Privacy Policy

Between is an iOS application created by Dzmitry Bosak. Between helps you think through personal situations and decisions by asking clarifying questions and generating AI-assisted reflections.

This Privacy Policy explains what information Between handles, how it is used, and what choices you have. Between does not currently use user accounts, authentication, advertising, or cloud synchronization for saved decision history.

If you do not agree with this Privacy Policy, please do not use Between.

Controller

For purposes of applicable data protection laws, the controller of personal information handled by Between is:

Dzmitry Bosak
Email: between.official.app@gmail.com

Between has not appointed a data protection officer. Between has not appointed an EU or UK representative at this time.

Information Between Handles

Between may handle the following categories of information:

• Situation descriptions. Text you enter about a decision or personal situation.
• Answers to clarifying questions. Answers you provide during guided decision flows.
• Optional personalization text. Text you add in Settings to personalize AI responses.
• AI-generated responses. Questions, analysis, possible directions, Magic responses, reasons, and reflection questions generated from your input.
• Saved decision history. Decisions you choose to save locally on your device, including the original situation and generated analysis.
• Installation identifier. A generated identifier stored in the iOS Keychain and used for backend usage limits, subscription coordination, and RevenueCat configuration.
• Usage-limit and subscription status. Request kind, usage counts, subscription access level, entitlement status, and related timestamps used to enforce free and paid access.
• Purchase and subscription information. Product identifiers, entitlement state, transaction status, renewal state, and related App Store or RevenueCat subscription information.
• Analytics events. Firebase Analytics may receive non-sensitive usage metadata such as feature interactions, flow type, input length bucket, question count, paywall placement, subscription status, notification permission status, app version, and device or OS information.
• Crash and diagnostic information. Firebase Crashlytics may receive crash reports, stack traces, technical error categories, app version/build, device model, operating system version, feature/screen/action metadata, and similar diagnostics.
• Notification settings. If you enable local notifications, Between stores notification preferences locally on your device.
• Feedback text if enabled. The current iOS implementation hides feedback behind a feature flag and uses a local stub that does not send feedback to the backend. If remote feedback is enabled in the future, this policy should be updated before release.

Between does not create user accounts, does not require login, does not show ads, and does not sell personal information.

Purposes and Legal Bases

Where GDPR, UK GDPR, or similar laws apply, Between processes personal information for the following purposes and legal bases:

• Providing AI-assisted reflection features. Situation descriptions, answers, optional personalization text, selected language, AI-generated responses, installation identifier, idempotency key, and request metadata are processed to provide the app's requested AI features. Legal basis: performance of a contract or steps requested by you before entering a contract.
• Saving local history and preferences. Saved decision history, personalization data, notification preferences, appearance settings, onboarding state, feature flags, and review prompt state are stored locally to provide app functionality you choose to use. Legal basis: performance of a contract and, where required for optional features, consent.
• Usage limits, rate limits, security, abuse prevention, and reliability. Installation identifiers, request kind, usage counts, usage status, timestamps, platform/app version headers, and operational metadata are processed to operate, secure, debug, and protect the service. Legal basis: legitimate interests in operating and protecting the app and backend, and performance of a contract.
• Subscriptions and purchases. Product identifiers, entitlement state, transaction status, renewal state, RevenueCat app user ID, webhook data, and related subscription records are processed to provide paid access and manage subscription status. Legal basis: performance of a contract and compliance with legal obligations relating to transactions where applicable.
• Analytics. Non-sensitive analytics events are processed to understand feature use and improve product quality. Legal basis: legitimate interests, or consent where required by applicable law or platform settings.
• Crash reporting and diagnostics. Crash reports, stack traces, sanitized error categories, device and OS information, app version/build, and feature/screen/action metadata are processed to detect and fix technical problems. Legal basis: legitimate interests in maintaining app stability and security.
• Legal compliance and rights protection. Records may be processed where necessary to comply with law, respond to lawful requests, enforce terms, prevent fraud or abuse, or protect rights and safety. Legal basis: legal obligation and legitimate interests.

You are not legally required to provide situation descriptions, answers, or personalization text, but AI-assisted features may not work without the information needed for the relevant request.

Local Storage

Between stores saved decision history and optional personalization data locally using SwiftData. Preferences such as notification settings, appearance or onboarding state, feature flags, and review prompt state may be stored with UserDefaults. The installation identifier is stored in the iOS Keychain.

Saved decision history is not uploaded merely because it is saved. However, situation text, answers, and personalization text used in AI features are sent to the backend as part of those AI requests.

Deleting local app data from Settings removes saved decision history and personalization data managed by the app. It does not delete the Keychain installation identifier, notification settings, third-party SDK records, backend records, AI provider records, Apple records, or RevenueCat records. Deleting the app may remove app container data according to iOS behavior; Keychain behavior is controlled by iOS and may differ from normal app data deletion.

Backend Processing

When you use AI-assisted features, Between sends information to the Between backend over the network.

For guided decisions, the backend may receive the situation text, selected language, optional personalization text, request kind, installation identifier header, and idempotency key. For analysis after clarifying questions, the backend may also receive your clarifying-question answers. For Magic mode, the backend may receive the situation text, selected language, optional personalization text, request kind, installation identifier header, and idempotency key.

For limits and subscription coordination, the backend receives the installation identifier and may receive platform and app version headers.

The backend enforces usage limits, rate limits, concurrent request limits, subscription access, and idempotency. It may store installation records, usage events, idempotency keys, request kind, usage status, timestamps, failed-event reasons, subscription status records, and successful AI response bodies. Successful AI response bodies are stored so duplicate completed requests can be replayed safely.

The backend does not intentionally store the raw user request body as a separate field, and it does not intentionally log full prompts, request bodies, answers, personalization text, or AI response bodies. Backend logs may include request identifiers, installation identifiers, request kind, access level, provider latency, prompt length, request type, rate-limit events, payload rejection events, and other operational metadata.

The backend currently does not provide an automated user-facing deletion, export, or retention endpoint. Backend data may remain in memory for the process lifetime and, when JSON persistence is configured, in the backend usage store until removed or changed outside the application. You may contact us to request manual review, export, or deletion of backend records associated with your installation identifier where technically feasible and legally required.

AI Provider Processing

When the backend is configured for real AI processing, it sends prompts to DeepSeek to generate questions and responses. Those prompts can include your situation text, clarifying-question answers, optional personalization text, output language, and backend prompt instructions.

The backend does not intentionally include installation identifiers, subscription records, platform headers, app version headers, idempotency keys, or client IP addresses in AI prompts.

Because your input may include sensitive personal details, do not enter information that you are not comfortable having processed by the backend and an external AI provider.

AI-generated responses are informational only. Between does not provide medical, psychological, psychiatric, therapeutic, legal, financial, emergency, crisis, or other professional advice. AI-generated outputs may be inaccurate, incomplete, misleading, or unsuitable for your circumstances. You remain responsible for your own decisions and actions.

Firebase Analytics

Between uses Firebase Analytics to understand app usage and improve product quality. Analytics events are intended to use non-sensitive metadata only, such as feature interactions, flow type, input length bucket, question count, error category, subscription status, paywall placement, notification permission status, app version, and device or operating system information.

Analytics events should not include situation text, clarifying-question answers, generated result text, feedback message bodies, personalization text, names, email addresses, personal identifiers, or sensitive personal details.

Between does not use Firebase Analytics for advertising or cross-app advertising tracking.

Firebase Crashlytics

Between uses Firebase Crashlytics for crash reporting and diagnostics. Crashlytics helps identify stability problems by collecting crash reports, stack traces, device model, operating system version, app version/build, crash time, sanitized error categories, feature/screen/action metadata, and other technical diagnostic information.

Crash and error reporting is intended not to include situation text, clarifying-question answers, generated result text, feedback message bodies, or personalization text. System-generated crash data may still include technical information about the device, operating system, app state, and diagnostic context.

RevenueCat and App Store Subscriptions

Between uses Apple's App Store subscription system and RevenueCat to manage purchases, subscription status, offerings, and restores. RevenueCat is configured with the app's generated installation identifier as the RevenueCat app user ID.

Apple processes payments through the App Store. Between does not process payments directly and does not receive your full payment card number, bank account details, or other full payment information. Apple and RevenueCat may process purchase-related information according to their own terms and privacy practices.

The backend can receive RevenueCat webhook events and may store subscription-related records, including app user ID, entitlement, active subscription flag, product ID, original transaction ID, expiration date, update timestamp, and raw RevenueCat webhook event JSON.

Notifications

Between may offer optional local notifications, such as reflection reminders. Local notifications are scheduled and managed on your device after you grant permission through iOS.

Notification content is intended to be generic and not include your situation text, answers, saved history, or generated analysis. You can disable notifications in the app, if controls are available, or in iOS Settings.

Data Sharing

Between shares or sends information only as needed to operate the app:

• Between backend receives AI request content, installation identifiers, usage-limit data, subscription coordination data, and operational metadata.
• DeepSeek receives prompt text when real AI processing is enabled.
• Firebase Analytics receives non-sensitive analytics events.
• Firebase Crashlytics receives crash and diagnostic information.
• RevenueCat receives subscription and purchase status information needed to manage premium access.
• Apple processes App Store purchases and subscriptions.

Between does not sell personal information and does not use your information for advertising.

Automated Processing

Between uses automated AI processing to generate reflection questions, analysis, possible directions, Magic responses, reasons, and related text from information you provide. Between does not use this processing to make legally binding decisions about you, determine your legal rights, approve or deny benefits, set prices for you individually, or make decisions that are intended to produce legal or similarly significant effects about you. The output is provided to you as reflection content only, and you remain responsible for deciding whether, when, or how to act.

Security

Between uses reasonable technical measures designed to protect information handled by the app, including iOS platform storage, Keychain for the installation identifier, SwiftData and UserDefaults for local app data, and HTTPS backend requests in production.

No method of transmission or storage is completely secure. You are responsible for protecting access to your device with available security features such as a passcode, Face ID, or Touch ID.

Data Retention and Deletion

Saved decision history and personalization data remain on your device until you delete them in the app, delete the app, or remove app data through iOS behavior.

Backend usage, idempotency, AI response, and subscription records may be retained as described in the Backend Processing section. Because the current backend has no automated retention job, deletion endpoint, or export endpoint, records in configured backend persistence may remain until they are manually removed, overwritten by operational changes, or deleted according to future retention tooling. We intend to keep backend records only as long as reasonably necessary for usage limits, subscription coordination, reliability, abuse prevention, legal compliance, and dispute handling.

If you make a privacy request, we will use reasonable efforts to locate records associated with the identifiers you provide, such as the installation identifier, and respond as required by applicable law. We may be unable to identify or delete some records if we cannot reasonably verify the relevant installation or if the records are controlled by third-party providers.

Firebase Analytics, Firebase Crashlytics, RevenueCat, Apple, and DeepSeek may retain information according to their own settings, terms, and privacy practices.

You can manage subscriptions through your Apple ID subscription settings. You can manage notification permissions in iOS Settings.

Your Rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or objection regarding certain personal information. You may also have the right to withdraw consent where processing is based on consent, without affecting processing that occurred before withdrawal.

Because Between does not use accounts and much of your app data is stored locally, many controls are available directly on your device. To make a privacy request, contact us using the information below. We may need enough information to understand and respond to your request.

If GDPR, UK GDPR, or similar law applies, you may also have the right to lodge a complaint with your local data protection supervisory authority.

Children's Privacy

Between is not intended for children under 13 years old, or the minimum age required by applicable law in your jurisdiction. In the European Economic Area, United Kingdom, or other regions with higher consent ages for online services, Between is not intended for children below the applicable digital-consent age unless valid parental or guardian consent is provided where legally permitted. We do not knowingly collect personal information from children. If you believe a child has provided personal information through Between, please contact us.

International Processing

Between, its backend, AI provider, and third-party services may process information in countries other than where you live. Those countries may have data protection laws different from your jurisdiction.

Where required by applicable law, international transfers are intended to rely on appropriate safeguards, such as adequacy decisions, standard contractual clauses, provider data processing terms, or another lawful transfer mechanism. Third-party providers may maintain their own transfer mechanisms and privacy terms.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make changes, we will update the "Last updated" date above. Continued use of Between after a revised Privacy Policy becomes available means you accept the updated policy.

Contact

If you have questions about this Privacy Policy or Between's privacy practices, contact:

Dzmitry Bosak
Email: between.official.app@gmail.com