Privacy Policy

1. Who we are and how to contact us

The data controller responsible for your personal information is Mindset & Harmony Pty Ltd, an Australian company. If you have any questions about this policy or wish to exercise your privacy rights, contact us at:

Email: hello@butterflyletters.io

Web: https://www.butterflyletters.io/contact

2. Information we collect

2.1 Information you provide

2.2 Information collected automatically

When you use the app we automatically collect certain technical and usage information to keep the Service running, secure and improved:

• Device and app information — device type, operating system, app version, and crash/diagnostic data.
• Usage analytics — in-app events such as sign-up, login, creating a memory, and starting a subscription, used to understand how the app is used and to improve it.
• Attribution data — aggregated, privacy-preserving information about which advertising campaign led to an install, so we can understand which campaigns are effective. On iOS this is measured using Apple's SKAdNetwork (SKAN) framework, which provides aggregated results and does not collect your device's advertising identifier (IDFA). We do not use Apple's App Tracking Transparency (cross-app tracking) for this.
• Storage usage — the size of the files you store, so we can display your usage and enforce plan limits.

2.3 Sensitive information

The content you store — letters, photos and videos of and for your children, including a child's name — may be sensitive information. We collect it only because you choose to create and store it, and we treat it with a high level of protection. We do not use this content for advertising, profiling, or any purpose other than storing it and delivering it as described in this policy.

3. How we use your information

We use your personal information to:

• Provide the Service — create your account, store your memories, and manage child profiles;
• Verify your identity and your recovery contact via one-time codes sent by email and SMS;
• Operate the inactivity-detection and recovery process described in Section 6;
• Process your subscription, free trial, and any promotional offer codes;
• Send you service and transactional messages (for example, verification codes, inactivity check-ins, and content-delivery links);
• Provide customer support and respond to your enquiries;
• Maintain the security, integrity and reliability of the Service, including fraud prevention and diagnosing technical problems;
• Comply with our legal obligations.

We rely on your consent and on the performance of our contract with you (our Terms of Use) as the primary bases for this processing. Where a legitimate-interests or legal-obligation basis applies under GDPR-style laws, we rely on those bases as relevant.

4. Where your information is stored and how we protect it

Your account data and memory content are stored using Supabase, our backend and file-storage provider, in data centres located in Sydney, Australia. Files (photos, videos and letters) are held in encrypted object storage and are encrypted at rest.

Our security measures include:

• Encryption in transit and at rest for stored files;
• Row-level security so that each account can only ever access its own data — one user cannot access another user's letters, photos or videos;
• One-time-code verification for email and mobile number, rather than reusable passwords;
• Access controls and audit logging of significant account and content events for accountability.

No method of transmission or storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

5. Service providers and disclosure

We do not sell your personal information. We share it only with trusted service providers who help us operate the Service, and only to the extent necessary. Each provider is bound to protect your information and use it only for the services they provide to us.

Some of these providers may process data on servers outside Australia (for example, in the United States or Europe). Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

We may also disclose personal information where required by law, to enforce our Terms of Use, or to protect the rights, safety or property of our users or others.

6. Recovery contacts and the inactivity / delivery process

A central feature of Butterfly Letters is the ability to nominate a recovery contact — a trusted person who will receive your stored content in defined circumstances. Because a recovery contact is a third party, we handle their information carefully.

6.1 Consent of the recovery contact

When you nominate a recovery contact, we send them an email invitation with a secure link. Through a short two-step web form, that person confirms their email address and verifies their mobile number, and in doing so gives their consent to act as your recovery contact. They can also decline. We only mark a recovery contact as “verified” once they have completed this process. You should only nominate someone you have spoken to and who is willing to take on this role. Because your content is delivered directly to this person and may be emotionally significant, we recommend choosing a trusted adult who can receive and, if appropriate, pass on your content — rather than a child.

6.2 When content is delivered

Your content is delivered to your recovery contact only in these situations:

• Inactivity (paid accounts): If you are an active paying user and do not open the app for an extended period, we send you a series of reminders — a check-in email at around 180 days, an SMS and email at around 187 days, and an urgent email with a final warning at around 194 days. If you still do not return, at around 201 days we deliver a secure, time-limited download link for each child to both you and your verified recovery contact. Logging in at any point resets this process.
• Subscription cancellation (paid accounts): If you cancel after having been a paying user, your content is sent to both you and your verified recovery contact on the last day of your billing cycle. The inactivity process is not triggered.
• Free-trial cancellation: If you cancel during your free trial, any content is sent only to you — not to your recovery contact.

If you have no stored content, no delivery email is sent. Download links expire after 365 days.

7. Marketing communications and advertising

7.1 Marketing emails

As well as the service messages described above, we may send you promotional and lifecycle emails — for example, a welcome and onboarding series when you sign up, and reminders if you create an account but do not start your free trial. These are sent using our email provider, Resend.

You can opt out of marketing emails at any time using the unsubscribe link in each email. Opting out of marketing does not stop essential service messages (such as verification codes, inactivity notices and content-delivery links), which are necessary to operate your account. We handle marketing email in accordance with the Spam Act 2003 (Cth).

7.2 Advertising

We advertise Butterfly Letters on platforms including Meta (Facebook and Instagram), Google and TikTok, to reach people who may be interested in the app. These campaigns are used to drive new installs.

To understand which campaigns lead to installs, we use AppsFlyer together with Apple's SKAdNetwork (SKAN) framework. This provides us with aggregated attribution results — it tells us that a campaign produced installs, but does not identify you individually and does not collect your device's advertising identifier (IDFA). We do not upload your personal information (such as your email) to these advertising platforms to build audiences, and we do not use cross-app tracking. If this changes in the future, we will update this policy and obtain any consent required at that time.

8. Data retention

We keep your personal information only for as long as we need it:

• Account and content: for as long as your account is active.
• After a delivery or recovery event: your content remains on our servers for an additional one (1) year as a redundancy safeguard, after which it is deleted.
• After account deletion: when you delete your account, we delete your stored files and account data, subject to any short technical retention in backups and to records we are required to keep by law.

9. Your rights and choices

You can, at any time:

• Access and update your account details and child profiles within the app;
• Edit or delete individual memories, child profiles, or your recovery contact;
• Export your content to yourself at any time via the in-app export feature;
• Delete your account, which removes your stored content as described in Section 8;
• Opt out of SMS messages by replying STOP, and manage push and email marketing preferences;
• Unsubscribe from our marketing emails at any time using the link in each email.

Depending on where you live, you may also have rights to request a copy of your personal information, ask us to correct or delete it, or object to or restrict certain processing. To make a request, contact us at hello@butterflyletters.io. We will respond within the timeframe required by applicable law. If you are in Australia and are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

10. Children

Butterfly Letters is intended for use by adults (parents and guardians). Accounts are not intended to be created by children. The app stores content about children — created by the adult account holder — but children do not hold accounts or interact with the Service directly. You must be 18 years of age or older to hold an account, as set out in our Terms of Use.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date and, where appropriate, notify you within the app or by email. Your continued use of the Service after an update means you accept the revised policy.

12. Contact us

If you have any questions, concerns or complaints about this policy or how we handle your information, please contact us at hello@butterflyletters.io or via https://www.butterflyletters.io/contact.

Mindset & Harmony Pty Ltd · ACN 670 117 665 · Australia