Privacy policy

Who is responsible

ZINFER TECHNOLOGIES, S.L. (“Zinfer”), Calle Magdalena Díaz 22, 8.º B, 28035 Madrid, Spain, NIF B05776141, publishes Ampersand and is responsible for the data it processes. Write to ampersand@zinfertech.com for anything about your data.

What we keep

Your name and email, which come from Apple or Google when you sign in. The language you use the app in, so notifications reach you in it. What you write and the photos you upload in each journey. Your answers to the opening questions of each journey. Little else: we don’t ask for anything the app doesn’t need to work.

The other person’s name

When you start a journey you give us the first name of the person you’re doing it with, so we can say “Waiting for Ana” and remind you about the invitation. It is someone else’s information that you give us: only use it if you know they won’t mind. It lives in that journey and is deleted the moment that person joins with their own account. It never goes to analytics.

Journeys written with AI

Each journey is written by Claude, a model made by Anthropic (United States), from what you answer when you start it: the opening questions and, if you write one, the open answer. It is only sent if you accept on the consent screen; without that permission nothing is written. Before sending, we replace names with placeholders, so Anthropic doesn’t receive your names, your email, or anything you write during the journey. Anthropic acts as a processor: it uses this data only to write the journey. We also keep the first name of the person who creates the journey: we use it only on our server, to personalise the days the AI generates once they are written; we never send it to Anthropic or to analytics. Our team can read those answers and the days that get written, to review them before you reach them. What you write each day is read only by the people doing the journey.

Who else handles it

Supabase stores the database and handles sign-in, in the European Union. Sentry collects app errors, in Frankfurt, and adds an approximate location it infers from the connection: we don’t send it and can’t prevent it. PostHog, in the European Union, receives which sign-up screens are seen and what is chosen on them (for example, the kind of relationship or the pack), with the language, platform and app version: never names, text or photos, and it never records the screen. RevenueCat, in the United States, manages purchases: it receives from Apple or Google the record of each purchase, linked to an identifier of your account, never to your name or to what you write. PostHog and RevenueCat act as processors: they handle this data on our behalf and for nothing else. Our own server in Spain puts together the video keepsake. Apple and Google identify you when you sign in and charge for purchases; we never see your payment details. If you sign in with Apple, we also keep a long-lived Apple credential: it lets us revoke your access at Apple when you delete your account, and it is only read at that moment.

Why, and on what legal basis

• Your account, your journeys, what you write, your photos and your purchases: to provide the app you signed up for (performance of a contract).
• The opening answers sent to Anthropic: your consent, given on the consent screen. Without it, no journey is written with AI.
• The other person’s first name: our legitimate interest in letting you invite them and remind you about it.
• Error reports to Sentry: our legitimate interest in keeping the app working.
• Sign-up screens measured with PostHog: [legal basis to confirm: consent or legitimate interest].
• Notifications: your permission, which you can withdraw in Settings.

Transfers outside the European Union

Anthropic and RevenueCat are in the United States. Transfers to them are covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses, as each provider offers.

Notifications

They’re optional. You can turn them off in Settings at any time, and mute a single journey without turning off the others. If you invite someone and they haven’t joined yet, we remind you at most twice (after 48 hours and after 12 days), and never again.

Taking your data with you

From Settings, “Export my data” gives you everything of yours in a file: your profile, your journeys, what you wrote and your photos. On a day you both wrote, the photo is included in your export even if the other person uploaded it: it’s an entry that belongs to both of you.

Deleting your account

Also from Settings, with “Delete my account”, and it’s immediate. What you wrote in a shared journey stays, but without your name: it also belongs to the other person, and they can’t lose what’s theirs because you leave. If you were the only person left in a journey, that journey is deleted entirely. The record of your purchases is deleted with your account; Apple or Google, and RevenueCat, keep their own record under their own terms. One exception: if the video keepsake of that journey had already been made before you deleted your account, your first name still appears in it and on its cover, as they were composed — they are an image and a video, not data that can be rewritten.

Age

You must be 16 or older to use Ampersand.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format (the export above does this), and to withdraw any consent you gave. Write to ampersand@zinfertech.com; we answer within one month. You can also complain to the Spanish Data Protection Agency (AEPD), at www.aepd.es.

This text is also available in Spanish. If the two versions differ, the Spanish one prevails.