Privacy Policy

1. Who this policy is for

This policy covers the Journeyward app - the Android app and the web/browser version. It explains what happens to the information you enter.

2. The most important thing: your information stays on your device unless you choose to move it

Journeyward works without an internet connection. Everything you enter - names, notes, diary entries, contacts, documents, reminders - is stored on the device you are using, and goes nowhere else unless you choose to make a copy:

• On the web/browser version, in that browser's private local storage on your computer or phone.
• On the Android app, in an encrypted store on the phone or tablet, unlocked by your device's own screen lock.

There is no Journeyward account, no Journeyward server for your records, and no copy held by us anywhere. The Android app has no permission to use the internet at all. The web/browser version is downloaded from our host like any website, but the app does not send your family records back to us.

3. What information the app holds (on your device only)

So you can see exactly what is involved, the app can hold:

• People's names and family/household details.
• Contact details you choose to type (phone numbers, emails, addresses).
• A child's health, education and special educational needs and disability (SEND) information, and your own notes and concerns.
• Diary entries, events, threads, reminders and to-dos.
• Documents you attach and their details (on the web version; the Android app holds document details but not the file contents yet).
• A private history of changes you make, kept on the device so nothing is silently lost.

Every item above is held on your device only. None of it is sent to us or to any other company by Journeyward.

4. We do not collect, receive, or have access to your family records

• Journeyward does not collect your family records. "Collect" means sending your records off your device to a company - Journeyward does none of that.
• We operate no analytics, advertising, or crash-reporting that carries your content.
• We cannot read your records. There is no path by which Journeyward, us, or any third party can see the information you enter. This is true in the app's code, not just a promise.
• When you load the web/browser version, our web host may receive ordinary website request information, such as your IP address and the page or file requested. That is used to serve the app and does not include your family records.
• If you email us, we receive your email address and whatever you choose to write. Please do not send your child's personal details, health information, case notes, or a backup file unless we specifically ask for something and you choose to send it.

5. No Journeyward account, no tracking, no ads

• No Journeyward account or sign-in. You do not create an account with us or give us an email to use the app.
• No advertising and no advertising ID use.
• No analytics or tracking of any kind. Journeyward does not measure what you do in the app.

6. How your information is protected

• Android: encrypted at rest. On Android, your records are stored in an encrypted database (SQLCipher / AES). The key that unlocks it is held securely by the Android system and released only when you unlock with your device's screen lock (PIN, pattern, password, or fingerprint/face if you turn that on). Where your device supports hardware-backed key storage, it is used.
• App lock. The Android app can re-lock itself after you leave it or after a short idle period, and it hides your records from the app-switcher preview.
• Web/browser version. On the web version, your information's safety relies on your own device's security - your computer or phone login and disk encryption - because it is stored in that browser on that device.

7. Backups and exports - the main way family records leave your device, and you control it

The main situation in which your family records can leave your device is when you deliberately create a backup or export:

• You choose to make a backup. You can also set up automatic backups yourself, choosing the folder they go to; Journeyward then writes them there for you. Journeyward never begins backing up without that setup, and it keeps no copy of its own.
• The default backup is encrypted with a passphrase you choose before it leaves the app, so the file is unreadable without that passphrase.
• You choose where it goes - your own cloud drive, a USB stick, or an email to yourself. From that point the file is in a place you picked and under your control; we are not involved and have no access to it.

We never store your passphrase and cannot recover it. If you lose it, the backup cannot be opened - by anyone, including us.

8. Other times you might choose to share something

A few features hand information to another app only when you tap to do so:

• Tapping a phone number or email address opens your phone's dialler or mail app - Journeyward just passes the number or address across; it does not send anything itself.
• A "copy" action puts text on your device's clipboard so you can paste it into your own email or document.
• On Android, a "share" action hands a file you chose to the app you pick.
• If you email us, you choose what to put in that email.

In each case it is your deliberate choice, and what happens next is governed by the app you hand it to, not by Journeyward.

9. Children's information

Journeyward is designed for parents and carers to keep their own family's records, which may include a child's health and SEND information. This is sensitive information. Journeyward does not collect it or share it with us. On Android it is stored in an encrypted store; on the web/browser version it is stored in that browser on your device; backups are encrypted when you make them with a passphrase. Journeyward is intended for use by adults (parents and carers), not by children.

10. Your control over your information

Because your family records are on your device and there is no Journeyward account, you are always in control of those records:

• You can remove records from the app at any time. Removing an individual record removes it from your current case file, but its text may remain in the app's change history and in backups you have already saved.
• Uninstalling the Android app removes its encrypted store from the device.
• There is nothing to "request" from us about your family records, because we hold none of them - deletion is entirely in your hands, on your device.

For any email you send us, contact us at the address below if you want it deleted.

11. Who is responsible

Journeyward is provided by Christopher Winfield, trading as "Journeyward", based in England. Your family's records are yours, kept on your own device under your own control: the app does not send them to us, and nothing is taken from your device automatically. The one way any of them can reach us is if you deliberately send them - for example in an email, which section 4 asks you not to do. We are the data controller only for the limited information that does reach us, such as web-host request information and emails you choose to send.

You are the data controller for the records you keep in Journeyward. In data protection law that means the decisions about them are yours - what to record, keep, correct, delete or share. We make none of them and, apart from the one route above, never receive those records.

Why we are allowed to handle the little that reaches us. Data protection law asks anyone who handles personal information to say why they are allowed to. For your family's records that question does not arise for us. They stay on your device, we cannot read them, and we make no decisions about what you keep or why - so our position is that you are responsible for the information you keep in Journeyward, and we are not. The one way those records could reach us is if you deliberately send them to us, and section 4 asks you not to.

For the small amount that does reach us - the ordinary website request information our web host records when your browser downloads the web version, and any email you choose to send us - our reason is our legitimate interest in keeping Journeyward running and being contactable. There is no sign-up with us and no Journeyward account, so we hold no registration details about you. If you have sent us an email you would rather we did not keep, section 10 explains how to ask us to delete it.

Information about a child's health, education or needs carries stricter rules again, and those rules apply to whoever handles that information. Journeyward does not send it to us and we keep no copy of it. That is why section 4 asks you not to put it in an email: an email reaches us like any other one.

We are registered with the Information Commissioner's Office (ICO), the UK data protection regulator, under reference ZC194487. If you have a question about this, contact us at the address below.

12. Permissions the Android app asks for

• Fingerprint / face unlock (biometric): so you can unlock the app with your device's fingerprint or face if you choose. Matching is done entirely by Android; no biometric information is collected, stored by us, or sent anywhere.
• The app does not request internet access. It has no internet permission.

13. Changes to this policy

If we change this policy, we will change the effective date at the top. Any change that would let family records leave your device in a new way would be explained here first.

14. Contact

If you have any questions about this policy or about privacy in Journeyward, contact: help@journeyward.com