Privacy policy

Draft of 23 October 2026 — legal review pending.

This is a draft for the private beta of Betterward. It describes the service as it is being built for the beta. A lawyer will review it before the public launch.

1. Who is responsible

The controller of the personal data processed through the Betterward app and this website is Mega Apps Ventures, LLC, a limited liability company under the laws of Delaware, USA. Mailing address: Mega Apps Ventures, LLC, 8 The Green, Suite #27141, Dover, DE 19901, US. Contact: info@megaappsventures.com.

2. Two separate promises

Betterward makes two different promises. Only the first one is about encryption, and the second one is not covered by it.

Encrypted storage. Everything personal you record — entries, habits and check-ins, plans and tasks, people and interactions, reviews, settings — is stored encrypted on your phone. If you turn on the backup, every record is encrypted on your phone before it is uploaded, with keys that only you hold (protected by your recovery kit). Our server and its backups hold only this ciphertext. We cannot read it, and we cannot hand it to anyone in readable form.
Authorized AI processing. Some optional features use AI. When you allow one, the data that feature needs is decrypted on your phone and sent readable, over an encrypted connection (TLS), to our server and from there to an AI provider, for that one request. Section 5 explains what is sent and what is kept.

3. Data on your phone

The app keeps its database on your phone, encrypted (SQLCipher). The key stays in the phone's secure key storage (Keychain on iOS, Keystore on Android) and never leaves the phone.
Without an account and backup, nothing personal leaves your phone. For the private beta, testers set up both (see the beta terms).
Your phone's own backup (iCloud, Google) may contain the encrypted database file, but not its key, so that copy cannot be opened on its own.
The optional app lock (PIN or biometrics) works only on the phone; your PIN is never sent.
Reminders are computed and scheduled on the phone; our server sends no push messages. Notification previews never show journal text or the names of people.
The app contains no advertising, analytics or crash-reporting services.

4. Account and encrypted backup: what our server can read

An account is needed only for the backup. With an account, our server can read:

Account data: your e-mail address, your password only as a hash, an optional two-step verification secret, the language for service e-mails, your confirmation that you are 18 or older, sign-in sessions (device, IP address, app or browser identifier, expiry) and security events such as sign-ins and password resets (with IP address and time).
Devices: the list of devices allowed to use your backup, with model name (for example "Pixel 8"), platform, app version and when each was last seen.
Metadata per backed-up record: a random identifier, the record type (for example "habit log"), the time of the last change, the size (rounded up in 256-byte steps) and a deletion marker. This can show when and how much you use the app, not what you wrote.
Key material only in wrapped form: your keys encrypted with your recovery kit, the non-secret parameters to unwrap them, and hashes used to check your recovery kit and your devices.

Nothing else. In particular, our server cannot read the content of any record.

5. AI features (optional, off by default)

The current version has no active AI feature and sends nothing to an AI provider. When AI features are offered during the beta, each one has its own switch in the app (Me → AI and data sharing). Every switch is off by default, says what it sends and to whom before you turn it on, and can be turned off at any time. They will work like this:

A feature that works on your text sends only the passages you select for that request. Names of people, habits and projects in them are replaced by placeholders on your phone and filled back in on your phone. This reduces what is exposed; it is not anonymization — the rest of the text can still say something about you or others.
The wording of tips and the weekly review narrative send numbers and categories only (for example how many check-ins were done), no free text.
Our server passes the request on and does not log or store the text you sent. For proposals created from a capture, it keeps the AI's answer for 24 hours, encrypted with a server key, so that a repeated request does not run twice. During those 24 hours we could technically read that answer (it contains the placeholders, not the real names); then it is deleted. A host backup taken in that time can contain it until the backup expires (section 8).
We count AI requests and their size per month to apply a usage limit.
Before the first AI feature is switched on, this policy will name the AI provider, where it processes the data and its retention terms. Our requirement for that provider: no training on the data and no storage after processing.
Cloud transcription and cloud voices follow the same rules with their own switches. Until they are offered, the app sends no audio anywhere.

6. This website

This website sets no cookies, uses no analytics or tracking, and loads no content from third parties (fonts are served from this server). The web server records technical access logs (IP address, time, page requested, browser identifier) for operation and security.

7. Service providers

We do not sell or rent personal data and show no advertising. We use only these providers:

Hosting provider — runs the server with the database, the stored files and the backups. Today the server is in Finland (EU) and its backups are stored on separate backup storage in Helsinki, Finland.
Brevo (France) — sends the service e-mails (address confirmation, password reset, confirmation of an account deletion with the cancel link). It receives your e-mail address, the language and the content of that e-mail — never journal content — and keeps a log of sent e-mails under its own terms.
Apple and Google — distribute the app (App Store and TestFlight, Google Play) under their own privacy terms. If you join the beta through TestFlight or Google Play testing, we see the e-mail address you were invited with and any feedback or crash reports you choose to send through those programs.

We may disclose data where a law or an order of a competent authority requires it; your records would still be ciphertext we cannot read.

8. Retention and deletion

On your phone: until you delete a record, delete the local copy or uninstall the app.
Encrypted backup: until you delete the record, the backup or the account. A deleted record is replaced by an encrypted deletion marker at the next backup.
Deleting the cloud backup removes all backed-up records, keys and the device list from our live database at once; the account stays.
Deleting the account is scheduled 7 days out. We send you an e-mail with a link to cancel. After the 7 days the account and everything linked to it are deleted from our live database automatically.
Host backups: our hosting provider backs up the whole hosting account every day and keeps each backup for 60 days. Because the backup runs once a day, a server failure can lose up to the last 24 hours of changes on the server; the copy on your phone is not affected. These backups contain the database and the files as stored on the server: your records only as ciphertext, your account data (e-mail address, password hash, sign-in records) as stored. Deleted data remains in these copies until they expire — at most 60 days after it was deleted from the live database, so up to 67 days after an account-deletion request.
Server logs record request metadata only (time, route, status, size, user and device identifier, IP address), never the content of a request. We will state their exact retention period here before the private beta starts.
E-mails you send us stay in our mailbox until the matter is settled; ask us and we delete them.

We plan to move the service to its own server before the private beta starts. Before that move we will update this section (location of the server and of the backups, backup retention).

How to delete, step by step: Delete your account and data.

9. Feedback, crash reports and beta metrics

During the beta the app may offer an in-app feedback form, crash reports and summaries of usage numbers for the test. Each one is sent only if you choose to; crash reports and usage summaries each have their own switch, off by default. These are separate from your journal, are not end-to-end encrypted, and never contain entry text, recordings or the names of people. Before they are offered, the app and this policy will list exactly which values they contain and how long we keep them.

10. Legal bases

Account, backup and service e-mails: performance of the contract (the beta terms), Art. 6(1)(b) GDPR.
AI features, crash reports and usage summaries: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the switch in the app.
Security, abuse prevention, server and access logs: our legitimate interest in running the service safely (Art. 6(1)(f) GDPR).

11. International transfers

The operator is a company in the United States; the server is in the European Union (Finland). Brevo is based in the EU. Apple and Google process data under their own terms, also outside the EU. If an AI provider outside the EU is used, section 5 will say so before the feature is switched on. We have no separate transfer agreements (for example standard contractual clauses) with these providers today; the terms each provider publishes apply. This point is under legal review.

12. Your rights

Under Dominican Republic Law No. 172-13 on the protection of personal data and, where it applies, the EU General Data Protection Regulation (GDPR), you have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, to withdraw consent, and to lodge a complaint with a supervisory authority.

Because we cannot read your encrypted records, a request to us can only cover what we can read (account data and the metadata in section 4). The content itself you can export in the app at any time (Me → Export: everything as JSON, the journal as Markdown) and delete in the app. To exercise your rights, write to info@megaappsventures.com.

13. Age

Betterward is meant for people aged 18 or older. Creating an account requires you to confirm that you are 18 or older; we ask for no date of birth or documents, so we cannot check the confirmation. We do not knowingly collect data from minors; if we learn that an account belongs to a minor, we delete it.

14. Security and your recovery kit

All connections between the app, this website and our server are encrypted (TLS). Your records are encrypted on your phone before upload. The recovery kit is the only way to restore your encrypted backup on a new phone: a password reset lets you sign in again but cannot restore your data, and we cannot restore it either. Keep your recovery kit safe. We will never ask you for your recovery kit, your password or your journal content.

15. Changes to this policy

We will publish every new version on this page. If a change is material, we will tell you in the app or by e-mail before it takes effect.

16. Contact

Questions about this policy or your data: info@megaappsventures.com. Mailing address: Mega Apps Ventures, LLC, 8 The Green, Suite #27141, Dover, DE 19901, US.