Privacy Policy

1. Introduction

Thingys (“Thingys”, “we”, “our”, or “us”) is a personal management app for to-dos, income and expenses, jobs, appointments and events, operated by Anouk Solutions (Pty) Ltd. We are committed to protecting your personal information and handling it responsibly in accordance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”) and all other applicable data protection laws.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights. It applies to this website and to the Thingys app. By using Thingys, you agree to the practices described in this policy.

2. Who This Policy Applies To

This Privacy Policy applies to:

• Users of the Thingys app (“Users”) who create an account.
• People who joined the Thingys pre-launch list on this website.
• Visitors to this website and related digital properties.

3. Information We Collect

3.1 Pre-Launch List (This Website)

Before Thingys launched, people could join a pre-launch list. If you did, we collected:

• Your name, surname, email address and phone number.
• The kind of phone you use (iPhone, Android or both), if you chose to tell us.
• The date and time you agreed to be contacted.

3.2 Account Information

When you create an account with a username, we collect your chosen username and a password, which we store only in a scrambled (hashed) form. We do not ask for your email address. If you instead sign in with Google or Apple, they confirm your identity to us and we receive a unique account identifier and, if you allow it, your email address (Apple may give us a private relay address instead). We use these only to recognise your account; we store no password for you, and we do not use your email address to contact you or for marketing.

3.3 Content You Add to the App

Everything you add to the app, such as to-dos, income and expenses, jobs, appointments and events, is stored against your account and is visible only to you. We do not read, sell or share it, and we do not use it for advertising.

3.4 Subscription Information

Some features need a paid subscription after your free trial. If you subscribe, the App Store or Google Play processes your payment; we never see your card or other payment details. We receive confirmation of your subscription from our subscription provider, RevenueCat, including the product, its dates and whether it will renew, and we store that against your account to decide whether you have full access. RevenueCat processes this on our behalf, using your Thingys account identifier and no other personal details from us. Deleting your Thingys account does not cancel a subscription; cancel it in your App Store or Google Play subscription settings.

3.5 Free Trial Protection

Every account gets a free trial. To stop the trial being repeated, we keep a one-way (hashed) code of your Google or Apple account identifier after an account is deleted. This code cannot be reversed into your identifier and is not used for advertising or tracking.

3.6 Reminders and Location

Reminders are scheduled on your own device. The app does not track your location.

3.7 Security and Authentication

We do not store passwords in plain text. All passwords are hashed using industry-standard algorithms before being stored in our database.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To create and manage your Thingys account and recognise you when you sign in.
• To provide, operate, and improve the Thingys app.
• To store the content you add so that it is available to you.
• To decide whether your account has full access, based on your trial and subscription status.
• To send you one email about the launch, and to understand which phones to build for first (pre-launch list only).
• To comply with our legal obligations under South African law.
• To investigate and resolve disputes or security incidents.

We do not send marketing about anything else, we do not sell or rent your details, and we do not use your information for advertising or tracking.

5. Legal Basis for Processing

We process your personal information on the following legal bases under POPIA:

• Contractual necessity: Processing is required to provide you with the services described in our Terms of Service.
• Legitimate interest: Processing is necessary for the administration, security, and improvement of our app, including preventing repeated free trials.
• Legal obligation: Processing is required to comply with South African law.
• Consent: Where we rely on consent, such as the pre-launch list, you may withdraw it at any time by contacting us.

6. Data Storage and Infrastructure

Your data is stored and processed on infrastructure provided by Google Cloud (hosting) and Supabase (database). Our servers are located in Europe.

While our servers are located outside South Africa, we take reasonable steps to ensure that your information is protected with appropriate contractual and technical safeguards equivalent to the standards required by POPIA. By using Thingys, you acknowledge and consent to your data being processed in these locations.

7. Data Retention

We retain your personal information only for as long as needed to provide our services. Specifically:

• Account information and content you add: Retained for as long as your account exists.
• Subscription status: Retained for as long as your account exists.
• Free trial protection code: A one-way hashed code is retained after account deletion solely to prevent the free trial being repeated.
• Pre-launch list details: Retained for up to 12 months after the launch email was sent, or until you ask us to delete them, whichever comes first.

You may delete your account at any time from inside the app. This permanently removes your account and all of the information you added, with the exception of the one-way trial protection code described above. This action cannot be undone.

8. Sharing of Information

We do not sell your personal information. We share your information only with the following third-party service providers, strictly for the purposes of delivering our service:

• Google Cloud – Application hosting infrastructure.
• Supabase – Database hosting.
• RevenueCat – Subscription status management.
• Google and Apple – Only if you choose to use them to sign in; their own privacy policies apply to your Google or Apple account.
• Apple App Store and Google Play – Payment processing for subscriptions.

Each of these providers processes information on our behalf and is bound by its own privacy policy and security commitments. We may also disclose your information where required to do so by law, court order, or regulatory authority.

9. Cookies

This website does not use cookies or third-party tracking. It loads one font from Google Fonts, which means your browser contacts Google to download it.

10. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information, subject to our legal obligations.
• Object to the processing of your personal information, and withdraw your consent to be emailed.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise the right to deletion, you can delete your account from inside the app, or contact us directly. For all other rights, please contact us at the details in Section 13. If you are in South Africa and are not satisfied with our response, you may lodge a complaint with the Information Regulator; if you are in the EU or UK, you may contact your local data protection authority.

11. Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, or disclosure. These measures include encrypted connections, password hashing, separation of each account’s data from everyone else’s, and the use of reputable cloud infrastructure providers. However, no system is completely secure, and we cannot guarantee the absolute security of your information. We will tell you if something goes wrong that affects you.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this document and, where the change is significant, tell you in the app. Continued use of Thingys after such notification constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact us at: