FOLLOW LABS LIMITED (“Follow”, “we”, “our”, or “us”) operates the Follow website and mobile application (together, the “Service”).
This Privacy Policy explains what information we process, why we process it, who receives it, how long we keep it, and the choices available to you.
The data controller is:
FOLLOW LABS LIMITED
Registered in England and Wales
Company No. 17069541
Registered office: 27 Old Gloucester St, London, United Kingdom, WC1N 3AX
Email: [email protected]
The app creates an anonymous account with an internal user ID. You can use Follow without providing a name, email address, phone number, password, or public profile.
If you choose Sign in with Apple, we process the unique account identifier Apple provides for Follow. Apple may also provide your name and email address, including an Apple private relay address, depending on what you choose to share. We record whether the email is a private relay address and when the Apple account was connected.
We also process authentication and session records, including refresh-token hashes and account creation and activity times. Follow access and refresh tokens are stored on your device using the operating system’s secure storage. For Sign in with Apple, the Apple identity token and authorization code are sent to our server for verification. We securely store the resulting Apple refresh token only so that we can revoke Follow’s Apple authorization if you delete your account.
We process the information needed to provide the features you use, including:
This content is linked to your internal user ID. If you connect Sign in with Apple, that account is also linked to the Apple identifier and any name or email address Apple provides. Free-text fields may identify you or another person if you choose to include identifying details.
We process limited technical and preference data such as your time zone, language, locale, platform, major operating-system version, app version, notification permission state, enabled notification types, preferred notification delivery time, and relevant timestamps.
When you view, purchase, restore, or use Follow Premium, Apple processes the purchase and payment through the App Store. Follow does not receive your full payment-card details.
To provide and verify Premium access, we and our subscription-management provider, Qonversion, process information such as:
The Qonversion SDK and services may also process limited app and device information needed to operate the subscription service, verify purchases, prevent duplicate access, restore entitlements, and diagnose subscription problems. This may include app version, operating-system information, device or installation identifiers, country, locale, time zone, IP address, and the time the app was used.
When you are signed in, Follow identifies your subscription account to Qonversion using your internal Follow user ID so that Premium access can be restored and synchronised across supported devices.
If a purchase or restoration is interrupted, the app may temporarily store a pending billing operation and limited transaction evidence on your device so that it can safely complete the operation after the app restarts. This temporary record is removed after a conclusive result or when it becomes too old to resume.
Follow may use your internal user ID, app version, and language or locale to decide whether a service notice should be shown to you. We store whether a notice was shown, dismissed, or acted upon, the number of times it was shown, and related timestamps. We use this information to deliver relevant service communications, avoid repeatedly showing completed notices, and measure whether notices were successfully delivered.
If you enable notifications, we process an Expo push token, platform, enabled status, notification preferences, delivery time, and related timestamps. A scheduled notification may include a title derived from your goals or plans. Notification content and the token pass through Expo’s push service and the relevant platform service, such as Apple Push Notification service (APNs).
You can disable all notifications, disable an individual notification type, change its delivery time, or turn notifications off in your device settings. When all notifications are disabled in Follow, the token is marked inactive and is no longer used to send notifications.
If you send feedback in the app, we store your message, our reply, read status, timestamps, and internal user ID. We also save a snapshot of the app version, platform, major operating-system version, language, locale, and time zone associated with the message. We use this information to review and answer the message, troubleshoot relevant issues, and apply reasonable submission limits. A reply may trigger a push notification, but the notification contains only a generic notice and not the reply itself.
If you submit the website support form, Formspree receives and stores the name, email address, topic, message, and consent choice you provide. We can view the submission in our Formspree account. If you contact us directly through another available channel, we process the information you choose to send there.
When you use the website or app, our infrastructure and service providers may process IP address, request time, requested path, response status, browser or device information, and error or security records. Some application logs may contain AI prompts and generated outputs when needed to diagnose an operation.
The Follow website uses Cloudflare Web Analytics to collect aggregate page-view, browser, device, operating-system, country, referrer, and page-performance information. We use this information to understand website traffic and reliability, not to build advertising profiles or track visitors across unrelated websites.
Follow does not show third-party advertising or use personal information for cross-app advertising. We do not collect precise location data. We use the service providers described below, including Qonversion for subscription management and Cloudflare Web Analytics for aggregate website traffic and performance information.
| What we do | Why we do it | UK GDPR legal basis |
|---|---|---|
| Create and maintain your anonymous or Apple-linked account | Authenticate you, preserve your account across sign-ins, and keep your data linked to the correct account | Performance of our contract with you |
| Store goals and progress and build plans | Provide the features you ask us to provide | Performance of our contract with you |
| Send relevant content to AI providers | Generate requested plans, steps, summaries, and suggestions | Performance of our contract with you |
| Process settings and technical data | Adapt the Service to your device, language, time zone, and app version | Performance of our contract and our legitimate interest in operating a reliable Service |
| Administer Premium and subscriptions | Present subscription products, process and restore purchases, verify entitlements, synchronise subscription status, prevent duplicate or unauthorised access, and maintain reliable billing records | Performance of our contract with you, compliance with legal obligations, and our legitimate interests in operating and protecting the subscription service |
| Deliver and measure in-app notices | Show relevant service communications, prevent unnecessary repetition, and confirm whether a notice was delivered or acted upon | Performance of our contract and our legitimate interest in communicating changes and operating the Service |
| Measure website traffic and performance | Understand aggregate website usage, diagnose performance problems, and improve reliability | Our legitimate interest in maintaining and improving the website |
| Send push notifications | Deliver reminders you choose to receive | Your consent, which you can withdraw at any time |
| Keep security, error, and operational records | Protect accounts, prevent misuse, diagnose faults, and maintain the Service | Our legitimate interests in security and reliable operation |
| Process in-app feedback and support requests | Receive, review, and reply to your messages and resolve relevant problems | Your consent, steps at your request, and our legitimate interest in customer support |
| Meet legal duties and handle claims | Comply with law and protect legal rights | Legal obligation and legitimate interests |
Where we rely on legitimate interests, we consider whether the processing is necessary and whether your rights override those interests.
Follow uses the OpenAI API and Anthropic API. Depending on the feature, the information sent to a provider may include your goal, related plans, results, notes, previous context, pseudonymous record identifiers, and the instruction needed to generate a response. The provider returns generated content to Follow.
Follow does not intentionally include your Apple account identifier, name, or email address as fields in prompts sent to AI providers. However, goals, notes, and other free-text content may contain personal information if you choose to include it. Do not put identifying or sensitive information in free-text fields unless it is necessary for the feature you are using.
We use business API services. We do not enable model training with Service content. Under the providers’ standard API arrangements, inputs and outputs may normally be retained for up to 30 days for safety and abuse monitoring, subject to legal, security, and provider-specific exceptions.
AI output is a suggestion, not a decision about your legal rights or access to a service. Follow does not use AI to make decisions that produce legal or similarly significant effects about you.
We share information only as needed to operate the Service or meet legal duties. Recipients may include:
Service providers may use information only under our instructions and contracts, except where they act as an independent controller under applicable law.
We do not sell personal information. We do not share it for third-party advertising or marketing profiles.
Some providers may process information in the United Kingdom, European Economic Area, United States, or other countries. Where data protection law requires a transfer safeguard, we use an applicable adequacy decision or approved contractual safeguards, such as the UK International Data Transfer Agreement or Addendum and EU Standard Contractual Clauses. You may contact us for more information about the safeguard used for a particular transfer.
We may keep a record longer where the law requires it, a dispute is ongoing, or it is necessary to establish, exercise, or defend a legal claim.
You can:
Depending on where you live and the circumstances, you may also have the right to:
To exercise a right, email [email protected]. If your account is connected to Apple, we may use the Apple-provided account details we hold and ask you to verify the request. For an anonymous account, we may need your current account or session information to find the correct record. If we cannot safely identify the relevant account, we may be unable to provide or change its data. We will never ask for your Apple Account password.
You may complain to the UK Information Commissioner’s Office through the ICO website. If you live elsewhere, you may also have the right to contact your local data protection authority.
Follow is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has used the Service, contact us so we can investigate and delete the information where appropriate.
Follow is a general planning tool. It is not designed to store medical records, payment details, government identifiers, passwords, or other highly sensitive information. Please do not enter this information into goals, notes, or support messages.
We use reasonable technical and organisational measures designed to protect information, including encrypted network connections, restricted operational access, hashed Follow refresh-token records, server-side verification of Apple identity tokens, protected storage for the Apple credential used for revocation, and secure device storage for authentication tokens. No online service can guarantee absolute security.
We may update this policy when the Service, our providers, or legal requirements change. We will post the new version here and change the date above. If a change materially affects how we use your information, we will provide additional notice where reasonably possible or legally required.
For privacy questions or requests, email [email protected], use the support page, or write to:
FOLLOW LABS LIMITED
27 Old Gloucester St
London, United Kingdom
WC1N 3AX