1. Who is responsible for your information
Until Tomorrow and tomorroweditions.com are operated by William Marsey, trading as Tomorrow Editions, a sole trader in the United Kingdom. William Marsey is the controller of the personal information described in this policy. "We", "us" and "our" refer to William Marsey trading as Tomorrow Editions.
Email: hello@tomorroweditions.com Postal address: 50 Capstan Way, London SE16 5HH, United Kingdom
This policy covers the Until Tomorrow iOS and Android app, the Tomorrow Editions website and correspondence about them. It explains our processing, rather than giving us permission to do anything with your information. Apple, Google and other services also have their own policies for information they control.
2. Information we collect and why
Reader account and sign-in
The app creates a pseudonymous Firebase reader account so it can save settings, readings and highlights. You can use this without supplying your name or email. Pseudonymous means associated with an identifier, not completely anonymous.
If you choose Sign in with Google or Sign in with Apple, Firebase receives the provider identifier and account information that provider shares, which may include your email address, name and profile information. Apple may supply a private relay email address. We use this to link or restore your reader account. We do not receive your Google or Apple password.
Readings, highlights and preferences
We store the digests you open, their reading dates and account association, and highlights you save, including quotation text and selection positions. We store your selected digest days, notification preferences, notification time and time zone. The time zone comes from your device; we do not request GPS location. These records let the app provide its reading, archive, backup and sync features.
Downloaded readings, reading positions, highlights, preferences, sign-in state and pending sync changes are also stored on your device. A saved reading position is held locally. Local data may also be affected by your device's own backup, storage and security settings.
Notifications
If you enable notifications, we process a device registration identifier, device platform, push token, delivery records and your chosen schedule. The push provider receives the token and notification payload, including the digest description and reading date, to deliver the reminder. Notifications may appear on your lock screen according to your device settings. You can turn them off in the app or device settings.
Purchases
Apple or Google processes store payments. RevenueCat helps us validate and restore purchases and manage Reader Pass access. This involves your Firebase reader identifier, store transaction identifiers and receipts or purchase tokens, product, purchase and entitlement status, and relevant device, app and network information. This can occur when purchase services initialise, as well as when you buy or restore. We do not receive your full payment card details.
Optional usage analytics
If you choose to enable optional analytics, Firebase / Google Analytics collects an app-instance identifier, device and app information, approximate location derived from network information, and events about use of the app. These include screens, reading activity and duration, digest and author identifiers, highlights being added or removed, sharing actions, settings actions and error categories.
Our custom analytics events do not contain quotation text, the text of your highlights, email addresses, notification contents, push tokens or passwords. We do not attach your Firebase authentication identifier to Google Analytics. Google Analytics uses its own identifier, so this is not a promise that usage information is anonymous. Advertising identifiers, advertising personalisation and advertising consent are disabled in our analytics configuration.
Optional analytics is off unless you choose to enable it. You can change that choice in Settings, under Privacy. The choice applies to this installation. Withdrawing consent stops future optional collection and resets the local analytics identifier; it does not automatically erase earlier server records. For an account deletion request made in the app, we record the current analytics identifier, when available, so we can ask Google to delete associated records. Earlier identifiers that have already been reset may no longer be identifiable to us. You can also contact us about analytics deletion.
Website, technical information and correspondence
Our website is hosted by Cloudflare. Hosting and other service providers process IP addresses, request information and technical or security logs to deliver and protect the services. The website does not currently use advertising or visitor analytics scripts, and its fonts are self-hosted.
If you email us, we receive your email address, message, attachments and any information needed to answer or investigate. Please do not send passwords, full card details or identity documents unless we have explained why they are needed and agreed an appropriate way to provide them.
3. Our lawful bases
Where UK or EEA data protection law applies, we use:
- Performance of our contract with you for essential account, reading, sync, purchase validation, restoration and support functions you request.
- Consent for optional usage analytics and notifications where consent is required. Device notification permission and optional analytics permission are separate choices. Necessary notification administration may also be needed to provide the notification service you request.
- Legitimate interests for proportionate service security, fraud prevention, fault investigation, routine correspondence and managing legal claims. Our interests are operating and protecting a small independent reading service; we consider the effect on your rights when relying on this basis.
- Legal obligations for tax, accounting and other records the law requires.
Essential device storage supports functions you request, such as keeping you signed in, saving downloads, restoring reading positions and remembering your privacy choice. We seek consent before using non-essential analytics storage where required. You do not have to agree to optional analytics to use the app.
If you do not provide information necessary for an optional function, such as sign-in or a purchase, we may be unable to provide that function. We do not make decisions with legal or similarly significant effects about you solely through automated processing.
4. Who receives information
We use service providers to operate the service, including:
- Google / Firebase: authentication, cloud storage, backend hosting and, when enabled, Google Analytics.
- RevenueCat: purchase validation, entitlement management and restoration.
- Expo, Apple Push Notification service and Firebase Cloud Messaging: push notification delivery, when enabled.
- Cloudflare: website hosting, delivery and security.
- Email and administrative providers: correspondence and business records.
Providers receive the information needed for their roles. They may process some service, security, payment or account information under their own responsibilities. We may also disclose information to professional advisers, where legally required, to protect legal rights, or as necessary for a genuine transfer of the business subject to applicable data protection requirements. This is not permission to sell your reading history as a separate asset.
We do not sell personal information, provide it for third-party targeted advertising or use the app to track your activity across other companies' apps and websites for advertising.
If you choose Share, your device sends the selected text or image to the app or recipient you choose. That recipient's handling is outside our control.
Editorial preparation may use AI services to help select historical source material or prepare editorial copy. Our digest-generation workflow sends source and editorial material, not reader accounts, reading history or saved highlights, to those services.
5. Where information is processed
Our main Firestore database is configured in London. This does not mean all information stays in the UK: providers may process information in the United States and other countries where they or their subprocessors operate.
For restricted transfers under UK or EEA law, we use an applicable adequacy decision or appropriate contractual safeguards, such as standard contractual clauses with the UK addendum or the UK International Data Transfer Agreement, as appropriate to the provider and transfer. Contact us for information about the safeguards applicable to your data and how to obtain a copy.
6. How long information is kept
Account information, saved readings, highlights and preferences are kept while your reader account remains open and they are needed to provide its functions. There is currently no automatic account expiry after a fixed period of inactivity. Uninstalling the app does not itself delete server-side records.
We delete account-related information in response to a verified deletion request, subject to information we need to retain for a specific legal obligation, security purpose or legal claim. We explain any relevant exception when replying to the request, including what is retained and why. Such records are restricted to that purpose and are not used to keep providing the deleted account.
Routine support correspondence is kept for as long as reasonably needed to resolve and follow up the matter. Transaction, complaint and dispute records may be kept longer where necessary for accounting, tax or legal claims, taking account of the applicable legal record-keeping and limitation periods. We review whether retained information is still necessary rather than retaining everything simply because it could be useful.
Our Google Analytics property is configured to retain event data for 2 months and user data for 14 months. The user-data retention period restarts when there is new activity from that user. Google Signals is off. Reports that no longer identify a person may be retained longer. Providers may retain limited service, security, backup or legally required records under their own applicable retention rules; links to their information appear below.
Data held only on your device remains until you remove it, clear the app's data, uninstall it or it is removed by your device's storage processes. Device backups can have separate retention settings.
7. Your choices and rights
You can change your reading and notification preferences in the app, remove individual highlights and choose whether to link a Google or Apple account. Depending on applicable law and the circumstances, you can ask us to:
- Give you access to and a copy of your personal information.
- Correct inaccurate information or delete information.
- Restrict processing or provide a portable copy of information.
- Stop processing based on legitimate interests by exercising your right to object. You can withdraw consent for processing based on consent at any time.
To request account deletion in the app, open Settings, then Your account, and choose Request account and data deletion. This also works for an unlinked reader account. Linked accounts require you to confirm the sign-in. The request is processed manually, normally within one month, and you can check completion in the app using its deletion reference without signing back into the old account. You do not need to email or call us to complete an in-app request.
Once submitted, the request blocks further account sync and notification sends. The app clears that reader's local downloads, preferences and highlights on the requesting device and signs out. Clear storage or uninstall on any other devices to remove their local copies. We delete the Firebase sign-in account, profile, saved digests, highlights, notification registrations and delivery records, and arrange deletion of associated RevenueCat and identifiable analytics records.
You can also request deletion without the app at https://tomorroweditions.com/request-deletion/ or email hello@tomorroweditions.com with the subject "Delete my Until Tomorrow account". Tell us the sign-in email or reader identifier if available. Never send a password. For an unlinked account, we may need information from the device to locate its records. We ask only for proportionate information to verify ownership. For other privacy requests, email the same address.
We keep a restricted deletion marker containing the old reader identifier and completion status to prevent stale sessions recreating deleted records and to demonstrate fulfilment. A separate status receipt uses a random reference and does not expose your email, highlights or reading history. Analytics identifiers and other request details are removed from the request on completion. We review the continued need for restricted deletion markers and remove them when no longer necessary. Keep your deletion reference private.
Deleting an account removes access to its saved readings and highlights. It does not itself cancel store billing, delete an Apple or Google account, or guarantee that store transaction records must also be erased. Any subscription offered in the future must be managed through the relevant store. A Reader Pass is currently designed as a one-time purchase, not a recurring subscription.
We respond within the time required by applicable law, normally one month for a UK GDPR request. A lawful extension may apply to complex or numerous requests; we will explain this if relevant. Requests are normally free. We charge or decline a request only where applicable law permits it.
You can complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or your relevant local supervisory authority. You do not need to contact us first, although we welcome the chance to resolve your concern.
8. Children and security
The app is intended for people aged 16 and over and is not directed at children under 16. If we learn that we hold information about a child who is not permitted to use the service, we will assess and take appropriate steps, including deletion where required. Contact us if you believe this has happened.
We use reasonable technical and organisational measures appropriate to the information and the service, including access controls and secure transport. No system is completely secure. Keep your device and linked sign-in account secure. We do not claim that cloud backups or highlights are end-to-end encrypted.
9. Updates and provider information
We may update this policy to reflect changes in the service or law. We identify the latest version by its date and give additional notice of significant changes where appropriate or legally required. We obtain fresh consent if a change requires it; merely publishing a new policy does not override your choices.
Provider information: Google / Firebase: https://firebase.google.com/support/privacy Google: https://policies.google.com/privacy RevenueCat: https://www.revenuecat.com/privacy Expo: https://expo.dev/privacy Apple: https://www.apple.com/legal/privacy/ Cloudflare: https://www.cloudflare.com/privacypolicy/