Privacy Policy
Draft for review. Have a lawyer who knows Vietnamese law review this policy before launch, and check it matches the App Store and Google Play privacy labels.
Check It Twice (the “App”) is made by Ngo Nguyen Nhi, an independent developer trading as GLASHION and based in Ho Chi Minh City, Vietnam (“I”, “me”; we use “we” and “us” below for readability, and they mean the same person). This policy explains what information the App collects, why, who it’s shared with, and the choices you have. Ngo Nguyen Nhi (GLASHION) is responsible for your personal data (the “data controller”) under Vietnam’s personal data protection law and, where they apply to you, other data protection laws such as the GDPR.
The short version. Your lists are yours. As a guest, your lists and photos stay on your phone. If you sign in, we store them on our server so they’re backed up and sync to your other devices. We use your information only to run and improve the App, we don’t show ads, we never sell your information, and you can delete your account and everything in it at any time.
Contents
1. Guest mode and accounts
You can use the App in two ways:
- As a guest (offline, no account). Your lists, items, ticks, history, reminders and photos are saved on your phone only. None of it is sent to our server, and AI features are off. If you delete the App or lose your phone, a guest’s data can’t be recovered. Anonymous usage statistics and crash reports (section 2) are still collected in guest mode.
- With an account. When you sign in, your lists and photos are stored on our server so they’re backed up and sync to your other devices. If you sign in after using the App as a guest, the lists on your phone are copied to your account.
2. What we collect
Information you give us (accounts only)
- Account details. Your email address and, if you sign in with Apple or Google, your Apple or Google account ID and the name they share with us (with Apple’s “Hide My Email”, a private relay address instead of your email). We use your first name for the greeting on Home. You can change your name in Profile.
- Your lists. List names, items, whether each item is ticked, stars, categories and their colours, due dates, reminder times, repeat settings, and the history of each finished round.
- Photos. Proof photos you take or choose for a list, and your profile photo if you add one. The App resizes and re-saves each photo on your phone before upload, which removes location and other metadata from the file.
- Settings. Your notification and “remind ahead” settings and your choice of avatar.
- What you type for AI features. See section 4.
- Messages to us. Anything you send when you email us for support.
Information collected automatically
- Sign-in and device information (accounts only). A random ID the App creates for your phone, the platform (iOS or Android), your time zone (so reminders and daily limits follow your day) and the App language. When you ask for an email sign-in code, we also record your IP address with the code, to prevent abuse.
- Security records. To limit abuse, our server briefly keeps your IP address or account ID with a count of recent requests.
- Usage statistics (Firebase Analytics). Events such as “list created”, “item ticked”, “round finished”, “reminder opened” and “signed in”, with counts and types but never the text of your lists, plus the device and app information Firebase collects automatically (such as device model, operating system, app version, country and an app-instance ID). Where your device allows it, Firebase may also read your device’s advertising identifier. We use these statistics only to understand and improve the App, not for advertising, and we don’t link them to your name or email.
- Crash reports (Firebase Crashlytics). If the App crashes or hits an error, a report with technical details about the device and what went wrong. Reports don’t include your list content, your sign-in tokens or your email.
- App updates. The App checks Expo’s update service for small updates, which sends basic technical information such as the App version, platform and your IP address.
What we don’t collect
We don’t show ads, and we don’t track you across other companies’ apps and websites. We don’t access your contacts or your location. The App uses your camera and photo library only when you choose to add a photo.
3. How we use your information
| Purpose | Information used |
|---|---|
| Create and secure your account, and sign you in | Account details, sign-in and device information |
| Store, back up and sync your lists and photos across your devices | Your lists, photos, settings |
| Draft and edit lists with AI when you ask | What you type, list names and items, categories (section 4) |
| Schedule reminders on your phone, only for lists that still have unticked items | Reminder settings, time zone |
| Understand how the App is used, fix crashes and improve it | Usage statistics, crash reports |
| Reply to support requests | Messages to us |
| Prevent abuse and meet legal obligations | IP address, security records, as needed |
We process this information because you agreed to it when you started using the App and because we need it to provide the App to you. Where the law requires a specific consent, we’ll ask for it in the App, and you can withdraw it at any time. We don’t sell your personal information, and we don’t use it for advertising.
4. AI drafting and editing
When you’re signed in, you can type a few words to get a draft list, or type an instruction in the chat box to change a list (for example “add sunscreen” or “remind me Friday”). These features don’t work in guest mode.
- For a draft, our server sends what you typed, the App language, your phone’s country setting and your category names to OpenAI.
- For an edit, our server sends your instruction, the list’s name, its item names, today’s date and your category names to OpenAI.
- Your text is first checked by OpenAI’s moderation service. We don’t send your name, email or account ID to OpenAI.
- We don’t store what you type. We keep a record of each request (the feature used, its size and whether it worked) to apply daily limits. Draft answers are cached for up to 30 days, without your account ID, so the same request can be answered again quickly, including for other people. Edits are not cached.
Don’t type sensitive personal information (such as health details or bank numbers) into AI features. AI suggestions can be wrong, so check them before you rely on them.
5. Who we share it with
As an independent developer, I rely on a few service providers to run the App. They process your information only to provide their service to me:
- Our hosting provider, which runs the server that stores account data, lists and photos.
- Google (Firebase Analytics and Firebase Crashlytics): usage statistics and crash reports.
- OpenAI: AI drafting, editing and moderation (section 4).
- Resend and Amazon Web Services (Amazon SES): sending email sign-in codes. They receive your email address and the code.
- Apple: Sign in with Apple, when you choose it.
- Google: Sign in with Google, when you choose it.
- Expo (650 Industries): delivering App updates.
We may also share information if the law requires it, to protect someone’s safety, or if the App is transferred to someone else. If the App is transferred, this policy will continue to protect your information, and I’ll tell you first.
6. Notifications and your device
Reminders are scheduled on your phone; we don’t use push notifications from a server. A reminder shows the list’s name and a short question, not its items. Anyone who can see your screen may see it. You can hide notification previews or turn notifications off in your device settings, or turn off Notifications in Profile.
Your lists, photos and sign-in session are also stored on your phone. Logging out or deleting your account removes them from the phone.
7. Where your data is stored
If you have an account, your account data, lists and photos are stored on our server in Singapore. Our service providers may process data in other countries, including Singapore (Amazon SES) and the United States (Google, OpenAI, Expo). This means your information may be transferred outside Vietnam and outside your own country. We rely on our providers’ data protection terms, including the Standard Contractual Clauses where the GDPR applies, and we complete any transfer filings Vietnamese law requires.
8. How long we keep it
- Account, lists and photos: as long as you have an account. When you delete a list, you have a few seconds to undo it; it is then removed from your devices and from our server, including its photos, within 30 days.
- Deleting your account: your account, lists, history, photos, settings, sign-in methods and sessions are deleted from our server straight away, and Apple sign-in is revoked if you used it. Remaining copies in sync records, security records and backups are deleted within 30 days. AI usage records (which hold no text) are kept for up to 12 months and then deleted.
- Email sign-in codes: each code works for 10 minutes; expired codes and their IP addresses are deleted after a day.
- Sign-in sessions: a session ends after 60 days without use, and ended sessions are deleted 30 days later.
- AI draft cache: up to 30 days.
- Server error logs: up to 90 days. They don’t contain your email, sign-in codes, tokens or what you type.
- Usage statistics and crash reports: kept by Google under Firebase’s retention settings (crash reports up to 90 days).
- Support emails: up to 2 years after the conversation ends.
- Guest data: stays on your phone until you delete it in the App or delete the App.
9. How we protect it
Data is encrypted in transit (HTTPS). Sign-in codes and session tokens are stored only as secure hashes, and Apple sign-in tokens are encrypted. Photos can only be downloaded by the account that owns them, and the App keeps your sign-in session in your phone’s secure storage. Only I can access the server. No system is perfectly secure. If a breach affects your personal information, I’ll notify you and the authorities as the law requires.
10. Your rights and choices
Depending on where you live, you have the right to know what we hold about you, and to access, correct, download or delete it, to restrict or object to how it’s used, and to withdraw consent at any time. You can:
- edit or delete lists, items and photos at any time in the App;
- change your name and profile photo in Profile;
- delete your account in Profile (see Delete your account), or, as a guest, delete the data on your phone;
- turn off reminders for any list, or turn off notifications, camera or photo access in your device settings;
- email glashion.studio@gmail.com for any other request. I’ll reply within 30 days at the latest.
If you’re unhappy with how your data is handled, you can complain to your local data protection authority. In Vietnam, this is the Department of Cybersecurity and High-Tech Crime Prevention (A05) of the Ministry of Public Security.
11. Children
The App is for people aged 16 and over. We don’t knowingly collect personal information from anyone younger. If you think a child under 16 has an account, email me and I’ll delete it.
12. Changes to this policy
If I change this policy in a way that matters, I’ll tell you in the App or by email before the change takes effect. The date at the top shows when it was last updated.