account identifier as the store carries it and the store’s identifier for the subscription, until an operator has reviewed it, and is then removed.

The following automated processes also apply:

1. If you register but never complete onboarding, your account is permanently deleted after 30 days.

2. Free tier accounts inactive for more than 90 days are permanently deleted.

3. If you request account deletion, or on iOS withdraw ClanIt’s access to your Apple identity in your Apple account settings, a 14 day window applies during which you may reinstate your account. After 14 days, your account and all associated data are permanently and irreversibly deleted.

4. Support tickets close automatically after 14 days of inactivity, are archived 14 days after closing, and are permanently deleted 120 days after that. Deleting your account permanently deletes your support tickets with it.

5. User activity log entries are kept for 120 days and are automatically removed once they age out.

6. Copies of the subscription notifications Apple or Google sends us are kept for 180 days and are then automatically removed, and are deleted sooner if you delete your account, apart from a notification that arrives after deletion, which is held until an operator has reviewed it.

7. Diagnostic records are kept by our hosting provider for a limited period and are then automatically removed. They expire on that schedule rather than being deleted individually when you delete your account.

All deletions are permanent and irreversible. Your subscription record at Apple or Google is governed by that store’s own retention rules.

6. How Do We Keep Your Information Safe?

All content you store in ClanIt is encrypted on your device before it leaves your device using end to end encryption. We store only encrypted blobs that we have no technical ability to read or access. Your content is never transmitted to us in readable form.

For the limited account level information we do hold, your display name, device information, subscription identifiers, and diagnostic records are stored on secure infrastructure in the United Kingdom with strict access controls. Every protected request is bound to a device whose integrity is attested by the platform, Apple on iOS and Google on Android, sessions are short lived and rotate on every use, and every notification a store sends us is verified before it is recorded or acted on, against Apple’s signature for Apple and against Google’s signed delivery token for Google. Administrative access is restricted to named identities, and every administrative action is recorded in an audit log.

We keep no recoverable backup of your data and we will not restore one. Our infrastructure is built so that, if it were ever catastrophically lost, we would rebuild it clean rather than roll it back to an earlier state. That is deliberate: rolling back could return an account you deleted, return a device you removed, or return security state you have since changed, and none of those outcomes is safe. The consequence is that content lost that way is gone and we cannot recover it, which is why ClanIt is not a backup service and why you should keep your own copies of anything you cannot afford to lose. A paid subscription is unaffected, because it is held by Apple or Google rather than by us and can be restored in the app.

The in app support feature is a separate plain text channel: messages you send to us are stored in plain text so we can read and respond to them. We do not request personal information in support messages. See Section 13.

7. Do We Collect Information from Minors?

ClanIt is for families. Anyone who may hold an Apple account on iOS or a Google account on Android under the terms and age requirements of Apple or Google may use ClanIt, and those terms govern who may buy a subscription. We do not knowingly collect information from children below the minimum age the platform sets for holding an account, and we collect the same information from all users as described in Section 1, regardless of age.

8. What Are Your Privacy Rights?

In the EEA, UK, Switzerland, and Canada, you have certain rights under applicable data protection laws, including the right to access, correct, or delete your personal information, and the right to data portability.

Because ClanIt holds so little personal information about you, exercising these rights is straightforward:

1. Update your display name: do this directly within the app at any time.

2. Export your account data: the in app data export provides the personal information we hold about you, namely your display name, your registered devices, and your user activity log.

3. Export your stored content: the export is produced on your device from locally decrypted content and never passes through our servers in readable form.

4. Delete your stored data without closing your account: the Delete My Data feature in the app permanently removes everything you have stored, namely your tile items, your notes, your attachments, the encryption keys that protect them, and the clans you own other than your Primary clan, together with every other device registered to your account. Your account, your subscription, your memorable word, your Primary clan, and the device you use to make the request remain. This is irreversible.

5. Delete your account: use the account deletion feature within the app. This permanently deletes all information we hold about you, apart from the three records described in Section 5, which hold none of your content and expire on the schedules set out there. Deleting your ClanIt account does not cancel a paid subscription; only you can cancel that, in your Apple account settings or in Google Play, and you will continue to be billed until you do.

6. Your billing details: the payment method and billing information you gave Apple or Google are held by that store. Exercise your rights over them with Apple or Google.

7. Any other request: write to us at the postal address in Section 15. We will respond within one calendar month.

We do not use automated decision making. We do not profile you. There is no meaningful processing of your personal information beyond what is described in Section 2.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your Member State data protection authority or the UK Information Commissioner’s Office. You can contact the ICO at ico.org.uk, by telephone on 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

9. Do We Use Tracking Technologies?

No. ClanIt does not use cookies, tracking pixels, analytics SDKs, advertising networks, or any tracking technology of any kind in the app. We do not track your behaviour, browsing activity, or usage patterns, and the diagnostic records described in Section 1 are operational records, not analytics. There is nothing to opt out of.

10. Do United States Residents Have Specific Privacy Rights?

If you are a resident of California, you may have rights to access, correct, or delete personal information we hold about you.

Beyond what is described in Section 1, we do not collect additional personal information as part of your ClanIt account. We have not sold or shared any personal information with third parties for advertising or any other commercial purpose in the preceding twelve months; the only disclosures we make are those described in Section 4, to operate the Service. We will not sell or share personal information in the future.

To exercise your rights, use the in app controls described in Section 8, or write to us at the postal address in Section 15.

11. Zero Knowledge Architecture

ClanIt is built on a zero knowledge architecture. Everything you store in the app, including tile items, notes, and attachments, is encrypted on your device before it leaves your device. We store only encrypted data that we have no technical ability to read, interpret, or reconstruct under any circumstances. This is an architectural property of the Service, not a policy position.

12. Apple and Google Platform Services

ClanIt runs on the platform services of Apple on iOS and Google on Android, and some features rely on them. The platform of your account decides which apply:

1. Sign in with Apple: you sign in with Apple, which gives us an opaque identifier for your account. We never receive your Apple email address or your Apple password. If you withdraw ClanIt’s access to your Apple identity in your Apple account settings, Apple tells us, and your account enters the same 14 day deletion window as a deletion you request yourself, so a withdrawal made by mistake can still be undone by signing in again within that window.

2. Sign in with Google: on Android you sign in with Google, which gives us an opaque identifier for your Google account. We hold no Google token and keep nothing from the sign in beyond that identifier. Google does not tell us when you remove ClanIt from the third party access list of your Google account, so doing that does not delete your ClanIt account; delete your account in the app, which starts the same 14 day deletion window.

3. App Store and Google Play: the app is distributed through the App Store on iOS and through Google Play on Android, and the terms of Apple or Google govern that distribution.

4. Store billing: paid subscriptions are sold through Apple on iOS and through Google Play on Android as an auto renewing in app subscription. The store is the seller, takes your payment, collects any applicable tax, issues your invoice or receipt, and handles renewals, cancellations, and refunds. We receive from the store only the subscription facts listed in Section 1; Google delivers its subscription notifications to us through Google Cloud Pub/Sub, a Google service that carries each notification to our servers. Prices are set by us in App Store Connect and in Google Play Console and shown to you by the store in the currency of your storefront or country; neither the app nor our servers hold a price.

5. Free trial: the free trial offered with a paid tier is an introductory offer of the store. Whether you are eligible is decided by Apple against your Apple account or by Google against your Google account, not by us and not against your ClanIt account, so a second ClanIt account signed in to the same Apple or Google account is not offered a further trial. We hold no record of trial usage.

6. Refund requests: if you dispute a subscription charge with Apple, Apple requests information from us to decide the refund, and we automatically provide Apple with the limited account facts described in Section 4, and nothing more. Google asks us for nothing when it decides a refund.

7. Push notifications: notifications are delivered through Apple Push Notification service on iOS and Firebase Cloud Messaging on Android. A notification may carry a display name, a device name, or a tile name so you know what it concerns. It never carries a clan name, your encrypted content, or any key.

8. Apple Wallet and Google Wallet: you can keep a permanent connect pass in the wallet of your platform for connecting with people in person. On iOS we build and sign the pass and your device installs it. On Android we build the pass and Google Wallet holds it as a pass object under our issuer account, so Google holds what the pass carries, and the themed ClanIt logo shown on it is fetched by Google from clanit.app. Either pass carries your display name on its face, your ClanIt account identifier for support reference, and a QR code containing a link that resolves to your display name and nothing more. It contains none of your stored content.

13. Support Tickets

The in app support feature is a separate plain text channel for raising a question or problem, available on paid tiers. Zero knowledge applies to the content you store in the app and is not affected by a support message. When you contact us through the support feature, the messages you send and our replies are stored in plain text so that we can read and respond to your query. We do not ask for or require any personal information in support messages, and you should not include sensitive personal information in them. A ticket closes when you close it or automatically after 14 days of inactivity. A closed ticket is archived shortly afterwards, at which point it is no longer visible in the app, and it is permanently deleted after that. Deleting your account permanently deletes all of your support tickets and their messages.

14. Do We Make Updates to This Notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top of this notice. If we make material changes, we will notify you via the app. The current version is always available at clanit.app/privacy.

15. How Can You Contact Us?

If you have questions or comments about this notice, you may contact us through in app support if your plan includes it, or by post at:

ClanIt Ltd

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

ClanIt Ltd is registered with the UK Information Commissioner’s Office under registration reference ZC171157.

The address support@clanit.app is published because the app stores require one. Support is provided through the app, so a message sent to this address receives an automatic reply asking you to raise a ticket in the app. The mailbox is monitored, messages are not retained beyond that reply, and your email address is not added to any list.

16. How Can You Review, Update, or Delete Your Data?

All account management is self service within the app. You can update your display name, manage your devices, export your data, delete your stored data, and delete your account entirely from within the app at any time. Your subscription is managed in your Apple account settings or in Google Play, reached from Manage Subscription in the app. To make a formal request or for anything not covered by the app, write to us at the postal address in Section 15.

ClanIt Ltd | Company No. 17209874 | clanit.app