Privacy policy

1 · Who we are

Five-Year Diary is published by Lustig Fairchild Ltd., a company registered in Bulgaria, in the European Union, with its seat and address of management at 14 Aleksandar Malinov str., apt. 7, Varna 9000, Bulgaria.

It is registered in the Commercial Register of the Registry Agency, Republic of Bulgaria under 208942846.

For the purposes of the General Data Protection Regulation we are the controller for the limited processing this policy describes. Being established in the European Union, we are not required to appoint a representative under Article 27, and the nature and scale of the processing do not require a Data Protection Officer under Article 37. Neither appointment is made, and this policy says so rather than leaving you to infer it.

2 · What this policy covers

This policy covers Five-Year Diary on Android, as distributed through Google Play, together with its home-screen widget, its daily reminder and its app shortcut. They are parts of the same download.

Five-Year Diary is distributed through Google Play only, and has no edition in any other store.

On Google Play the app is listed as Five-Year Diary: Daily Journal. This policy is the one linked from that listing.

3 · What you write, and where it stays

Everything you put in the app stays in its own storage on the phone:

• Your diaries and their lines — a line a day, kept with its date — and the names you give your diaries.
• The bin. A line you clear, or a diary you remove, waits there for 30 days and then goes for good.
• Photographs, if you add one to a line: a new copy made by the app, at most 1,600 pixels along its long side, carrying none of the original's metadata — where and when it was taken included. The app sees only the picture you choose in Android's photo picker; it has no access to your photo library and asks for no permission to it.
• Your settings — the reminder and its time, the hour your day turns over, the appearance, the typeface and size of your lines, the question of the day, the diary you are in, the last choice you made when bringing in a file, which one-time notices you have seen, and which diary each widget shows.
• A few records about this phone — when the reminder is next due and when it last came, whether the unlock has been confirmed here, a few counts that decide when, rarely, to ask for a rating, and whether the question in section 9 has been asked.

We never see any of it. It is not sent to us, and there is no code in the app that could send it. The app keeps no identifier of any kind.

Erase everything, in the app's settings, deletes every diary, every line — the bin's too — and every photograph from the phone, once you have confirmed it twice. Your settings and your purchase are kept. Uninstalling the app removes everything it keeps.

4 · The reminder, the widget and the shortcut

The reminder is a daily notification at the time you choose, and only if you turn it on. It shows a line you wrote on this date in another year, and you can reply to it to write today's line, which goes straight into the diary. On a locked phone it is marked private, so Android shows only a plain reminder there, unless your phone is set to show private notification content on the lock screen.

The widget shows the day on your home screen, with lines from other years. Anyone who can see your home screen can read what it shows; removing the widget removes it from there and nothing else.

The app shortcut — press and hold the app's icon — opens today's page, ready to write.

None of them makes a request of any kind.

5 · Copies you make

Nothing leaves the phone through the app unless you send it, and then only to the place you choose in Android's own file picker — a folder on the phone, a memory card, or a cloud drive whose app you have installed. That place's own terms apply from there; the app sends nothing anywhere else.

• Export writes a diary as plain text or Markdown, unencrypted — to a file, or to a folder with the photographs copied beside it.
• Seal a copy writes your whole diary — every diary, every line and every photograph — as one file encrypted with a passphrase (AES-256-GCM, with a key derived from the passphrase by PBKDF2). The app offers a passphrase of random words, or takes one of your own, and never keeps it: if it is lost, the copy cannot be opened — not by you, not by us, not by anyone.
• Open a sealed file and Bring in an old diary read the one file you choose and add what is in it to the diary. Nothing else on the phone is read.

6 · What Android's backup and transfer include

If backup is turned on for your device, Android includes your diaries, their lines and the bin, and your settings, in the backup it makes to your Google Account. The photographs are not included — a backup has a size limit, and a sealed copy is how photographs travel. When you move to a new phone with Android's own transfer, the photographs go too. The records about this phone listed in section 3 never travel: a new phone starts them again.

That backup is made by the operating system, stored by Google under your Google Account, and restored by Android when you set up a device. We do not receive it, cannot read it and cannot delete it. Google provides it to you, under your agreement with Google — it is not something we do with your data.

The practical consequences, stated rather than implied:

• Your diary leaves the phone in that backup only if backup is on, protected as Android protects the rest of your backup. The passphrase of a sealed copy plays no part in it.
• Erase everything removes the diary from the phone at once, but not from a backup Android has already made: that copy stays until Android next backs the app up.
• Uninstalling the app removes everything from the phone. A copy can remain in your backup until Android replaces it or Google deletes it; you manage it in your device's backup settings.
• The only controls over this are Android's and Google's. The app has no switch of its own for it.

7 · Permissions

One permission is asked for, and only when you turn on the feature that needs it: notifications, for the daily reminder. Decline, and the reminder stays off; nothing else changes.

Android grants a few more at installation, without a prompt:

• to run after the device restarts, so the reminder is set again after a restart, as it is after a change of time or time zone;
• the Google Play billing service, full network access and view network connections, which belong to Google Play's billing library inside the app — see section 8. The app's own code opens no connection;
• to keep the device awake briefly and run a foreground service, which the system library that keeps the widget up to date uses for its work.

The app asks for nothing else: no location, no contacts, no camera, no microphone, no calendar, and no access to your photos or files beyond the one picture or file you choose each time.

8 · Google Play's parts of the app

Four features of the app are Google Play's own. Each runs through the Google Play app on your device, and it is Google that collects what each one needs, under its own privacy policy. The app itself collects nothing, and none of it reaches us; the one exception, the record of a sale, is in section 13.

• The unlock. Buying it opens Google Play's own purchase screen, and Restore purchase asks Google Play whether your account owns it. The app reads the answer on the phone and unlocks what you bought. Google Play's billing library in the app also reports to Google how its own calls fare — whether they succeed, and any trouble reaching Google Play — which Google uses to improve the library and to support errors. That is why the app has network access at all; we receive none of it, and cannot switch it off.
• The update check. When you open the app, it asks Google Play whether a newer version is available. For this, Google collects information about your device, the app's version and the parts of it that are installed. Google states that this data is encrypted in transit, is not transferred to third parties, and is deleted after a fixed retention period. If there is an update, Google Play may offer it on its own sheet, which you can decline; one you accept is installed when you next leave the app.
• The rating card. Rarely — at most once for each version, and only after the app has been in use for some days — the app asks Google Play to show its rating card, and Google Play decides whether it appears. If you rate the app or write a review, Google collects them and publishes them on the app's Google Play listing, as with any review. Google states that this data is encrypted in transit, and you can delete your review in Google Play at any time. The app is not told whether the card appeared or what you chose.
• The age question, in the United States only — see section 9.

The app's Data safety section on Google Play lists this data, because Google Play asks every app to include what the Google Play libraries it uses collect. It is collected by Google, for the purposes above, under Google's privacy policy; section 12 says in what capacity.

9 · Age signals: the United States only

Some US states require an app to rely on the age information its app store holds about the person using it. Five-Year Diary does so in the simplest way it can.

The app first asks Google Play, on the phone, which country your Google Play account is in. Only if it is the United States, it then asks Google Play, once, for the age information Google Play holds for your account: an age range and how it was established, and — for an account a parent supervises — the parent's approvals and a code Google Play gives that installation. Google Play may first ask you, on its own screen, whether to share it.

The answer is read on the phone and dropped at once. It is not stored, not backed up and not sent anywhere, and it changes nothing: the app is the same for everyone. All the app keeps is a note that the question has been asked, which no backup carries, so a new phone asks again; if Google Play cannot answer, the app asks the next time it is opened. Outside the United States the question is never put.

10 · Where the app's links go

A few rows in the app's settings hand you over to somewhere else, and only when you tap them:

• Sealed copies and Privacy policy open pages of this website in your browser; the website's own privacy notice, at /privacy/, covers the visit.
• Send feedback opens your email app with our support address.
• Recommend another app opens one of our other apps in Google Play. It appears once one is available there.

Google Play's own terms and privacy policy apply on its pages. Nothing is sent to us, except an email you choose to send.

11 · What we never do

The app collects no personal data and sends nothing to us. We run no servers of our own. We do not sell, rent or trade anything about you. There is no profiling and no automated decision-making. The app does not read the advertising ID and is not enrolled in any attribution or measurement framework.

That is not the same statement as “your data never leaves your device”, which would be untrue here: section 6 says what does leave it, section 8 what Google collects, and section 13 the one record that reaches us.

12 · The role of Google

Google is not our processor: it handles your data under its own terms, not on our instructions — even where, as below, it sells to you on our behalf.

• As the distributor of the app through Google Play, Google has its own relationship with you, under the Google Play terms of service and its own privacy policy. The app is free to download.
• For what you buy in the app, Google takes the payment and keeps your payment details and the record of your purchase, under the same terms and policy. In the European Economic Area, the United Kingdom and some neighbouring territories, Google is the merchant of record for the sale, acting as our agent; elsewhere it handles the payment for the sale. What it gives us is described in section 13.
• Through the Google Play app on your device, Google runs the app's update check and its rating card, and collects what each one needs, as described in section 8. A rating or review you leave is published by Google Play, not by us.
• As your backup provider, Google holds the Android backup described in section 6 under your Google Account and your agreement with Google.

Google's handling of your data under each of these relationships is governed by Google's privacy policy, at policies.google.com/privacy, not by this one.

13 · What we receive when you buy in the app

Anything you buy in the app is bought through Google Play's billing system, and Google takes the payment. Your payment details stay with Google: we never see your card or bank details, and Google gives us neither your name nor your e-mail address.

For each sale, Google Play gives us a record of it, in Google Play Console — the service through which we publish the app — and in its monthly reports to us:

• the order number and Google Play's own code for the purchase, the date and time, the product, its price and the tax charged;
• the country of your Google Play account, and the model of the device the purchase was made on;
• in some cases your state or region, and — where Google is not the merchant of record for the sale, as section 12 explains — your postal code and your city, which Google provides for tax.

Nothing else comes with it: nothing about how you use the app, and nothing from it. The app sends us nothing about the purchase either; it asks Google Play, on the device, whether the purchase is yours, and unlocks what you bought.

We use these records for our accounts and our tax returns, and for nothing else. They are seen only by whoever keeps our accounts and by authorities entitled to them by law. Because no name comes with them, we cannot tell whose purchase a record is unless you tell us: Google Play's receipt shows the order number, which begins GPA.

14 · Legal bases for processing

For the app itself, we process no personal data, so no legal basis arises. What the app keeps stays on the device, except that Android may include it in the backup it makes to your own Google Account; that backup is made and held by Google for you, under your arrangement with Google, and never reaches us.

Where Google Play gives us the record of a purchase, described in section 13, the basis is Article 6(1)(c): accounting and tax law require us to keep it.

Where you write to us, the basis is Article 6(1)(f), our legitimate interest in responding to correspondence about our software. You may object at any time by asking us to stop, and we will.

15 · Your rights, and how to exercise them

Under the GDPR and the UK GDPR you have rights of access, rectification, erasure, restriction and objection, and the right not to be subject to automated decision-making. Write to support@lustigfairchild.com. We answer within one month, which is the period Article 12(3) allows.

It is worth being concrete about what such a request would be about here, rather than listing rights and leaving you to guess.

Not what is in the app. What you keep in it sits on your device and, if Android backup is on, in your own Google Account's backup — never with us. Uninstalling the app removes it from the device, and the app's own erase removes what you made in it sooner; the backup is yours to manage in your device's backup settings. There is nothing for us to produce, correct or erase, because we never had it.

The record of a purchase, if you bought something in the app. We hold what section 13 lists, and no name comes with it — so send us the order number from Google Play's receipt, and we will tell you what the record says, or correct it. We cannot delete it while the law requires us to keep it, and we delete it when the law no longer does.

Your correspondence, if you have written to us. That we do hold, and it is what a request would concern: what we have, correcting it, deleting it, or asking us to stop. Ask and we will do it.

That is the whole of it. We hold nothing else about you, so for anything beyond those three the honest answer to a request is that there is nothing to give you.

One right genuinely does not apply: portability under Article 20 covers processing based on consent or on a contract, and we process correspondence on the basis of legitimate interests, and purchase records because the law requires it. We would rather say so than list a right we could not honour.

16 · Children

The app is meant for people aged 13 and over, and is not designed for children. It does not ask your age. In the United States only, it asks Google Play for the age range Google Play holds for your account, as section 9 describes, and keeps no record of the answer. We do not knowingly process children's personal data, and there is no mechanism in the app by which we could.

17 · Retention, security and international transfers

The app itself sends us nothing, so there is nothing from it to schedule for deletion. Support correspondence is kept for 24 months.

The record of a purchase, described in section 13, is kept for as long as accounting and tax law requires us to keep the records it supports, and is then deleted.

The app's own data never reaches us, so we make no international transfer of it and hold nothing of yours on any server of ours to secure. The security of your Android backup, and where in the world Google stores it, are matters for Google's privacy policy; on the device, the app relies on the operating system's own protection of app data.

18 · Notice for residents of the United States

We do not sell or share personal information as those terms are used in the California Consumer Privacy Act, and the only personal information we have in connection with this app is the record of a purchase described in section 13, which we use for our accounts and nothing else. We do not use or disclose sensitive personal information beyond what is permitted. No financial incentive is offered for personal information, and nobody is treated differently for exercising a right.

The same holds under the comparable laws of other US states. You may contact us at the address in the last section in any case.

19 · Other jurisdictions

Where local law gives you stronger rights than this policy describes, those rights apply, and nothing here limits them.

20 · Changes to this policy

Every version is dated and numbered, and superseded versions stay published at /legal/archive/ so you can read what applied before. Where a change affects you, the version number moves by a whole number rather than a decimal.

This is the first version of this policy. Five-Year Diary is distributed through Google Play only, so this is its only policy.

21 · Contact, and how to complain

support@lustigfairchild.com, or by post at the address in section 1.

You also have the right to complain to a data protection supervisory authority, and you do not have to come to us first. Ours is the Commission for Personal Data Protection in Bulgaria, at cpdp.bg. You may instead complain to the authority in the country where you live or work.