Privacy Policy
Who we are
Enforso is provided by DOINGA LTD, a private company limited by shares registered in England and Wales (company number 17477068), whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom . We decide what personal data the service collects and why, which makes us the controller of that data. Write to us at privacy@enforso.com about anything in this policy.
The short version
- We collect what the service needs to remind you on time and nothing for advertising. We do not sell personal data, we do not use it for advertising, and we do not track you across other apps or websites.
- Your reminders can reveal your health — the name of a medicine, when you take it. We treat them as health data and process them only with your explicit consent.
- Measurements from Apple Health never leave your device. The service refuses to accept them.
- You can delete your account in the app at any time. What deletion removes, and what stays for a while, is described here.
- Enforso is for people aged 18 and over.
Health data and your consent
A reminder is whatever you write into it, and in a reminder app that is often medical: what you take, how often, whether you took it. Data like this is a special category under data-protection law, and we process it only on your explicit consent, which the app asks for on a screen of its own before your first reminder is saved. The text you consent to is here.
We record that you consented, on which device, when, and to which version of that text, because the law requires us to be able to show it. You can withdraw your consent at any time by deleting your account: without it there is nothing the service may do with your reminders, so withdrawing and deleting are the same step.
Apple Health is a special case. You can let a measurement — a blood-pressure reading, a workout — complete a reminder. Your device does that comparison itself; the service is told only which kind of measurement may complete which reminder, and rejects any request that carries a measurement, a sample identifier or health values. No Apple Health data is used for advertising or stored in iCloud by us.
Reminders about other people
You may keep reminders about somebody else — a parent's medicine, a child's inhaler. That person is described by what you write, not a user of the service. You are responsible for having a good reason to keep that information, and it is deleted together with your account.
What we collect, why, and for how long
The sections below are generated from the same inventory of our database that our tests check against the database itself, and every period comes from the configuration that enforces it.
Account identity
What: Your e-mail address if you sign in by e-mail, and the identifier Apple or Google gives us if you use Sign in with Apple or Google. Sign-in codes are stored only as one-way hashes and stop working after ten minutes.
Why: To sign you in, to let you recover your data on a new device, and to link several devices to one account.
Lawful basis: it is needed to provide the service you asked for.
Who processes it: Apple, Google and Our e-mail provider.
How long we keep it:
- Account and sign-in identities — while your account exists, and deleted when you delete it.
- Where your account and devices are kept, and the hashed keys that find them — while your account exists, and deleted when you delete it.
- Sign-in codes sent to your e-mail address — ten minutes, or until it is used.
Device record
What: A public key your device generates, the platform, the device name, the operating-system and app versions, the timezone and the language, and the settings you choose in the app.
Why: To authenticate requests from your device, to schedule reminders in your timezone, and to know which app versions need an update.
Lawful basis: it is needed to provide the service you asked for.
Who processes it: Our hosting provider.
How long we keep it:
- Device, owner and settings — while your account exists, and deleted when you delete it.
Notification addressing
What: The tokens Apple issues so we can send notifications and Live Activity updates to your device, and a record of each notification we sent.
Why: To deliver reminders, and to answer "did it arrive?" when a reminder is reported missing.
Lawful basis: it is needed to provide the service you asked for.
Who processes it: Apple.
How long we keep it:
- Notification and Live Activity tokens — while your account exists, and deleted when you delete it.
- Instructions to remove a Live Activity from your screen after you delete your account — 14 days after the card has been removed.
- Record of notifications sent — 30 days.
Reminders
What: What you write into a reminder — its name, icon and colour, its schedule, the tags it is bound to, your vacations and your snoozes. A reminder's name may reveal health information, such as the name of a medicine, and we treat it as health data.
Why: This is the service: storing your reminders and sending them on time.
Lawful basis: your explicit consent, because this is health data.
Who processes it: Our hosting provider and Apple.
How long we keep it:
- Reminders, schedules, tags and their settings — while your account exists, and deleted when you delete it.
History and scheduling state
What: When each reminder was due, and whether and when it was completed, missed or postponed — together with the scheduling state the service derives from that.
Why: To show your history, to decide what is due next, and to keep every one of your devices in agreement.
Lawful basis: your explicit consent, because this is health data.
Who processes it: Our hosting provider.
How long we keep it:
- Completions, occurrences and the state derived from them — while your account exists, and deleted when you delete it.
Location triggers
What: The latitude, longitude, radius and place name of each location you choose to attach to a reminder. Your device decides when you arrive or leave; we do not receive your location as you move.
Why: To complete or fire a reminder when you arrive at or leave a place you chose.
Lawful basis: it is needed to provide the service you asked for.
Who processes it: Our hosting provider.
How long we keep it:
- Location triggers — while your account exists, and deleted when you delete it.
Health triggers
What: Which kind of Apple Health measurement — such as a blood-pressure reading or a workout — may complete a reminder. Only the kind: the measurement itself never leaves your device.
Why: To let a measurement you take complete a reminder.
Lawful basis: your explicit consent, because this is health data.
Who processes it: Our hosting provider.
How long we keep it:
- Health trigger configuration — while your account exists, and deleted when you delete it.
Purchases and paid access
What: The identifier we share with RevenueCat for your purchases, the paid tier and entitlements you hold, the events the App Store reports about your subscription, trials, Founder Pass places and invitations, and access codes you redeem.
Why: To give you the paid access you bought, and to keep a record of what was granted and why.
Lawful basis: it is needed to provide the service you asked for.
Who processes it: Apple and RevenueCat.
How long we keep it:
- Tiers, entitlements, store events, trials and Founder Pass — while your account exists, and deleted when you delete it.
- Which access code you redeemed — while your account exists, and deleted when you delete it.
Your consents
What: That you gave your explicit consent to the processing of your health data, on which device, when, and to which version of the consent text.
Why: To be able to show that the consent was given, as the law requires of us.
Lawful basis: our legal obligation to be able to show that consent was given.
Who processes it: Our hosting provider.
How long we keep it:
- Consent records — while your account exists, and deleted when you delete it.
Announcements you have seen
What: Which in-app announcements have been shown to you and which you have read.
Why: So the app does not show you the same announcement twice.
Lawful basis: our legitimate interest in running a reliable and secure service.
Who processes it: Our hosting provider.
How long we keep it:
- Announcement reads — while your account exists, and deleted when you delete it.
Diagnostics from the app
What: Log lines the app uploads when something fails, and events describing what the app did — which screen showed what, whether a notification was handled. Never a HealthKit value.
Why: To find and fix the reason a reminder did not behave as it should.
Lawful basis: our legitimate interest in running a reliable and secure service.
Who processes it: Our hosting provider and Sentry.
How long we keep it:
- Uploaded log lines — 24 hours.
- App events — 30 days.
Service logs
What: For each request your device makes: the device and account it came from, the time, the address it called and how it ended. For a short time, the request and response themselves, with secrets masked — which can include reminder content. And the records the service keeps of what it did on your behalf.
Why: To diagnose delivery failures and to keep the service secure.
Lawful basis: our legitimate interest in running a reliable and secure service.
Who processes it: Our hosting provider and Sentry.
How long we keep it:
- Request log, without bodies — 30 days.
- Request and response bodies, masked — 24 hours.
- Operator request log — 7 days.
- Trace events — 7 days.
- Reminder timeline events — 7 days.
- Live Activity event records — 14 days.
- Live Activity divergence records — 14 days.
- Changes on their way to another account — until the change reaches every account it concerns — seconds, or minutes when a delivery has to be retried — and then deleted.
- Marks that a notification about such a change was already sent — thirty days.
- Background jobs that failed — 14 days.
Early-access sign-ups
What: The name and e-mail address you give on the website, with the IP address and browser it came from.
Why: To tell you when Enforso is available.
Lawful basis: your consent, given when you sent it to us.
Who processes it: Our hosting provider and Our e-mail provider.
How long we keep it:
- Early-access sign-ups — 365 days.
Test-device registration
What: If you ask to test a pre-release build: your device's UDID, model and OS version, with the IP address and browser the request came from.
Why: To register your device with Apple so the test build installs on it.
Lawful basis: your consent, given when you sent it to us.
Who processes it: Our hosting provider and Apple.
How long we keep it:
- Test-device registrations — 365 days.
Visits to the website
What: For each page of enforso.com you open: its address, the page or site that sent you, your browser, operating system and screen size, and the country your IP address points to. Your IP address is used for that lookup and to tell one visit from the next, then discarded; no cookie is set and nothing is stored on your device.
Why: To see which pages people find and read, so we can make the website better. Visits are counted, never linked to an account.
Lawful basis: our legitimate interest in knowing which pages of our website are read, measured without cookies and without identifying you.
Who processes it: GoatCounter.
How long we keep it:
- Page-visit counts — kept as counts per page and day, with nothing in them that identifies you.
Server logs
What: What the service records about its own operation: errors and warnings, with the request they occurred in, and timing traces of requests and background work, which carry device and account identifiers.
Why: To keep the service secure and to investigate faults.
Lawful basis: our legitimate interest in running a reliable and secure service.
Who processes it: Our hosting provider.
How long we keep it:
- Application log — 14 days.
- A note that your account was deleted, with its identifiers and the time, so that a restored backup deletes it again — 180 days.
- Operator audit log — 14 days.
- The service's console output — rotated by size — at most 100 MB per service, the oldest discarded first.
- Performance traces and logs, on our own monitoring server — 90 days.
Who else processes your data
We use these companies to run the service. Each receives only what is listed, only for the reason given.
- Apple (Apple Push Notification service, Sign in with Apple, App Store and StoreKit) receives notification tokens and notification content, your Apple sign-in identifier, purchase and receipt data, and the UDID of a registered test device, to deliver notifications, to sign you in, to take payment and to install test builds.
- Google (Google Sign-In) receives your Google account identifier and the e-mail address on it, to sign you in.
- RevenueCat (subscription management) receives the identifier we use for your purchases, your device and purchase data, and your entitlement state, to keep track of what you have bought.
- Sentry (error monitoring) receives technical reports of errors in the service, with the context of the failing code; personal data is not attached by default, to find and fix faults.
- Our e-mail provider (transactional e-mail) receives your e-mail address and the message, to send sign-in codes and service messages.
- GoatCounter (website visit counting) receives the address of the page you open, the page that sent you there, your browser's user agent, your screen size and your IP address, which it does not store, to count visits to the website without cookies.
- Our hosting provider (servers and storage) receives everything the service stores, at rest, to run the service.
Transfers outside the UK and the EEA
Apple, Google, RevenueCat and Sentry process data in the United States. Those transfers rely on the safeguards the law provides for them — an adequacy decision where one applies, otherwise standard contractual clauses or the UK's international data transfer addendum.
What we do not do
- We do not sell personal data, and we do not share it for anyone's advertising.
- We do not track you across apps or websites owned by others, and the app contains no advertising or analytics SDK.
- The website sets only the cookies it needs to work — a session cookie and a security token. No analytics or advertising cookies — the visit counting described above sets none — so there is no cookie banner to answer.
- We do not make decisions about you by automated means that have legal or similarly significant effects.
Your rights
You have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable form, and to withdraw a consent you gave. Write to privacy@enforso.com from the address on your account, or with your device's identifier from the app; we answer within 30 days. Deleting your account is available in the app without writing to anyone.
You may also complain to a data-protection authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the European Union, the authority of the country you live in.
Age
Enforso is for people aged 18 and over. We do not knowingly accept data from anyone younger, and if we learn that we hold some, we delete it.
Security and breaches
Every connection to the service is encrypted, each device signs its requests with a key that never leaves it, and access to production data is limited to the people who operate the service. If a breach puts your data at risk, we tell the regulator and the people affected within the periods the law requires.
Retention and deletion
Each period above is the longest we keep that data; much of it goes sooner. When you delete your account, your account data is deleted at once, and the few records keyed to your device rather than your account expire within 180 days. The details are on the deletion page.
Changes to this policy
Each version of this policy carries a version number and the date it applies from, shown at the top. If a change affects what you consented to, the app asks for your consent again; other changes apply from the date shown.
Contact
DOINGA LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom — privacy@enforso.com. See also our Terms of Use.