Privacy Policy.

1. Who we are

Sedonis makes local-first apps, including Notch and Turnover, described at sedonis.com and used in a web browser. Sedonis is based in England and Wales. Company registration details will be published here once incorporation completes. We are the data controller for the personal data described in this policy.

For any privacy question, or to exercise your rights, email hello@sedonis.com.

2. The data we collect

• Account data. Your email address, and authentication data needed to sign you in and secure your account.
• Billing data. If you subscribe to a paid plan, our payment processor collects and processes your payment details. We receive limited billing information (such as your plan, subscription status and the last four digits of your card) but not your full card number.
• Your content. The invoices, records, notes and other content you create in the app. This is stored local-first on your device and synced to our servers if you enable sync. Content you place in the encrypted Vault is stored only as ciphertext (see section 5).
• Technical data. Basic information needed to operate and secure the service, for example device or browser type, approximate region, and error/diagnostic logs.
• Usage data. Privacy-respecting, aggregate analytics about how the marketing site and app are used, so we can improve them.

We do not ask for or need special-category data, and we ask you not to store it unencrypted.

3. How we use your data, and our legal bases

Under UK GDPR we rely on the following legal bases:

• To provide the service (performance of our contract with you): creating your account, syncing your data, and delivering the features of your plan.
• To take payment (performance of our contract): processing subscriptions through our payment processor.
• To secure and improve the service (our legitimate interests): preventing abuse, fixing bugs, and understanding aggregate usage. We balance these interests against your rights.
• To contact you about your account (contract / legitimate interests): service messages such as receipts, security notices and important changes.
• Marketing email (consent): only if you opt in, and you can withdraw consent at any time.

4. Who we share it with

We don’t sell your personal data and we never share it for advertising. We use a small number of service providers (sub-processors) strictly to run the service. Each is bound to protect your data and use it only on our instructions.

We may also disclose data where we are legally required to. That said, Vault content is encrypted and unreadable to us, so there is nothing there for us to hand over in a readable form.

5. Encryption and your Vault

Sedonis is local-first: your content lives on your device first. Anything you place in your encrypted Vault is sealed on your device with a key derived from your passphrase, which never leaves your device. For that content we store ciphertext, and we cannot decrypt it.

Content you have not placed in the Vault is handled in Standard mode. With cloud sync on, it is sent to us over an encrypted connection and stored so it can sync across your devices; it is readable by us, and we use it only to provide the service. Your account details, billing status and app settings are never Vault-encrypted, because the app needs them before anything is unlocked.

This is a deliberate trade-off: because we can’t read your Vault, we also can’t recover it if you lose your passphrase. Please keep your passphrase and any recovery method safe.

6. Payments

Paid subscriptions are processed by our payment processor, Stripe. Your card details are handled by the processor under its own terms and privacy policy; we do not store full card numbers on our servers.

7. How long we keep it

We keep your account data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep certain records (for example billing records for tax and accounting) for as long as the law requires.

8. International transfers

Some of our service providers may process data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data protection law (such as the UK’s International Data Transfer Agreement or adequacy regulations).

9. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• correct data that’s inaccurate or incomplete;
• delete your data (“right to erasure”);
• export your data in a portable format;
• object to or restrict certain processing;
• withdraw consent at any time where we rely on it.

You can export or delete most of your data yourself from within the app. To make any other request, email hello@sedonis.com. We’ll respond within the time limits set by law.

10. Cookies and analytics

We keep this light. We use the cookies and local storage necessary to sign you in and remember your preferences, plus privacy-respecting, aggregate analytics to understand how the site and app are used. We don’t use advertising trackers.

11. Children

Sedonis isn’t intended for children under 16, and we don’t knowingly collect their data.

12. Changes to this policy

If we make material changes, we’ll update this page and, where appropriate, let you know by email. The “last updated” date above always reflects the current version.

13. Contact and complaints

Questions or requests: hello@sedonis.com. We handle personal data in line with UK GDPR and the Data Protection Act 2018. If you’re unhappy with how we’ve handled your data you can complain to the ICO at ico.org.uk, though we’d appreciate the chance to put things right first.