Privacy Policy

What we store

To make shared decisions work, ProsNCons' server keeps, in a database hosted by Cloudflare:

• Your random identity: an ID, the name, emoji and color the app made up for you, and a SHA-256 hash of its sign-in token. The token itself stays in your iCloud Keychain.
• What you create: decision titles, notes and colors, the pros and cons you write and who wrote them, and which decisions you're a member of.
• Invites: stored only as hashes of the invite code, along with who created and who used each one. Each link works once and expires after 7 days, and used and expired invites are deleted 7 days later.
• Your push token, if you allow notifications, for up to 5 of your devices. Tokens Apple reports as no longer valid are deleted.
• Notification bookkeeping: short-lived records of recent changes, used to write notification summaries and deleted after about an hour, and when you were last notified about each decision.
• A daily write counter, used to limit abuse.

Creating a new identity is rate-limited by IP address for about a minute, using Cloudflare's rate limiter. IP addresses are not stored in our database. Cloudflare, which runs the server, keeps request logs for a limited time as part of operating it.

Notifications

Notifications are opt-in. The app asks after you send your first invite or join a decision, never at launch. If you allow them, your device's push token is sent to Apple's push service with each notification. A notification shows the decision's title and a short summary, like "🦊 Zippy Fox added 2 pros".

What we don't collect

No name, email address, phone number, contacts or location. No analytics, advertising or tracking, and no third-party SDKs in the app.

We never sell your data or share it with anyone, except the service providers that run the app: Cloudflare, which hosts the server and database, and Apple, which delivers notifications.

Who can see what

• People in a decision see each other's random name, emoji and color, and everything written in that decision.
• Only someone you send an invite link to can join, and each link works for one person.
• Nobody else can see your decisions.

Deleting your data

In the app, tap your avatar, then Delete my data. That immediately removes:

• your identity
• your push tokens
• every decision you created, with everything in it, for everyone in it
• your membership in other people's decisions

Pros and cons you wrote in other people's decisions stay there, shown as coming from a former member, because the rest of the group may still be using them.

You can also leave a single decision, and its creator can remove you from it.

Children

ProsNCons is not directed at children under 13.

Changes

If this policy changes, we'll update this page and the date at the top.