Heapforge Journal Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains how Heapforge Ltd. (“Heapforge”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you use Heapforge Journal (the “app”) on Android, iOS or the web, or when you otherwise contact us about it. It also explains the rights you have and how to exercise them.

The Heapforge Reader app is covered by a separate privacy policy, and the heapforge.com website by another.

1. Who we are

The data controller responsible for your personal data is:

• Heapforge Ltd., registered in England and Wales
• Company number: 17418393
• Registered office: 82A James Carter Road, Mildenhall, Bury St. Edmunds, Suffolk, England, IP28 7DE, United Kingdom

Privacy contact: privacy@heapforge.com

2. Scope

This policy applies to personal data processed through the app, as well as when you communicate with us. It does not apply to third-party websites or services that we link to, which have their own privacy policies.

The app uses services provided by Google and Apple for purchase verification only. Those companies process the data involved under their own terms and privacy policies, as described in section 5.1.

3. Personal data we collect

We try to collect only what we need. We do not operate any servers for the app, so the app sends nothing to Heapforge. Depending on how you interact with us, we may process:

• Contact information - such as your name and email address, when you email us or otherwise get in touch.
• Communications - the content of messages you send us, including any attachments, and our replies.
• Transaction information - purchases are handled entirely by the store you buy from. We receive only aggregated, non-identifying sales reports (see section 5.1.3), and we do not directly collect or store payment card details.
• Any other information you choose to provide to us.

The app does not send technical or usage information to us.

We do not intentionally collect special category data (such as health, religious or biometric data). Please do not send us such information unless we have specifically asked for it.

3.1 What stays on your device

A journal is about as personal as data gets, and the app is designed so that we never come near it. Everything below is stored locally, in the app’s own private storage on your device. It is never sent to Heapforge or to any third party:

• your entries and their full contents, including drafts and anything you have deleted but not yet purged;
• photographs, audio and any other files you attach to an entry;
• the metadata around your entries: dates, titles, tags, moods, prompts, streaks and word counts;
• reminders and notification schedules you set;
• your appearance and writing preferences, such as theme, typeface and editor settings;
• search history within the app, and any local index or cache the app builds to find your entries quickly;
• any passcode or biometric lock you set on the app, which is checked on your device and never sent anywhere.

This data is removed when you delete the app, or when you clear its data through your device’s settings. If you export or back up your journal yourself, that copy goes wherever you send it, and is then in your hands rather than ours.

Device backups. If you have turned on your operating system’s backup service, such as Android Auto Backup, Google One or iCloud Backup, your device may include the app’s local data in that backup. That copy is made by your device and governed by Google’s or Apple’s privacy policy, not by ours. Heapforge has no access to it. You can turn this off in your device settings.

3.2 The web version

The web version of the app runs entirely in your browser. Your entries are held in your browser’s own local storage on the device you are using; they are not uploaded to us, and we have no way to read them. Clearing your browser’s site data for the app deletes them, and they do not follow you to another browser or device.

Loading the web version is a visit to our website, which is covered by the heapforge.com privacy policy. That concerns delivering the page to you, never the contents of your journal.

4. How we use personal data and our lawful bases

Under the UK and EU GDPR, we must have a lawful basis for each use of your personal data.

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You can contact us for more information about this balancing.

We do not sell your personal data.

5. Third-party service providers

We use a small number of trusted service providers to run our business. They are listed below.

5.1 Google and Apple (purchase verification only)

Heapforge Journal is a paid app. To confirm that your copy was legitimately purchased, and so to protect the app against unauthorised copying and distribution, the app checks your entitlement with the store you installed it from. This is the only thing the app uses Google and Apple services for.

Google and Apple are not our processors for this. Each processes the data involved as an independent controller, under its own terms and privacy policy, in connection with the account you hold with it. The check happens directly between your device and the store; nothing passes through Heapforge, and nothing from your journal is involved.

5.1.1 Google Play

If you use the app on Android, it uses Google Play Services and the Google Play Billing Library provided by Google to confirm that your Google account is entitled to the app. In carrying out that check, Google processes data such as your Google account identifier, the purchase token for your order, and information about your device and the installed app.

For more information, see the Google Privacy Policy (https://policies.google.com/privacy) and the Google Play Terms of Service (https://play.google.com/intl/en/about/play-terms/).

5.1.2 Apple App Store

If you use the app on an Apple device, it uses StoreKit and App Store receipt validation provided by Apple to confirm that your Apple Account is entitled to the app. Apple processes the associated purchase and device information.

For more information, see the Apple Privacy Policy (https://www.apple.com/legal/privacy/).

5.1.3 What we can see

We do not collect any identifiable personal data from Google or Apple. We receive only the aggregated, non-identifying sales reports that every developer sees in the Google Play Console and App Store Connect, such as unit counts, revenue, refunds, and broad country and device breakdowns. We do not receive, and cannot request, the identity of an individual purchaser.

5.2 Google Workspace

We use Google Workspace, provided by Google, as our email provider. When you email us, for example for support with the app, your message - including your name, email address, message content, attachments and related metadata - is received, stored and processed on Google’s systems. Google processes this data on our behalf under its business data processing terms and does not use Workspace customer data for advertising.

For more information, see Google’s Privacy Policy (https://policies.google.com/privacy) and Google Cloud Privacy Notice (https://cloud.google.com/terms/cloud-privacy-notice).

5.3 Other recipients

We may also share some personal data with:

• professional advisers such as accountants, lawyers and insurers, where necessary;
• law enforcement, regulators, courts or other authorities, where required by law or to protect our rights, users or the public;
• a buyer, successor or investor in connection with a merger, acquisition, restructuring or sale of all or part of our business, subject to appropriate confidentiality protections.

6. What the app does not do

The app contains:

• no analytics or usage telemetry sent to us or to any third-party service;
• no crash or diagnostic reporting sent to us or to any third-party service;
• no advertising, ad SDKs or advertising identifiers, and no tracking across other apps or websites;
• no Heapforge accounts, sign-in or cloud sync, and no Heapforge servers;
• no scanning, indexing, reading or “AI” processing of your entries anywhere but on your own device;
• no sale or sharing of personal data by Heapforge.

7. Permissions

The app asks for a permission only when a feature you have used needs it, and only for that feature:

• Files and storage - to attach files you choose to an entry, and to save exports and backups where you ask for them.
• Camera and microphone - only if you attach a photo or a voice note from within the app; nothing is captured in the background.
• Notifications - only if you set a writing reminder; reminders are scheduled on your device, not sent from a server.
• Biometrics - only if you turn on the app lock; the check is performed by your operating system and tells the app nothing more than whether it succeeded.

Everything these permissions produce stays on your device. The app does not scan your storage for unrelated content and does not upload anything you open or create.

Network access is used only for the purchase verification described in section 5.1.

8. Store privacy disclosures

This policy is the privacy policy referenced by the app’s store listings. Our Google Play Data safety declaration and Apple App Store privacy labels state that the app collects and shares no data, other than the purchase processing that Google and Apple themselves perform in order to sell and license the app.

9. Cookies and similar technologies

The app does not use cookies or similar tracking technologies. The web version stores your journal in your browser’s local storage, as described in section 3.2; this is needed for the app to work and is never sent to us.

10. International data transfers

We are based in the United Kingdom, and some of our service providers process data in other countries, including the United States.

Where personal data is transferred outside the UK or the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• transfers to countries recognised as providing an adequate level of protection (adequacy regulations/decisions);
• transfers to organisations certified under the EU-U.S. Data Privacy Framework and its UK Extension (the “UK-US data bridge”);
• Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum or UK International Data Transfer Agreement, where applicable.

Google and Apple may also transfer data internationally when verifying purchases. They do so under the safeguards described in their own privacy policies.

You can contact us for more information about the safeguards we use.

11. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this policy, including to meet legal, accounting or reporting requirements. As a general guide:

• Email correspondence - kept for 24 months after our last contact, unless it relates to an ongoing matter or we need to keep it longer for legal reasons.
• Business and transaction records - kept for as long as required by law (in the UK, typically up to six years after the end of the relevant financial year).
• Data on your device - kept until you delete it, clear the app’s data or uninstall the app. In the web version, kept until you clear the app’s site data in your browser.
• Purchase records held by Google or Apple - kept under their own policies. Heapforge does not hold a copy.

When data is no longer needed, we delete or anonymise it securely.

12. How we protect personal data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These include encryption in transit, access controls and choosing reputable providers with strong security practices. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the relevant authorities as required by law.

13. Your rights (UK, EU, EEA and Switzerland)

If you are in the UK, EU, EEA or Switzerland, you have the following rights, subject to certain conditions and exceptions:

• Access - to request a copy of the personal data we hold about you.
• Rectification - to ask us to correct inaccurate or incomplete data.
• Erasure - to ask us to delete your data in certain circumstances.
• Restriction - to ask us to limit how we use your data in certain circumstances.
• Data portability - to receive data you provided to us in a structured, commonly used format, or have it transferred to another organisation.
• Objection - to object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Withdraw consent - where we rely on consent, you may withdraw it at any time without affecting earlier processing.
• Not to be subject to solely automated decisions with legal or similarly significant effects.

To exercise any of these rights, email us at privacy@heapforge.com. We will respond within one month, which may be extended by up to two further months for complex requests. We may need to verify your identity before responding. Exercising your rights is usually free of charge.

Because the app sends nothing to Heapforge, a request about your use of the app will usually show that we hold no data about you, other than any emails you have sent us. We will confirm this in writing so you have a record of it.

13.1 Data on your device and data held by Google and Apple

• Data on your device - you are in control. Delete individual entries in the app, export your journal at any time, or clear the app’s data or uninstall it through your device settings. In the web version, clear the app’s site data in your browser.
• Google Play - purchase data is controlled by Google. Use Google’s privacy tools (https://myaccount.google.com/privacy) to exercise your rights over it.
• Apple App Store - purchase data is controlled by Apple. Use Apple’s Data and Privacy portal (https://privacy.apple.com/) to exercise your rights over it.

You are still welcome to contact us, and we will help where we can.

14. Other countries

If you live in another country with privacy laws that give you rights over your personal data, please contact us and we will respond in accordance with the law that applies to you.

15. Children’s privacy

The app and our services are not directed at children under the minimal age for data processing consent, and we do not knowingly collect personal data from them. As the app sends nothing to us, a child using it discloses nothing to us. If you believe a child has provided us with personal data, for example by email, please contact us and we will delete it.

16. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not profile you.

17. Links to other websites

The app and our website may contain links to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

18. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it was last revised. If we make significant changes, we will take reasonable steps to let you know, for example by a notice on our website or in the app’s release notes.

19. Contact us and complaints

If you have any questions about this policy or how we handle your personal data, please contact us:

1. E-mail: privacy@heapforge.com
2. Post: Heapforge Ltd., 82A James Carter Road, Mildenhall, Bury St. Edmunds, Suffolk, England, IP28 7DE, United Kingdom

We would appreciate the chance to address your concerns first, but you have the right to complain to a data protection authority:

• United Kingdom: Information Commissioner’s Office (ICO) - https://ico.org.uk/make-a-complaint/
• EU/EEA: the supervisory authority in the country where you live, work or where the alleged infringement took place - a list is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en
• Other regions: your local data protection or privacy regulator.

Complaints about Google’s or Apple’s own processing should be directed to them, though you may also complain to your supervisory authority about it.