Privacy Policy

This Privacy Policy explains how Tarn ("we", "us", "our") collects, uses, and protects your personal data when you use the Tarn iOS application and related services.

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

---

1. Who we are

Tarn is operated by Nick Allen, based in the United Kingdom. If you have questions about this policy or how we handle your data, contact us at privacy@tarnapp.co.uk.

2. What data we collect

We collect the following categories of personal data:

• Account data: email address and name (provided when you sign in with Apple or email)
• Content data: items you capture via text, voice, or photo; notes and due dates you add to items
• Usage data: events such as items captured, categories corrected, and features used (collected via PostHog analytics)
• Device data: push notification token (if you enable reminders), device type, and OS version
• Email content: if you use email forwarding, the body of emails sent to your Tarn capture address

3. How we use your data

We use your data to:

• Provide and operate the Tarn service
• Classify and organise the items you capture
• Send reminders for items with due dates (if enabled)
• Improve the service through aggregated, anonymised analytics
• Respond to support requests and account queries

Our legal basis for processing is contract performance (providing the service you signed up for) and legitimate interests (improving the service and preventing abuse).

4. Who we share data with

We share data with the following third-party processors to operate the service:

• Supabase — database, authentication, and storage (EU-hosted; no international transfer)
• Railway — backend API hosting (US; covered by Standard Contractual Clauses)
• Google (Gemini API) — AI classification of captured items (US; covered by Google Cloud Data Processing Addendum and UK IDTA provisions)
• Expo (EAS) — mobile app build and push notification delivery (US; covered by Expo DPA and Standard Contractual Clauses)
• PostHog — product analytics (EU Cloud; no international transfer)
• Resend — transactional email delivery

We do not sell your personal data to third parties.

5. International transfers

Some of our processors operate outside the UK. Railway, Google, and Expo are based in the United States. Transfers to these processors are made under Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Agreement (IDTA). Supabase and PostHog are EU-hosted and no international transfer is required.

6. Data retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete all associated data within 30 days, except where we are required to retain data to comply with legal obligations.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate data
• Erasure ("right to be forgotten") — you can delete your account and all associated data from within the Tarn app
• Portability of your data in a machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@tarnapp.co.uk.

8. Security

We use industry-standard security measures including TLS encryption in transit, row-level security on all database tables, and access controls on all infrastructure. We review our security posture regularly.

9. Cookies and tracking

The Tarn iOS app does not use cookies. Our website (tarnapp.co.uk) does not use advertising or tracking cookies. We use minimal first-party analytics only.

10. Children

Tarn is not intended for use by children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notice. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact and complaints

For privacy-related questions or data requests, contact us at privacy@tarnapp.co.uk.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.