Privacy policy.

This Privacy Policy explains how Social Vortex Limited, trading as NOT YET ("NOT YET", "we", "us" or "our"), handles personal information when you use the NOT YET app, website, support services and physical Tag ordering services.

1. Who is responsible for your data

The data controller is:
Social Vortex Limited
55 Colmore Row, Birmingham, England, B3 2AA
Company number: 15233693
Privacy contact: [email protected]

2. Our privacy approach

NOT YET is designed so that core morning rule enforcement can operate on-device. Where technically practical, personalisation and behavioural context should remain on your device rather than being uploaded to our servers.

Your app selections are chosen through Apple's own picker and returned to us as opaque tokens — we never learn which apps you picked, and the selection never leaves your device. It is never transmitted to us, a school, an employer, an analytics provider or any backend.

Examples intended to remain on-device by default: exact apps you choose to restrict; first name used for local personalisation; selected reason; custom personal goal; exact step progress; precise location used to evaluate a challenge; NFC tag contents; local message history; active local challenge state.

The final production implementation may vary by app version and Apple platform capability.

3. Information we may process

A. App and device information

Limited technical information required to operate NOT YET: app version, build number, device type/model, iOS version, timezone, locale, pseudonymous installation or device reference, push-notification token, approved feature/configuration state, technical error information.

B. Subscription and purchase information

Where you purchase through Apple, we may receive limited transaction or entitlement information needed to determine trial status, subscription plan, entitlement state, renewal or expiry state, and refund or revocation state. Apple processes your App Store payment information. We do not receive your full payment-card details from Apple.

C. Support information

If you contact support through our support channels: email address, name if you provide it, conversation content, screenshots or attachments you choose to send, app version, device / iOS information, relevant permission state, Tag/order reference, technical diagnostic information. We do not intentionally attach unnecessary personal behavioural information to support conversations.

D. Tag orders

If you purchase a physical NOT YET Tag: name, email address, shipping address, country, order details, payment status, fulfilment status, carrier, tracking information, replacement / return history, support history relevant to the order.

E. Website information

Depending on the website configuration: basic server logs, IP address, browser/device information, contact form information, consent preferences, and — with consent where required — Google analytics data and ad-conversion measurement from Google Ads, Meta, X and TikTok. See the Cookie Notice. These technologies apply to the website only, not to what you do inside the app.

F. Product analytics

For adults, product analytics starts on for a new setup. You can turn it off in the app, and an existing opt-out is preserved. Our first-party event system processes limited product events, such as onboarding completion, rule creation, challenge type, rule completion, overrides and app version. These records use a pseudonymous account reference; they are not anonymous when collected. Children are excluded from optional product analytics. The separate step-reporting choice below starts off.

We should not collect exact app selections, exact goal text, precise location history, raw NFC contents or exact step counts merely for analytics unless there is a separate justified and disclosed purpose.

G. Crash and performance reports

The app sends crash and performance reports that Apple’s MetricKit prepares on your iPhone: where in our code a crash or freeze happened, the app version and build, the iOS version, the iPhone model and whether it is a test build. They contain no account, device or advertising identifier, no name or email address, and nothing about your rules, apps, steps, location, NFC tags or messages. We do not keep your IP address with them. They are stored on our servers in the UK, used only to find and fix faults, and deleted after 90 days. You can turn them off in the app’s Settings. Child accounts do not send them.

4. Health / step data

NOT YET may access step-count information through Apple Health / HealthKit where you grant permission, used to determine whether a Steps challenge is complete or a wake routine using MOVE has been completed. Our intended architecture is for this processing to happen on-device wherever technically possible. We do not use HealthKit information for advertising. We do not sell HealthKit information.

4a. Health data and explicit consent

Step-count information obtained through Apple Health is data concerning health, which is special category data under Article 9 UK GDPR. We process it only on the basis of your explicit consent, given when you grant Health permission and choose a rule that needs it. You can withdraw that consent at any time in iOS Settings or by removing the rule; withdrawal stops future processing and does not affect processing already carried out. We never process health data for advertising, never sell it, and never use it for automated decisions about you. Where a rule can be completed without health data — and most can — you can use the app fully without ever granting Health access.

4b. Step data, and how it is used in our reports

We treat step data in two completely separate ways, and they ask for your permission separately.

1. Checking whether a rule is complete. Where you grant Health permission, we read your step count to answer one question — has the target you set been reached. The number itself is never sent to us or stored by us: all that leaves your device is a yes or no. Health data obtained this way is never included in any report, never sold, and never shared with anyone.

2. Being counted in our statistics, if you choose. Adults can separately choose to contribute completed daily step totals from one explicitly selected reporting iPhone per account. This permission starts off. Selecting an iPhone does not turn it on, and totals from multiple phones are not combined. The totals come from your iPhone’s motion sensor, not Apple Health. When reporting is enabled, we receive the daily total and its measurement period, linked to a pseudonymous account reference and the selected reporting source. We keep source-selection evidence to check permission and avoid counting the same day twice. These source records are not anonymous when collected; they are used to produce aggregate statistics.

We publish and sell reports built from those totals — city by city, nationally, and for organisations we work with. We say that plainly because you should know what you are agreeing to. Nobody buying a report can see anything about you individually: figures are only released where enough people are represented that no one can be worked out backwards, and children are never included at any threshold.

This is optional and refusing changes nothing about the app. You can turn it off at any time; doing so removes you from future statistics, though figures already published cannot be unpicked because they contain nothing about you.

What our reports say and do not say. They report activity — how many steps were taken, how many rules were completed, what proportion happened before 9am. They never claim a health outcome, because that would require evidence we do not have and we are not willing to imply one.

5. Location information

Location is sampled only at the moment you claim completion or verify — there is no background tracking, so no location history exists to leak, be requested or be subpoenaed. Where a verification outcome is retained, it is limited to the outcome, a venue identifier, approximate accuracy, a timestamp and the minimum anti-fraud evidence. NOT YET may use device location for features such as Touch Grass and Go. Our intended architecture is to evaluate these conditions on-device. We do not need to create a server-side history of everywhere you go for the core product to work. We do not sell precise location information.

6. NFC information

NOT YET may read compatible NFC tags where required for Tap or Wake Alarm functionality. Where technically practical, Tag registration and matching are handled locally. We do not need raw NFC contents for advertising or behavioural profiling.

7. First name, reason and custom goal

You may optionally provide a first name, reason and custom goal, used to personalise SASSY or BRUTAL messages. Our intended architecture keeps these values on-device by default. You can edit or remove them using available app controls.

8. Push notifications

If you enable push notifications: APNs push token, app version, timezone, locale, approved subscription or product state needed for a message, approved segment attributes where applicable. Highly personal morning context should preferably use on-device/local notification logic rather than requiring central collection. Apple controls system-level notification permission.

9. Wake Alarm data

Where the Wake Alarm feature is available, local information may include alarm time, repeat days, selected Proof of Awake, step target, selected Tag, snooze / re-arm state and local completion state. The intended architecture is to keep these values local wherever practical.

10. Why we use personal information

To provide the app and requested functionality; validate subscription entitlements; deliver push notifications; fulfil physical Tag orders; provide support; maintain security; diagnose technical failures; operate and improve the service; comply with legal obligations; prevent abuse or fraud.

10a. Automated decisions and AI features

We do not make decisions about you by solely automated means that have legal or similarly significant effects. Rule verification is automated but mechanical — it checks whether a condition you set was met. Where we later offer optional insights or recommendations based on your own history, they will be opt-in, available to adult accounts only, never applied to children’s accounts, and will never restrict your access to anything or change what you pay. You can turn them off at any time, and doing so does not reduce any other part of the app. We will update this policy before any such feature is released.

11. Lawful bases

Contract — where processing is necessary to provide paid services, verify entitlements, fulfil Tag orders or provide requested support. Legitimate interests — proportionate purposes such as service security, fraud prevention, error diagnosis and operational reliability, considering your rights and freedoms. Consent — where required, e.g. certain optional analytics, marketing or non-essential cookies. Legal obligation — where processing is necessary to comply with applicable law.

12. Who we may share information with

Service providers including Apple, hosting and infrastructure providers, our support tools or another support provider, email providers, fulfilment providers, shipping carriers, payment or checkout providers for physical goods, professional advisers, and regulators or authorities where legally required. We only provide information reasonably necessary for the relevant service. We do not sell personal information to advertisers.

12a. Aggregate insights and commercial reporting

We may produce and share aggregate, statistical information about how the app is used — for example how many people in a city completed a rule in a month. This is never individual-level data, is never sold as individual records, and cannot be used to identify you. Aggregate figures are only released where enough people are represented that no one can be identified by elimination. The minimum scales with the group being described — it is higher for a single building, a venue, an employer or a school than for a national figure, and higher again for anything we publish. Health data and children’s data are never included. We do not sell personal data, we do not share it with advertising networks, and we do not operate behavioural advertising. Where an aggregate figure is produced for a partner — a university, employer or accommodation operator — that partner receives counts and rates only, never names, contacts or individual activity.

13. International transfers

Your information is stored in the United Kingdom. Our production databases, backups and reporting systems are hosted in a UK data region, and we do not replicate personal data to regions outside the UK or European Economic Area.

Two kinds of access happen from outside the UK, and we treat them differently.

1. Our service providers. A small number of providers — for example Apple for payments and subscriptions, and our email delivery provider — may process limited information outside the UK as part of their own infrastructure. Where they do, transfers are made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. A current list of these providers is available on request.

2. Our development team. Part of our software development is carried out by an engineering team based in India. We have put specific arrangements in place because of that:

• They work on company-owned, centrally managed devices. Equipment is provided and enrolled in our device management, encrypted, and can be locked or erased remotely by us.
• They do not routinely access production personal data. Development and testing use synthetic or anonymised data. Where access to live systems is genuinely necessary — for example to investigate a fault affecting real users — it is time-limited, individually approved, logged, and limited to the specific records needed.
• Transfers are covered by the UK International Data Transfer Agreement and a data processing agreement, supported by a transfer risk assessment.
• Access ends when the work does. Accounts, repository permissions and device access are removed on offboarding.
• No personal data is stored locally on development machines, and no production data is copied into documents, tickets or code.

If you would like more detail about these arrangements, contact us using the details at the end of this policy.

14. Retention

We keep personal information only for as long as reasonably necessary, and no longer. These are the periods we work to:

Children’s accounts follow the shortest applicable period in every case, and a child’s history is deleted when their account ends at 18 unless they choose to carry it into an adult account. Information held only on your device is not covered by this table — it goes when you delete the app.

15. Security

We use appropriate technical and organisational measures designed to protect personal information, which may include least-privilege access, secure authentication, encryption in transit, restricted admin roles, audit logging, environment separation, secure secret management and restricted access to shipping and support data. No online service can guarantee absolute security.

16. Your rights

Depending on applicable law: access, correction, deletion, restriction, objection, portability, and withdrawal of consent where consent applies. Some rights are subject to legal exceptions. To exercise a privacy right, contact [email protected]. We may need to verify your identity.

17. On-device information

Some NOT YET information may exist only on your iPhone. If information has never been transmitted to us, we may not be technically able to access, export or delete it remotely. You can normally remove local information through the relevant app controls or by deleting the app, subject to Apple backup and device behaviour. We will not claim to hold data that exists only locally.

18. Children

NOT YET is intended for anyone who meets Apple's App Store minimum age requirements for their territory (13 or over in most regions, subject to the app's App Store age rating).

18a. Age and child accounts

The app is offered to adults. A child account can only be created by a parent or guardian through Apple Family Sharing, which is where the child’s age is established — we rely on Apple’s family relationship and the parent’s authorisation rather than collecting identity documents. We do not knowingly create accounts for children outside a family group. Child accounts are configured so that data collection is the minimum needed for the feature to work, are never used for marketing, are never included in any commercial or aggregate dataset, and are never used to train or improve recommendation features. A child’s account ends at 18, when they may open their own adult account. If you believe a child is using an adult account outside a family group, contact us and we will investigate and close it. Child accounts do not send crash reports.

19. Marketing

If you choose to receive marketing communications, you can unsubscribe using the method provided. Service communications relating to purchases, security, support or essential operation are not necessarily marketing.

20. Cookies

See the Cookie Notice. If the website uses only strictly necessary cookies or storage, we use them as needed to operate the site. If non-essential technologies are introduced, we will use an appropriate consent mechanism where required.

21. Complaints

If you are concerned about how we handle personal information, contact us first at [email protected]. Where UK data-protection law applies, you may also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

22. Changes to this Privacy Policy

We may update this Privacy Policy as NOT YET develops. We will update the effective date and provide additional notice where required by law.

23. Contact

Social Vortex Limited
55 Colmore Row, Birmingham, England, B3 2AA
Company number: 15233693
Privacy: [email protected]
Support: [email protected]