Privacy Policy

The privacy of your data (and it is your data, not ours) is a big deal to us. In this policy, we lay out what data we collect and why, how your data is handled, and your rights with respect to your data. We never sell your data.

This policy applies to Untilt, the iOS and Android apps and related services operated by Delaney Labs LLC ("we", "us"). It covers information about everyone who uses the app or visits our website.

What we collect and why

Our guiding principle is to collect only what we need. Here's what that means in practice:

Identity and access

When you sign up for Untilt, you sign in with Apple or Google. We receive and store your name and email address from that sign-in (with Sign in with Apple, you can choose to hide your real email address, and we only receive the private relay address). We use this to create and secure your account and to contact you about essential service matters. We'll never sell your personal information to third parties, and we won't use your name in marketing statements without your permission.

Content you upload

Untilt works by letting you upload a screen recording of an article you scrolled through. We store your uploads and the content derived from them, meaning the readable article text and summaries you see in your library, on our servers (Amazon Web Services, in the United States). To produce your summaries and reading aids, your content is processed by Anthropic, our AI provider. Under Anthropic's commercial API terms, content sent to them is not used to train their models and is deleted from their systems within 30 days.

Your uploaded recordings and the text and summaries derived from them are private to your account. They are never visible to other users. We may access and review your content to operate, maintain, troubleshoot, and improve the service. We do not share your content with anyone beyond the subprocessors listed below, and we never use it for advertising.

Retention: everything associated with your account, both your uploads and the content derived from them, is kept for as long as your account is active, so your library keeps working. We may delete raw uploaded videos earlier once they are no longer needed to provide the service. When you delete your account, all of it is deleted as described under "Account deletion" below.

Push notifications

If you allow push notifications, we store the device token Apple or Google assigns to your device (an APNs token on iOS, a Firebase Cloud Messaging token on Android) so we can send you notifications, such as when an upload finishes processing. Declining notifications doesn't stop the app from working. You can turn notifications off at any time in your phone's Settings, and we delete your device tokens when you delete your account.

Product usage analytics

We use Amplitude to understand how the app is used in aggregate (for example, which screens are used and where people get stuck) so we can improve the product. These analytics are tied to a random, app-generated identifier, not to your name or email address. We do not send the contents of your uploads or your library to Amplitude.

Crash reports

If the app crashes or hits an error, a crash report is sent to Sentry, our error-monitoring provider. Crash reports include technical information about your device and app state (such as device model, OS version, and the sequence of screens that led to the crash) so we can find and fix bugs. Crash reports are not tied to your account or identity.

Voluntary correspondence

When you email us with a question or to ask for help, we keep that correspondence, including your email address, so we have a history to reference if you reach out again.

When we access or disclose your information

To provide the service you've asked for. We use third-party subprocessors to run Untilt:

To operate and improve the service. We may access your content to help you with a support request, to fix errors that stop automated processing, and to understand how the service is used so we can improve it.

Aggregated and de-identified data. We may aggregate and/or de-identify information collected through the service and use it for any purpose, such as understanding overall usage trends.

When required under applicable law. We are a U.S. operation and all data infrastructure is located in the U.S. We do not respond to government requests for user data unless we are compelled by legal process. It is our policy to notify affected users before we disclose data unless we are legally prohibited from doing so.

Finally, if Untilt is ever acquired by or merges with another company, we'll notify you before any of your personal information is transferred or becomes subject to a different privacy policy.

Your rights with respect to your information

We strive to apply the same data rights to everyone, regardless of location. These include:

• Right to know what personal information is collected, used, or shared. This policy is that disclosure.
• Right of access to the personal information we hold about you.
• Right to correction of your personal information.
• Right to erasure. You can delete your account and all associated data yourself, directly in the app; see "Account deletion" below.
• Right to portability. You can request a copy of the personal information we have about you.
• Right to object or restrict processing in certain situations, and the right to complain to your local supervisory authority (for example, your data protection authority if you are in the EU or UK).
• Right to non-discrimination. Exercising these rights will never cost you anything or degrade your service.

To exercise any of these rights, contact us at hello@getuntilt.com. We may need to verify your identity before responding, which for this service means verifying control of the email address on your account.

Account deletion

You can delete your account at any time from the Account screen in the app. No email required, no questions asked. When you delete your account, your uploads, your library content, your account record, and your push tokens are deleted from our active systems immediately. Residual copies may persist in encrypted backups and versioned storage for up to 35 days, after which they are permanently purged. We cannot recover this information once it has been deleted.

How we secure your data

All data is encrypted via SSL/TLS when transmitted between your device and our servers. Data at rest, including your uploaded videos and account data, is stored encrypted on AWS infrastructure. Access to production systems is restricted to the people who operate the service.

Location of site and data

Our service is operated in the United States. If you are located in the European Union, UK, or elsewhere outside of the United States, please be aware that any information you provide to us will be transferred to and stored in the United States. By using Untilt and/or providing us with your personal information, you consent to this transfer.

Changes and questions

We may update this policy as needed to comply with relevant regulations and reflect new practices. Whenever we make a significant change, we will refresh the date at the top of this page and take appropriate steps to notify users.

Have any questions, comments, or concerns about this privacy policy, your data, or your rights? Get in touch at hello@getuntilt.com and we'll be happy to help.

Adapted from the Basecamp open-source policies / CC BY 4.0.