Who we are
BondBook ("we", "us") is the controller of the personal data described here, which means we're responsible for it under the UK General Data Protection Regulation, the EU General Data Protection Regulation and the UK Data Protection Act 2018.
For anything about your data or your privacy, email us at hello@bondbook.app.
The short version
Your data belongs to you. We store and process it in the cloud, on our servers and through a small number of third-party providers, only to run BondBook for you. We don't sell it, use it for advertising, or use it to train AI models. The app has no advertising, tracking or analytics tools.
What we hold
- About you: your name, email address, a securely hashed version of your password, your settings, whether you've agreed to AI features, and the devices you're signed in on: for each, a label such as "iPhone 16 · iOS 18.2" and when it signed in and was last used.
- What you add: contacts and their details, notes, photos, events, reminders, and your chats with Bond. This includes information about other people that you choose to record. BondBook isn't meant for sensitive details, such as someone's health, beliefs or sex life: Bond doesn't add them to profiles, and says when it has left one out.
- What you import: if you import contacts from your iPhone or a file such as a LinkedIn export, we store only the people you choose. Nobody is chosen until you pick them, their photos aren't copied, and an address is kept only as town and country. We ask for permission first, we only read contacts, and we never read your email or calendar.
- Technical data: our servers log the time of each request and which part of BondBook it reached, never what was in it and never your network address. Those logs are deleted after 30 days. To slow down repeated sign-in attempts, the server keeps the network address of recent sign-in requests in memory only, never on disk. We don't use cookies in the app, and our website pages don't set any.
- On your phone: BondBook keeps a copy of your data on your iPhone so it works offline, and schedules your reminders there. That copy is left out of iCloud and computer backups, and deleted when you sign out. Reminders on the Lock Screen show no names unless you choose Show Details. If you dictate a message, your voice is turned into text by Apple's speech recognition, on your device where it supports that.
Why we use it, and our legal basis
To provide BondBook: creating your account, storing and syncing your data, showing your photos, importing contacts, sending reminders, and emails such as confirming your address or resetting your password. Our legal basis is that this is necessary to perform our agreement with you.
For AI features: sending the information each feature needs to our AI provider. Our legal basis is your consent, which you can withdraw at any time by turning AI features off in More.
To keep BondBook secure and working: preventing abuse, limiting AI use, fixing faults and keeping backups. Our legal basis is our legitimate interest in running a safe, reliable service. You can object to this; see Your rights below.
To meet legal obligations: for example, responding to lawful requests from authorities. Our legal basis is that we have a legal obligation to do so.
Information about other people
The people you record in BondBook don't use it themselves. You decide what to record about them and why, and we store and process that information on your behalf, only to provide BondBook to you. We never contact them or use their details for anything else, and other users can't see them.
If you're someone whose details may be in BondBook and you want to exercise your rights, contact us. Because we can't see who recorded what, we may need to refer you to the person who added your details.
Who processes it for us
We use these providers, each under a contract that requires them to protect your data and use it only on our instructions:
- Hetzner Online GmbH (Germany): hosts our servers and database in Finland, in the EU. All your data is stored there.
- Anthropic PBC (United States): provides the AI that powers AI features, only when you've turned them on. Anthropic doesn't use our requests to train its models, and keeps them only for a limited time for safety and abuse monitoring.
- Postmark, by ActiveCampaign (United States): sends account emails: codes to confirm your address or reset your password, a notice when your password changes, and the date and receipt when you delete your account. It receives your email address and the message, keeps them for 45 days, and we've turned off its tracking of opens and links.
- Apple (United States): distributes the app, and provides speech recognition when you dictate, on your device where possible.
We may also disclose data if the law requires it, or to a company that takes over BondBook, which would have to keep protecting it as described here.
International transfers
Your data is stored in the EU. When AI features are on, or when we send you an email, some of it is processed in the United States. These transfers are protected by the providers' data processing terms, using the European Commission's Standard Contractual Clauses with the UK addendum, or the EU-US Data Privacy Framework and its UK extension where the provider is certified. Contact us for more details.
How long we keep it
Nothing lingers.
Anything that isn't your own record has an end date.
1 dayUnsaved note readings
14 daysBackups
30 daysServer logs, undo copies, meeting briefs, a deleted account
90 daysChat with Bond, an unused sign-in
0306090 days
We keep your data while you have an account. When you ask to delete your account, every device is signed out, and 30 days later everything in it is removed from our live systems; until then you can sign in and keep it, and we email you a receipt once it's done. When you delete a contact or note, it's removed straight away too, along with Bond's chat replies that showed it. A few things are kept only for a while: your chat with Bond for 90 days, copies kept so a change can be undone for 30 days, meeting briefs for 30 days, and what Bond read in a note before you saved it for a day at most. Copies in our nightly backups are deleted 14 days after they're made.
A record that an account was deleted, with its dates and no name, is kept for 12 months, so restoring a backup can't bring the account back. Server logs are rotated and overwritten automatically, usually within a few weeks. Sign-ins end 90 days after you last use them, and a year after signing in at the latest. Email confirmation codes expire after an hour, and password recovery codes after 15 minutes.
Turning AI features off deletes saved meeting briefs, gift suggestions and check-ins. Anything already filed into a profile stays until you edit it.
Your rights
You have the right to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to how we use it, and withdraw consent at any time without affecting what we did before. Many of these you can do yourself in More: edit your details, export all your data, turn AI features off, sign out your other devices, or delete your account.
For anything else, email hello@bondbook.app. We'll reply within one month, and we may need to confirm it's you first.
You can also complain to the UK Information Commissioner's Office (ico.org.uk). If you live in the EU, you can complain to the data protection authority where you live. We'd appreciate the chance to put things right first.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. AI features only make suggestions for you to review.
Security
We protect your data with encrypted connections, hashed passwords, encrypted backups, and limited access to our servers. You can see every device signed in to your account and sign any of them out, and we email you whenever your password changes. No system is completely secure, so please use a strong password that you don't use anywhere else.
If a breach puts your data at risk, we'll tell the regulator and, where the risk is high, tell you without undue delay.
Children
BondBook isn't meant for anyone under 16, and we don't knowingly create accounts for them. If you think a child has signed up, contact us and we'll delete the account.
Changes to this policy
If we change this policy in an important way, we'll tell you in the app before the change takes effect.
