App Privacy Policy

At 1 in 3 Women, we understand that the information you choose to record can be deeply personal, sensitive, and sometimes difficult to revisit.
This Privacy Policy explains how 1 in 3 Women CIC (“we”, “us”, “our”) collects, uses, and protects your personal data when you use the Third app.

We are the data controller, which means we are responsible for deciding how your personal data is used.
We have designed the Third app to prioritise your privacy and safety.
We only process your data where it is necessary to provide the service, and we do not use your information for advertising or sell it to third parties.

We work with trusted technology providers who support the operation of the Third app under strict safeguards.

This policy sits alongside any in-app guidance on using the Third app safely.

It is important to consider your personal safety when using the Third app.
Please only use the app when it is safe for you to do so, particularly if someone else may have access to your device.

Website usage information
When you visit our website, we may process limited technical information necessary to operate the site securely, such as:

· IP address
· Browser type
· Device information
· Server logs

We do not use advertising cookies or tracking cookies on our website.

If you contact us through the website (for example by email or a contact form), we will process the information you provide in order to respond to your enquiry.

App usage information
We only collect the information needed to provide the Third app safely and effectively, and to improve the service, including where appropriate, understanding broader patterns of use.

This may include:

• Information you choose to provide

• Written entries and incident records

• Images or attachments you upload

• Responses to questions within the app (such as yes/no answers or selected categories)

Some of this information may be particularly sensitive, depending on what you choose to record.

This may include information that is considered “special category data” under data protection law (for example, information relating to health, sexual life, or experiences of abuse), depending on what you choose to record.

Account information

• A system-generated user ID created when you set up your account

• You do not need to provide your real name to use the Third app.

• If you choose to enable account recovery, we may also process:

  • An email address, stored in a protected form and not visible in plain text

Account recovery

• If you choose to enable account recovery using an email address, we store encrypted recovery data that allows your account to be restored on a new device.

• During recovery, the app uses your email address to help recreate your encryption credentials on your device. These credentials are then used to decrypt your previously stored records.

• The recovery data stored on our servers is encrypted and cannot be used by us to access your records.

Technical and usage information

To keep the app secure and functioning properly, we may process limited technical

information such as:

• Device type and operating system

• App usage and activity (for example, timestamps or system events)

• Authentication and session data

How the data is linked

By design, different types of data are linked using a system-generated user ID rather than directly identifying information.

The most sensitive information you record (such as logs and images) is protected using end-to-end encryption and cannot be accessed by us.

We use your data to provide, maintain and improve the Third app, and to comply with applicable data protection laws.

In practice, we use your data to:

Provide and operate the app

• To create and manage your account

• To enable you to record, store, and access your information

• To allow you to export or share your records if you choose to

Maintain safety and security

• To keep the app secure and protect against unauthorised access

• To maintain the security and integrity of the app

• To ensure the app functions reliably

Improve the Third app

• To understand how the app is used

• To identify patterns using limited structured data as described above

• To improve features, usability and overall experience

Communicate with you

• To respond if you contact us

• To support account access or recovery (if enabled)

• Where possible, we may contact you to provide important updates about your account, including where your data may be at risk of deletion due to inactivity

Comply with legal obligations

• Where we are required to process or disclose data to comply with applicable laws

Legal basis for processing
We process your personal data under the following legal bases:

• Contract: where processing is necessary to provide the Third app and its features

• Legitimate interests: to improve and maintain the app, provided these interests do not override your rights

• Legal obligation: where we are required to comply with applicable law

• Consent: where you choose to provide optional information (such as surveys or communications)

Where you choose to record particularly sensitive information, this is processed because it is necessary for you to use the app’s core features, and appropriate safeguards (including encryption) are in place to protect it.

We use limited information to help us understand patterns and improve the Third app.

This may include structured information such as:

• Yes/no responses

• Selected categories (for example, relationship types or context)

• General usage information

We use this information in a carefully controlled and aggregated way to better understand common experiences and improve the support and tools we provide. This information is linked to your account using a system-generated ID rather than directly identifying information.

What this means in practice

• We focus on overall patterns, not individual users

• We do not use this information to identify individuals

• We do not use your data for advertising or profiling

• This information is not used to make decisions about you as an individual

Your personal records remain private

The information you record in your logs and any images you upload remain private and are not accessed by us.

This means:

• We cannot access or read this content in normal operation

• We have designed the Third app so that even we cannot access your most sensitive information

• It is not used for analysis or research

• It remains private to you unless you choose to share it

How we approach this responsibly

We are careful to:

• Limit the data we use to what is necessary

• Avoid combining information in ways that could identify someone

• Keep access to this data restricted

Our aim is to learn at a collective level, while keeping individual experiences private.

From time to time, we may invite you to take part in optional questions or surveys within the app to help us better understand patterns and improve the Third app. Taking part is entirely voluntary. You can choose whether or not to respond, and your experience of the app will not be affected if you choose not to.

How this data is used

If you choose to take part:

• Your responses may be used to help us understand broader patterns and improve our services

• We will explain how the information will be used at the point you are asked

• We use this information in a carefully controlled way, typically in aggregated form

These questions are separate from your personal records:
The information you record in your logs and any images you upload:

• Are protected using end-to-end encryption

• Are not accessed by us

• Are not used for research or analysis

We have designed the Third app to keep your information as private and secure as possible.

End-to-end encryption for your personal records
The information you record in your logs, as well as any images you upload, is protected using end-to-end encryption.

This means:

• Your information is encrypted before it leaves your device

• It remains encrypted when stored on our servers

• Only you hold the key needed to access it

We cannot access or read this content. This is a fundamental part of how the Third app is designed.

In simple terms: your personal records are for you, and are designed to stay that way.

Separation of data
Different types of data are stored separately.
Your most sensitive information (such as logs and images) is encrypted and stored in a way that makes it inaccessible to us.

Other limited information needed to operate the app (such as structured responses or timestamps) is stored separately and used in a controlled way.

Minimising identifiable information
You do not need to provide your real name to use the Third app.

Accounts are created using system-generated IDs, helping to keep your information anonymous.

If you choose to provide an email address for account recovery, it is stored in a protected form and not visible in plain text.

Secure systems and access controls
We use appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit and at rest

• Secure infrastructure hosted in the UK

• Strict access controls and authentication

• Monitoring and logging of system access

Access to data is limited to authorised personnel and only where necessary.

We do not sell your personal data or share it for advertising purposes. We do not share your personal data with third parties for their own use. Where we work with service providers, they act as data processors on our behalf and are not permitted to use your data for their own purposes.

We only share data where it is necessary to provide the service or where we are required to do so by law.

Service providers
We work with trusted technology providers who help us operate the Third app.

This includes Third Technologies Ltd, who support the development and technical operation of the app and may process limited data on our behalf.

Legal requirements
We may disclose data where required to do so by law, for example in response to a valid legal request.

Where this happens, we will only share what we are legally required to provide.

Due to the way the Third app is designed, some information (such as encrypted logs and images) cannot be accessed or disclosed by us.

In all cases, these providers:

• Only process data under our instructions

• Are subject to strict contractual safeguards

• Do not use data for their own purposes

We may also use other service providers (such as hosting or technical support tools) who process data on our behalf under similar safeguards.

If you download the Third app through an app store (such as Apple App Store or Google Play), those platforms may process your data under their own privacy policies.

How long we keep your data
We keep your data only for as long as necessary to provide the Third app and its features, and while your account remains active.

Your control over your data
You remain in control of your information:

• You can choose what to keep, export, or remove

• You can delete individual records within the app (where this feature is available)

• You can request deletion of your account within the app. When your account is deleted, all associated data is permanently removed from our active systems. This action cannot be undone.

Account data
Your data is kept for as long as your account is active, unless you choose to delete it earlier.

Data export
When you choose to export your records, we generate a file (such as a PDF) for you to download.

This file is stored temporarily on our servers for a limited time to allow you to access it. It is automatically deleted after the download link expires.

Any keys required to generate this file are held only for the time needed to create the export and are not retained afterwards.

This process is designed so that your data remains protected throughout.

Backups and technical retention

When data is deleted, we take steps to remove it from our systems.

In some cases, it may remain in secure backups for a limited period before being permanently deleted as part of our regular back up cycles.

Inactive accounts
We consider an account inactive where there has been no meaningful activity (such as logging an incident, viewing your records, reviewing content within the app or updating settings) for a continuous period of 18 months.

If an account remains inactive for 18 months, we will permanently delete the associated data from our active systems.

Where you have provided an email address and agreed to receive communications, we will aim to send reminders before deletion. If we are unable to contact you (for example, if you are using a passphrase-only account), we may not be able to provide advance notice.

Important to understand:

Because the Third app uses end-to-end encryption:

• You are responsible for maintaining access to your records

• If you lose access to your device or recovery method, we will not be able to restore your data

If you choose to use the Third app without providing an email address, we will not have a way to contact you about your account, including in relation to inactivity or data deletion.

We store and process your data primarily in the United Kingdom and the European Economic Area (EEA).

Where we work with service providers that may process data outside of the UK or the EEA, we ensure that appropriate safeguards are in place to protect your information. This may include the use of approved contractual protections.

We use DigitalOcean to host our infrastructure, which is configured within the UK and EEA.
We also use Postmark to send transactional emails (such as verification or recovery codes).

This may involve processing data outside the UK/EEA depending on how the service operates, and appropriate safeguards are in place.

We take steps to ensure that your data remains protected to a standard consistent with UK data protection law.

Under data protection law, you have rights over your personal data.

These include the right to:

• Access the data we hold about you

• Request correction of inaccurate or incomplete information

• Request deletion of your data

• Restrict or object to certain types of processing

• Withdraw consent where processing is based on your consent.

• Request a copy of your data in a portable format

How to exercise your rights
If you would like to exercise any of these rights, you can contact us at: support@thirdapp.co

We will respond in line with applicable data protection laws.

Use by children
The Third app is not intended for use by children under the age of 18, and we do not knowingly collect personal data from children.

If we become aware that personal data has been provided by a child, we will take steps to delete it.

Things to be aware of

Because the Third app uses end-to-end encryption:

• Some of your data (such as your logs and images) is not accessible to us.

• This means we may not be able to provide or modify this information on your behalf

You remain in control of this data within the app.

Making a complaint
If you have concerns about how your data is handled, you have the right to raise a complaint with the Information Commissioner’s Office (www.ico.org.uk/concerns/).

If you have any questions about this Privacy Policy or how your data is handled, you can contact us at: support@thirdapp.co

We may update this Privacy Policy from time to time.

If we make significant changes, we will take appropriate steps to inform you, for example through the app or, where possible, by email if you have provided one.