The short version
- Right now we only collect your name and email when you sign up as an early tester.
- When the JTOY wearable and app launch, tap and “moments in sync” analytics will only happen if you explicitly opt in. You can switch it off at any time.
- We never sell your personal data.
- You can ask to see, correct, download or delete your data whenever you like.
1. Who we are
JTOY (“Just Thinking Of You”, “we”, “us”) makes wearables that let you send a gentle pulse to someone you’re thinking of. This policy explains how we handle personal data on jtoy.app and, in future, in the JTOY wearables and app.
The data controller is Eoin McDonagh, trading as JTOY TODO: confirm legal entity name, company number and registered address.
Contact: hello@jtoy.app TODO: confirm mailbox is live; add postal address
We are not currently required to appoint a Data Protection Officer. TODO: confirm, and confirm whether an EU or UK representative is needed depending on where JTOY is established
2. What we collect
Now: early tester sign-up
- Name and email address you enter in the sign-up form.
- Your consent to be emailed about early testing, with the date and time you gave it.
- Basic technical data the form provider or host logs automatically, such as IP address and timestamp, mainly to prevent spam and abuse.
Later: when you use a JTOY wearable and app
- Account data: name, email, and login details.
- Pairing data: which JTOY devices and accounts you’ve connected with, and when.
- Tap events: that a tap was sent or received, between which paired devices, and when (timestamps). We don’t need message content, audio or precise location to deliver a pulse.
- Device and app data: device identifiers, firmware and app versions, battery and connection status, and crash or error logs.
- Moments-in-sync insights (opt-in only): derived information about when you and a paired person tapped at around the same time, for example how often taps overlap within a short time window.
We will update this policy before the product launches and tell testers about any changes. TODO: finalise once the app’s data flows are designed
3. Tap and sync analytics: explicit opt-in
Sending and receiving a pulse is the core service, so we process tap events to make that work. Analysing tap patterns and “moments in sync” beyond what is needed to deliver a pulse, for example to study how people think of each other at the same time, happens only if you give separate, explicit opt-in consent in the app.
- The setting is off by default and is never a condition of using JTOY.
- Both people in a pair must opt in before their shared sync moments are analysed.
- You can withdraw consent at any time in the app or by emailing us. We will stop the analysis and delete or anonymise the related data. TODO: confirm approach
- Where we publish research or insights, we will only use aggregated or anonymised data that can’t identify you.
4. Why we use your data, and our lawful bases
| Purpose | Data | Lawful basis (UK/EU GDPR Art. 6) |
|---|---|---|
| Managing the early tester list and emailing you about testing | Name, email, consent record | Consent (Art. 6(1)(a)) |
| Providing JTOY: pairing devices and delivering pulses | Account, pairing, tap events, device data | Contract (Art. 6(1)(b)) |
| Keeping the service secure, fixing bugs and preventing abuse | Device/app data, logs, technical data | Legitimate interests (Art. 6(1)(f)) |
| Tap pattern and moments-in-sync analytics and research | Tap events, timestamps, sync insights | Explicit opt-in consent (Art. 6(1)(a)) |
| Meeting legal obligations, such as record-keeping and responding to authorities | As required | Legal obligation (Art. 6(1)(c)) |
We do not intend to collect special category data, such as health data. TODO: lawyer to confirm whether any planned analytics could be treated as special category data and whether a DPIA is required
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. We don’t sell your data
We do not sell or rent your personal data, and we don’t share it with advertisers. We only share it with the service providers listed below, who work on our behalf, or where the law requires it.
6. Who we share data with
We use trusted service providers (processors) who may only use your data to provide their service to us, under written data processing agreements.
- Form provider for the tester sign-up TODO: e.g. Formspree or Netlify Forms
- Website hosting TODO: e.g. Cloudflare Pages, Netlify or GitHub Pages
- Email provider for tester updates TODO: name provider
- Cloud infrastructure for the future app and database TODO: name provider and region, ideally EU/UK
- Hardware and app development partners, only where they need access to test or support the service TODO: list if applicable
We may also disclose data if required by law, or as part of a sale or restructuring of JTOY, in which case we will tell you in advance.
7. How long we keep your data
- Tester sign-ups: until early testing ends or you unsubscribe, then deleted within 30 days. TODO: confirm period
- Account and pairing data: for as long as your account is active, then deleted within 90 days of closure. TODO: confirm
- Tap events: kept only as long as needed to deliver pulses and show your history in the app. TODO: set a specific period
- Sync analytics: until you withdraw consent, after which they are deleted or irreversibly anonymised.
- Security logs: kept for a short period. TODO: set period
8. International transfers
We aim to store data in the UK or the European Economic Area. Some service providers may process data in other countries, such as the United States. When that happens, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or an adequacy decision (including the EU–US and UK–US Data Privacy Framework where the provider is certified). You can ask us for a copy of the relevant safeguards. TODO: confirm per provider
9. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest where available, access controls limited to people who need them, and pseudonymised identifiers for tap data. No system is perfectly secure, but if a breach affects your rights we will notify you and the relevant regulator as the law requires.
10. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- Access the personal data we hold about you and get a copy.
- Rectification: have inaccurate data corrected.
- Erasure: ask us to delete your data.
- Restriction: ask us to limit how we use your data.
- Portability: receive your data in a machine-readable format, or have it sent to another provider.
- Objection: object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time, without affecting processing that happened before you withdrew.
To use any of these rights, email hello@jtoy.app. We’ll respond within one month and may need to verify your identity first. Exercising your rights is free in most cases.
11. Complaints
If you’re unhappy with how we’ve handled your data, please contact us first so we can try to put it right. You also have the right to complain to a supervisory authority:
- UK: Information Commissioner’s Office (ICO), ico.org.uk
- Ireland: Data Protection Commission (DPC), dataprotection.ie
- Or the data protection authority in the EU country where you live or work.
12. Children
JTOY is not intended for children under 16. We don’t knowingly collect personal data from anyone under 16 without verifiable consent from a parent or guardian. If you think a child has given us their data, contact us and we’ll delete it. TODO: confirm age threshold. The digital age of consent is 13 in the UK and 16 in Ireland; consider a family/parent-child use case
14. Changes to this policy
We may update this policy as JTOY develops, especially before the wearable and app launch. We’ll post the new version here with a new effective date and, for significant changes, let you know by email.
15. Contact us
Questions or requests about your data: hello@jtoy.app
Eoin McDonagh, JTOY TODO: postal address