You give us an email address and the words you put into an agreement. We use them to run In Writing. Each agreement has its own 256-bit encryption key, analytics uses a random installation ID, and the sections below map where each piece of information goes.
WHO WE ARE + WHERE THIS APPLIES
0plus1 operates In Writing (“In Writing”, “we”, “us” or “our”). This policy applies to the In Writing mobile apps, website, APIs, emails and related services (together, the “Service”).
Send questions, access requests and privacy complaints to [email protected].
THE INFORMATION IN WRITING HANDLES
Your account
We collect your email address, an optional display name, email-verification status and account timestamps.
Your agreements
We store agreement wording, revisions, responses, party roles, invitation and status information, timestamps, final record numbers and cryptographic fingerprints. Each agreement links the participating accounts and gives both parties access to the shared record.
Purchases
Apple or Google handles your payment details. We and RevenueCat receive purchase and entitlement metadata such as the product, store, transaction status, purchase and expiry times, refund or cancellation status, and a random billing identifier linked to your In Writing account. We never receive your full card or bank details.
Sign-in + support
We process one-time email codes, device names attached to login tokens and the information you include when contacting us. Raw codes and bearer tokens stay within the authentication flow.
Your device + connection
Our servers process IP addresses, request details, device information and security logs to deliver and protect the Service. The app places its login token in platform secure storage. A local SQLite copy keeps your agreements ready for offline reading.
Product analytics + errors
Rybbit Cloud receives screen views, app lifecycle events, feature interactions, language, screen size, app version, diagnostic error messages and stack traces. Its mobile SDK assigns a random identifier to each app installation. We generalise agreement routes before sending events.
The analytics feed contains product events and coarse device data. Your email address, name, agreement wording, invitation credential, public agreement ID, record number, contacts, precise location, photos, camera and microphone stay outside that feed. Purchase-flow events exclude customer, transaction, email and agreement identifiers. Product analytics uses its random installation identifier in place of Apple and Android advertising identifiers. Our analytics setup covers product behaviour and errors, with advertising profiles and session replay outside its scope.
HOW WE USE IT
- create and authenticate your account;
- create, share, revise, respond to and preserve agreements;
- sync agreements to your devices and provide offline access;
- verify purchases, restore access and enforce the free creation limit;
- send requested sign-in and service emails;
- prevent abuse, investigate failures and protect the Service;
- understand feature use and improve reliability; and
- meet legal obligations and enforce our Terms.
Your personal information supports your account, agreements and the operation of In Writing. We keep it within that service relationship and the providers listed below. Agreement wording stays inside agreement delivery, security and support. Advertising, data brokerage and generative-AI model training sit outside its purpose.
WHO RECEIVES IT
These recipients receive information for the purposes listed:
- the other agreement party receives the agreement, its history, responses and party details;
- service providers supply hosting, databases, backups, transactional email, security and analytics, including Rybbit Cloud;
- RevenueCat receives billing identifiers and store purchase metadata to verify purchases and maintain Premium access;
- Apple and Google handle app-store purchases, payment details, cancellations and refunds under their own terms and privacy policies;
- authorities or advisers receive information when law, rights protection or a security response requires it; and
- a business successor may receive information during a merger, financing, reorganisation or sale, subject to appropriate confidentiality and this policy.
Providers process information in Australia and the countries where they operate. Rybbit states that its cloud analytics infrastructure is hosted in Germany. RevenueCat and the app stores may process purchase metadata in the countries where their infrastructure and staff operate. The privacy laws of those countries apply to processing that takes place there.
AGREEMENT-BY-AGREEMENT ENCRYPTION
Each agreement receives its own random 256-bit data key before the Service stores any wording. The Service encrypts every draft, revision and final version with authenticated AES-256-GCM encryption. Each encrypted payload includes its agreement ID and version number, allowing the Service to verify the exact context during decryption.
A separate deployment master key wraps each agreement key. The agreement database holds encrypted wording and wrapped data keys. The deployment master key lives in application secret storage, apart from the agreement database and its ordinary backups. Master-key rotation rewraps the per-agreement keys while the agreement ciphertext, wording fingerprints and record history stay unchanged. HTTPS protects connections to the production Service.
An authenticated request from an authorised party activates the decryption path for the requested wording. The running application retrieves the key material, verifies the agreement and version context, and returns the wording to that party. An operator holding both application-runtime access and the deployment secret can use the same path. This architecture is server-side envelope encryption with authorised application access.
A signed invitation link acts as a private credential until someone claims it. Send it to the person joining the agreement.
HOW LONG WE KEEP IT
Agreements serve as durable shared records. We retain account and agreement information while the account and Service remain active. Longer periods apply when we need to preserve another party’s shared record, resolve a dispute, prevent abuse, enforce an agreement or comply with law.
Purchase and entitlement records remain while needed to provide paid access, handle refunds and disputes, prevent fraud, keep an audit trail and meet tax, accounting or other legal duties. A daily cleanup removes expired and consumed app sign-in codes. App access tokens stay active until logout, revocation or account action. Operational schedules set the lifespan of logs and backups before overwrite or deletion. Rybbit keeps analytics for the period set by our account plan and configuration.
Request deletion from Settings in the app, or email [email protected] from your account address if you cannot access the app. We verify the request and map the records covered by it. A shared final record may remain available to the other party where law permits or requires retention; we can remove or de-identify your account details around that record. Removing the app clears its local app data. A verified account-deletion request starts the server-record process.
YOUR CHOICES + RIGHTS
Settings lets you update your display name, export your agreements and current-device drafts, and submit or cancel an account-deletion request. Signing out revokes the current device token. You can ask us to access, correct, export or delete personal information associated with your account, and you can object to or ask about particular processing. Your location determines the rights and lawful exceptions that apply.
Send requests or complaints to [email protected]. Include your account email and enough detail for us to identify the records involved. Keep sign-in codes inside the app’s authentication flow. We acknowledge privacy complaints and respond after verifying identity.
AGE
In Writing serves people aged 16 and over. Contact us if a child has supplied personal information so we can investigate and take the appropriate action.
POLICY UPDATES
We update this policy as the Service, providers and law change. The effective date above shows the current version. A change that affects how we use personal information will receive additional notice.