What Ward knows about you.

Effective [launch date] · Last updated [launch date]

1. Who we are
2. On your device
3. Your account and sync
4. Emails
5. Payments and Kickstarter
6. This website
7. Who we share with
8. How long we keep it
9. Your choices and rights
10. Security
11. Children
12. Changes and contact

1. Who we are

Ward is made by [legal company name], [mailing address] ("Ward", "we", "us"). This policy covers the Ward apps for macOS, Windows and Linux, the iPhone and Android apps when they arrive, and this website.

2. What happens on your device

Ward blocks the sites you choose by checking where your device is connecting. That check happens on your device. To decide whether to block something, Ward looks at the address you're connecting to, not at what's on the page.

• Unblocked sites. Ward doesn't read the content of unblocked websites or keep a history of those visits. Encrypted traffic to sites you haven't blocked passes through without being decrypted.
• The security certificate. On a computer, Ward installs its own security certificate so it can show you the wall instead of a broken page. The certificate stays on your device. Uninstalling Ward removes it from the places Ward installed it. Turning Ward off does not remove it.
• Your blocked moments. When the wall appears, Ward records it so it can keep your streak and your ledger of the times you walked away. The ledger keeps dates and counts only, never the site or the category. [CONFIRM with Colton: each record holds the time and the outcome only (walked away or slipped), never the category or the address]
• Your settings. The categories you block, any sites you name or allow, any blocking schedule, and any hard block. [CONFIRM: which settings sync and which stay on the device]
• The hotlines. Ward doesn't see or keep which hotline you call or open.

[CONFIRM: does the app send crash reports or diagnostics? If so: what's in them, whether they're optional, and the provider]

3. Your account and sync

Ward needs an account, including on Free: your email address and a password. It's how your streak syncs across your devices and how we email you a PIN reset. We hold:

• your email address and your password [CONFIRM: password stored only as a secure hash];
• your streak: the count and when it started, so every device shows the same streak.

That's all we hold on Free. If you have Premium, we also hold what Premium and giving need: your plan (Monthly, Yearly or Lifetime), its status and renewal date (Lifetime has none), whether giving is on, and the charity you chose.

This data is stored with [hosting provider] in [region], in a database that's encrypted in transit and at rest, including backups. Each account's data is walled off from every other account's at the database level.

4. Emails

When you click download on this website, we ask for your email address. We keep it to send you your download link and to tell you when Ward launches. We delete it if you ask. We email you about your account (sign-in, security, billing). We don't send marketing email unless you've asked for it, and every marketing email has a one-click unsubscribe. Emails are delivered by [email provider].

5. Payments and Kickstarter

Kickstarter. If you back Ward on Kickstarter, Kickstarter handles your pledge and payment under its own privacy policy. Kickstarter shares with us what we need to deliver your reward, such as your name, email address and the reward you chose.

On this website. When Premium opens here, payments are processed by Stripe under its privacy policy. We never see or store your full card number. We receive your plan, payment status, and the last four digits and expiry of your card so you can recognize it.

Giving. Ward gives to the charity you chose ($2 a month on Monthly, $15 a year on Yearly, $50 once on Lifetime), pooled with other members' gifts and given quarterly on every plan. The $15 from a Yearly plan and the $50 from Lifetime are given in the next quarterly round after purchase. We don't tell the charity who you are.

6. This website

This website sets no cookies and runs no analytics, ads or trackers. Its fonts are served from our own server, so loading a page doesn't contact anyone else. Like any web server, ours records basic request logs (IP address, browser type, the page requested and the time) to keep the site running and secure. [CONFIRM: host, and how long logs are kept]

7. Who we share with

We never sell your data, and we don't share it for advertising. We share it only:

• with the companies that run parts of Ward for us (hosting, email delivery, payments), and only what each needs to do that job: [list providers];
• if the law requires it, and we'll tell you when we're allowed to;
• if Ward is sold or merged, in which case this policy's promises go with your data, and we'll tell you first.

8. How long we keep it

We keep your account data while your account is open. When you delete your account, we delete its data from our live systems within [30] days, and it ages out of our backups within [90] days. We may keep billing records for as long as tax law requires.

9. Your choices and rights

• See your data, or ask us for a copy.
• Correct your account details.
• Delete your account and its data. In Settings, "Delete my account" removes your email, your synced streak and any Premium plan. Like other loosening actions it waits 24 hours, then Ward asks "Are you sure?". "Wipe everything" is separate: it erases what Ward keeps on this computer (your record, reason, plan and settings) and doesn't delete your account.
• Turn off any marketing email.

Depending on where you live (for example California, or the EU and UK), the law may give you further rights, including to object to or restrict how we use your data and to complain to a data protection authority. We honour these requests for everyone, wherever you live. Write to [privacy email] and we'll answer within 30 days. We won't treat you differently for using your rights.

If you're in the EU or UK: we use your data to provide the service you asked for (contract), to keep it secure (legitimate interests), and to meet legal duties. Your data may be processed in the United States.

10. Security

Data is encrypted in transit and at rest, access to it is limited to the people who need it to run Ward, and each account's data is isolated from every other's. No system is perfectly secure; if a breach ever affects your data, we'll tell you promptly.

11. Children

Ward isn't directed to children under 13, and we don't knowingly collect data from them. If you think a child under 13 has given us data, write to [privacy email] and we'll delete it. [CONFIRM with a lawyer (KD-11): wording for child profiles. A parent sets one up from their own account; we collect no email, password or age for the child, only a first name. A child's request to a parent names the site until the parent answers or 7 days pass.]

12. Changes and contact

If we change this policy, we'll update the date above. If a change is significant, we'll tell you by email or in the app before it takes effect.

Questions, requests or worries: [privacy email], or [mailing address].