This Privacy Notice for Matcha Minutes (“we”, “us”, or “our”), the app published on the App Store by Mohammad Razzaq, describes how and why we might access, collect, store, use and/or share (“process”) your personal information when you use our services (“Services”), including when you:
- download and use our mobile application, Matcha Minutes, or any other application of ours that links to this Privacy Notice;
- visit our website, which links to this Privacy Notice; or
- engage with us in other related ways, such as by emailing us.
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at support@matchaminutes.com.
Summary of key points
This summary gives the key points of our Privacy Notice. You can find more detail on each topic in the numbered sections below.
What personal information do we process? Matcha Minutes does not require an account. We process limited information to manage subscriptions, analytics and advertising attribution, and when you email us. See section 1.
What stays on your device? Your session notes, the name you enter during onboarding and your answers about distractions are stored only on your device and are not uploaded by the app. Some information about how you use the app, such as session lengths and the drinks you choose, is sent to our analytics provider.
Do we process any sensitive personal information? We do not process sensitive personal information.
Do we collect any information from third parties? Yes. Apple provides purchase information and Apple Ads attribution information. Our service providers, RevenueCat and Layers, process information for us. See section 1.
How do we process your information? We process your information to provide and improve our Services, manage subscriptions, measure the effectiveness of our advertising, respond to you, keep our Services secure and comply with law. See section 2.
In what situations and with which parties do we share personal information? With our service providers, with Apple, and in the other situations described in section 4.
How do we keep your information safe? We have organisational and technical measures in place to protect your personal information, but no system is 100% secure. See section 7.
What are your rights? Depending on where you live, you may have rights over your personal information. See section 9.
How do you exercise your rights? Email us at support@matchaminutes.com. We will consider and act on any request in line with applicable data protection laws.
1. What information do we collect?
Information you provide to us
In short: We collect the information you choose to send us. The app does not ask you to create an account or register.
Support and feedback emails. If you email us, or send feedback from the app, we receive your email address, your name if your email shows it, your message and any attachments. Feedback sent from the app opens your own email app. Before you send it, it also adds the app version, iOS version, device model, whether you have Matcha Minutes Pro and how many sessions you have completed.
Sensitive information. We do not process sensitive information.
Payment data. Purchases of Matcha Minutes Pro are made through Apple’s App Store. Apple processes your payment and holds your payment details, such as card numbers and security codes. We do not receive your payment card details, your name or your Apple Account email address. We do receive purchase and subscription records, described below. Apple’s privacy policy is at apple.com/legal/privacy.
Information stored only on your device
The app stores the following on your device:
- your session history, including any notes you add;
- your Tea Leaves balance, unlocked drinks and progress; and
- your onboarding answers, including the name you enter and your answers about distractions.
Your notes, onboarding name and distraction answers are not uploaded by the app. The app has no cloud sync of its own. If you use iCloud Backup or back up your device to a computer, your device backup may include the app’s data. Apple or your computer handles those backups, and we cannot access them. Live Activities and widgets display information from the app on your device.
Information collected automatically by the app
In short: The app uses two service providers: RevenueCat for subscriptions, and Layers for analytics and advertising attribution.
Subscriptions (RevenueCat). We use RevenueCat, Inc. to manage subscriptions, check whether you have Pro and restore purchases. RevenueCat’s software generates a random customer identifier and stores it on your device. This identifier is not based on your name, email address or Apple Account. It is pseudonymous rather than anonymous, because it links your subscription records together. RevenueCat processes:
- this identifier;
- your purchase and subscription records, such as the product, transaction identifiers, dates, trial status, price and currency; and
- technical information sent with its requests, which may include your device model, operating system and app version, language and App Store country, device-level identifiers provided by Apple to app developers, and your IP address.
Analytics and advertising attribution (Layers). From version 1.0.1 of the app, we use Layers Inc. to understand how the app is used and to measure which of our adverts and promotions lead to installs, subscriptions and revenue. The app sends Layers:
- Identifiers: an installation identifier created by Layers’ software; Apple’s identifier for vendors (IDFV); the RevenueCat customer identifier; and, only if you allow tracking (see below), your device’s advertising identifier (IDFA).
- Device information: device model, operating system, app version, language, time zone, screen size and whether you allowed tracking. Layers also receives your IP address, which it may use to estimate your general location, such as your country or city.
- App activity: installs, app opens, updates, and the app moving to the background or closing.
- Usage events: sessions started and completed, with their length, drink and category; drinks unlocked; reaching a free-tier limit; paywall views; and purchases, trial starts, subscription starts and restores, with the product, price, currency, plan and transaction identifier.
- Preferences: whether you have Pro, and the daily goal, focus intention and experience with focus timers that you choose during onboarding.
- Attribution information: an Apple Ads attribution token, and details of any link you used to open the app, including advertising click identifiers.
When the app opens, Layers uses the Apple Ads attribution token to ask Apple whether the installation came from one of our Apple Ads campaigns. Where Apple provides it, the answer can include the campaign, ad group and keyword. Apple does not attribute every installation, and the keyword is the one we chose for our campaign, not your exact search. The app may also update values for Apple’s SKAdNetwork. This is Apple’s system for reporting advertising results without identifying individual users.
Tracking permission. The app asks once for Apple’s App Tracking Transparency permission.
- If you allow tracking, Layers also collects your IDFA.
- If you do not allow tracking, the IDFA is not collected, but the other information described above is still sent to Layers.
- The app works the same either way.
- You can change your choice at any time in Settings › Privacy & Security › Tracking.
Notifications. The app does not send push notifications.
The app does not show advertisements.
Information from Apple
Apple provides us with aggregated sales, download and subscription reports and Apple Ads attribution information. If you have chosen to share analytics with app developers in your device settings, Apple also provides app usage and crash statistics.
Our website
Our website is a static site hosted by Cloudflare, Inc. It does not use analytics, advertising tags, tracking pixels or cookies set by us. Cloudflare processes technical information about each request, such as your IP address, browser user-agent, the page requested and the time, in order to deliver and protect the site. Cloudflare’s security features may in some circumstances set a strictly necessary cookie. The website has no connection to the software in the app.
2. How do we process your information?
In short: We process your information to provide, improve and administer our Services, communicate with you, measure the effectiveness of our advertising, keep our Services secure and comply with law.
We process your personal information for the following purposes:
- To deliver our Services, including providing Matcha Minutes Pro, verifying purchases and restoring access.
- To respond to enquiries and offer support.
- To send you administrative information, such as replies about your subscription or changes to our terms and policies, where you have contacted us.
- To understand how our Services are used, so that we can improve them.
- To determine the effectiveness of our marketing and promotional campaigns, including measuring which adverts and promotions lead to installs, subscriptions and revenue.
- To protect our Services, including fraud monitoring and prevention.
- To comply with legal obligations, such as keeping financial records.
- To save or protect an individual’s vital interests, such as to prevent harm.
3. What legal bases do we rely on to process your information?
In short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.
If you are located in the EU or UK, this section applies to you
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases we rely on to process your personal information. We may rely on the following:
- Consent. We may process your information if you have given us permission to use it for a specific purpose, for example when you allow tracking in Apple’s prompt. You can withdraw your consent at any time (see section 9).
- Performance of a contract. We process information to provide the Services and Matcha Minutes Pro, for example subscription information processed through RevenueCat.
- Legitimate interests. We may process your information when it is reasonably necessary for our legitimate business interests, and those interests are not outweighed by your interests and fundamental rights and freedoms. For example, we may process information to:
- analyse how our Services are used so we can improve them;
- measure the effectiveness of our advertising and promotion;
- diagnose problems and prevent fraud; and
- respond to support requests.
- Legal obligations. We may process your information where necessary to comply with our legal obligations, such as cooperating with a law enforcement body or regulatory agency, exercising or defending our legal rights, or keeping financial records.
- Vital interests. We may process your information where necessary to protect your vital interests or those of a third party, such as where someone’s safety is at risk.
If you are located in Canada, this section applies to you
We may process your information if you have given us specific permission (express consent) to use it for a specific purpose, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.
In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:
- if collection is clearly in the interests of an individual and consent cannot be obtained in a timely way;
- for investigations and fraud detection and prevention;
- for business transactions, provided certain conditions are met;
- if it is contained in a witness statement and the collection is necessary to assess, process or settle an insurance claim;
- for identifying injured, ill or deceased persons and communicating with next of kin;
- if we have reasonable grounds to believe an individual has been, is or may be the victim of financial abuse;
- if it is reasonable to expect that collection with consent would compromise the availability or accuracy of the information, and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province;
- if disclosure is required to comply with a subpoena, warrant, court order or rules of the court relating to the production of records;
- if it was produced by an individual in the course of their employment, business or profession, and the collection is consistent with the purposes for which the information was produced;
- if the collection is solely for journalistic, artistic or literary purposes; and
- if the information is publicly available and is specified by the regulations.
4. When and with whom do we share your personal information?
In short: We share information with our service providers, with Apple, and in the specific situations described below.
Service providers. We share information with the following service providers, which process it to provide services to us:
- RevenueCat, Inc. manages subscriptions. RevenueCat states that it processes this information as a data processor on behalf of the apps that use it.
- Layers Inc. provides analytics and advertising attribution. Layers’ documentation states that it processes this information as a data processor on behalf of the apps that use it. Layers can also send app events, such as installs and purchases, to advertising platforms, for example Meta, so that we can measure our adverts on those platforms. This happens where we enable it for a platform. When it happens, the events can include identifiers, your IP address and, if you allowed tracking, your advertising identifier.
- Cloudflare, Inc. hosts our website.
- Our email provider stores the emails you send us.
Apple. Apple processes App Store purchases, payments and refunds, and provides Apple Ads attribution information, under its own terms and privacy policy.
Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of assets, financing or acquisition of all or part of our business.
Legal requirements. We may disclose information where required by law, or where necessary to protect our rights, the rights of others or someone’s safety.
5. Is your information transferred internationally?
In short: We may transfer, store and process your information in countries other than your own.
We are based in the United Kingdom and do not operate our own servers. Our service providers process information in other countries:
- RevenueCat states that it stores data in the United States;
- Layers states that its primary processing takes place in the United States;
- Cloudflare operates a global network, so website requests may be handled in a data centre near you; and
- Apple processes App Store information under its own privacy policy.
If you are in the European Economic Area (EEA), the United Kingdom (UK) or Switzerland, these countries may not have data protection laws as comprehensive as those in your country. Where the law requires, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum offered in our providers’ data processing terms. You can contact us for more information.
6. How long do we keep your information?
In short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice, unless otherwise required by law.
We keep personal information only for as long as it is necessary for the purposes set out in this Privacy Notice, unless the law requires or permits a longer period, for example for tax or accounting purposes. In particular:
- Information on your device remains until you delete the app, apart from any copies in your own device backups.
- Subscription records held by RevenueCat are kept while we need them to provide and restore purchases, prevent fraud and handle questions, and afterwards as long as legal, tax or accounting obligations require.
- Analytics and attribution information held by Layers is kept while we use Layers, unless we delete it sooner or you ask us to delete it.
- Support emails are kept for as long as needed to deal with your question and any follow-up.
When we have no ongoing legitimate business need to process your personal information, we will delete or anonymise it. If this is not possible, for example because it is stored in backup archives, we will securely store it and isolate it from any further processing until deletion is possible.
Deleting the app removes the app’s data from your device and stops the app sending new information. It does not delete information already held by our service providers, and it does not cancel a Matcha Minutes Pro subscription. To cancel, go to Settings › [your name] › Subscriptions, or visit apps.apple.com/account/subscriptions.
7. How do we keep your information safe?
In short: We aim to protect your personal information through a system of organisational and technical security measures.
We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process, including using encrypted connections. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. We cannot promise or guarantee that hackers, cybercriminals or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal or modify your information.
8. Do we collect information from minors?
In short: Matcha Minutes is a general-audience app and is not directed at children.
Matcha Minutes has an App Store age rating of 4+, which reflects its content. The app does not ask for your age, so the processing described in this Privacy Notice applies to everyone who uses it. Purchases require an Apple Account, and Apple’s Family Sharing and Ask to Buy features let parents control children’s purchases. If you believe a child has provided us with personal information, contact us at support@matchaminutes.com and we will take reasonable steps to delete it.
9. What are your privacy rights?
In short: Depending on where you live, such as the EEA, the UK, Switzerland, Canada or some US states, you have rights that give you greater access to and control over your personal information.
In some regions, such as the EEA, UK, Switzerland and Canada, you have certain rights under applicable data protection laws. These may include the right:
- (i) to request access to and obtain a copy of your personal information;
- (ii) to request rectification or erasure;
- (iii) to restrict the processing of your personal information;
- (iv) if applicable, to data portability; and
- (v) not to be subject to automated decision-making.
In certain circumstances, you may also have the right to object to the processing of your personal information, including processing for analytics or advertising measurement. You can make a request by contacting us at support@matchaminutes.com.
Because the app has no accounts, we may ask for information that helps us find records relating to you, such as details of a purchase. We will consider and act on any request in accordance with applicable data protection laws.
Complaints in the UK. If you are located in the UK and are unhappy with how we have handled your personal information, you can complain directly to us at support@matchaminutes.com. This is in addition to your rights under the UK GDPR and the Data Protection Act 2018. After you complain:
- we will acknowledge your complaint within 30 days of receiving it;
- we will investigate without unjustifiable or excessive delay; and
- we will keep you informed of progress and explain the outcome.
If you are not happy with our final response, you can refer your complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority:
- website: ico.org.uk/make-a-complaint;
- helpline: 0303 123 1113;
- post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or the UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing your consent. If we rely on your consent to process your personal information, you can withdraw it at any time. For the advertising identifier, change your choice in Settings › Privacy & Security › Tracking. For anything else, contact us. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. Where applicable law allows, it also does not affect processing carried out on lawful grounds other than consent.
If you have questions or comments about your privacy rights, you may email us at support@matchaminutes.com.
10. Controls for Do-Not-Track features
Most web browsers and some mobile operating systems and applications include a Do-Not-Track (“DNT”) feature or setting. You can turn it on to signal your preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.
Our website does not track visitors. In the app, Apple’s tracking setting described in section 1 controls whether the advertising identifier is collected. If a standard for online tracking is adopted that we must follow in future, we will tell you about that practice in a revised version of this Privacy Notice.
11. Do United States residents have specific privacy rights?
In short: If you are a resident of certain US states, you may have the right to:
- request access to and receive details about the personal information we maintain about you and how we have processed it;
- correct inaccuracies;
- get a copy of your personal information;
- delete your personal information;
- withdraw your consent to our processing of your personal information.
These rights may be limited in some circumstances by applicable law.
Categories of personal information we collect
The table below shows the categories of personal information we have collected in the past twelve (12) months.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Random customer and installation identifiers, IDFV, IDFA (only if you allow tracking), transaction identifiers, IP address, and your email address if you contact us | YES |
| B. Personal information as defined in the California Customer Records statute | Your name, if it appears in an email you send us | YES, only if you provide it |
| C. Protected classification characteristics under state or federal law | Gender, age, date of birth, race and ethnicity, national origin, marital status | NO |
| D. Commercial information | Purchase and subscription history | YES |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other similar network activity | App usage events, device information, links used to open the app, Apple Ads attribution information | YES |
| G. Geolocation data | Approximate location estimated from IP address; no precise device location | YES, approximate only |
| H. Audio, electronic, sensory or similar information | Images and audio, video or call recordings | NO |
| I. Professional or employment-related information | Job title, work history | NO |
| J. Education information | Student records | NO |
| K. Inferences drawn from collected personal information | Profiles of preferences and characteristics | NO |
| L. Sensitive personal information | — | NO |
We also collect the onboarding preferences you choose, such as your daily goal and focus intention, as part of category F.
We use and retain personal information as needed to provide the Services, and as described in section 6.
Sources of personal information. See section 1. We collect information from you, from your device through the app, from Apple, and through our service providers RevenueCat and Layers.
How we use and share personal information. See sections 2 and 4. We collect personal information through software development kits (SDKs) in the app, as described in section 1.
Will your information be shared with anyone else? We disclose personal information to our service providers under written terms, as described in section 4. In the past twelve (12) months, we have disclosed the following categories of personal information to third parties for a business or commercial purpose:
- Category A. Identifiers
- Category B. Personal information as defined in the California Customer Records statute
- Category D. Commercial information
- Category F. Internet or other electronic network activity information
- Category G. Geolocation data (approximate)
We do not sell personal information for money. Some US state laws treat certain disclosures for advertising as “selling” or “sharing” personal information, or as “targeted advertising”, even when no money changes hands. This can include disclosing app events and identifiers to an analytics and attribution provider, or through it to advertising platforms, to measure our advertising. To the extent our use of Layers (section 4) falls within those definitions, the categories involved are A, D, F and G, and the third parties are data analytics services and, where enabled, advertising platforms. You can opt out by emailing us (see below).
Your rights
You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law. These rights include:
- the right to know whether or not we are processing your personal data;
- the right to access your personal data;
- the right to correct inaccuracies in your personal data;
- the right to request the deletion of your personal data;
- the right to obtain a copy of the personal data you previously shared with us;
- the right to non-discrimination for exercising your rights; and
- the right to opt out of the processing of your personal data if it is used for targeted advertising (or “sharing” as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).
Depending on the state where you live, you may also have the following rights:
- the right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota);
- the right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware and Maryland);
- the right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon);
- the right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut);
- the right to review, understand, question and, depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota);
- the right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California); and
- the right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida).
How to exercise your rights
To exercise these rights, including the right to opt out, email us at support@matchaminutes.com. You can also stop the app collecting your advertising identifier by declining tracking in Settings › Privacy & Security › Tracking. Declining tracking does not stop other app analytics. You can stop all collection by the app by deleting it.
Under certain US state data protection laws, you can designate an authorised agent to make a request on your behalf. We may deny a request from an authorised agent that does not submit proof that they have been validly authorised to act on your behalf in accordance with applicable laws.
Request verification
When we receive your request, we will need to verify your identity to confirm you are the person whose information is in our systems. We will only use personal information provided in your request to verify your identity or authority to make the request. If we cannot verify your identity from the information we already hold, we may ask you for more information for verification and for security or fraud-prevention purposes.
If you make the request through an authorised agent, we may need to collect additional information to verify your identity before processing it. The agent will need to provide written, signed permission from you to make the request on your behalf.
Appeals
Under certain US state data protection laws, if we decline to act on your request, you may appeal our decision by emailing us at support@matchaminutes.com. We will tell you in writing what action we have or have not taken in response to the appeal, and explain why. If your appeal is denied, you may submit a complaint to your state attorney general.
California “Shine the Light” law
California Civil Code Section 1798.83, also known as the “Shine the Light” law, lets California residents who use our Services request information from us once a year, free of charge. That information covers the categories of personal information (if any) we disclosed to third parties for direct marketing purposes, and the names and addresses of all third parties with which we shared personal information in the previous calendar year. We do not disclose personal information to third parties for their own direct marketing purposes. If you are a California resident and would like to make a request, contact us using the details in section 13.
12. Do we make updates to this notice?
In short: Yes, we will update this notice as necessary to stay compliant with relevant laws and to reflect changes to our Services.
We may update this Privacy Notice from time to time, for example when we add or remove a service provider. The updated version will be indicated by an updated “Last updated” date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of the changes or by sending you a notification directly. We encourage you to review this Privacy Notice frequently to stay informed about how we protect your information.
13. How can you contact us about this notice?
If you have questions or comments about this notice, you may email us at support@matchaminutes.com.
Matcha Minutes, United Kingdom
14. How can you review, update or delete the data we collect from you?
Depending on the laws of your country, or your state if you live in the US, you may have the right to:
- request access to the personal information we collect from you and details about how we have processed it;
- correct inaccuracies; or
- delete your personal information.
You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.
To request to review, update or delete your personal information, email us at support@matchaminutes.com. Information stored only on your device never reaches us, so you can delete it yourself by deleting the app.