Privacy Policy

Last updated 30 August 2026

The rest of this page is the detail behind those five points. It's written to be read, not to be survived.

Who we are

Spoondraw is made by Rhys Trevethan, a sole trader based in Australia, trading as Spoondraw. For anything in this policy, including any request about your information, the contact is [email protected].

This policy covers both the Spoondraw website at spoondraw.app and the Spoondraw iPhone app. Where the two differ, it says so.

The website

Visiting spoondraw.app

There is no analytics on this website. No Google Analytics, no tracking pixels, no advertising tags, no session recording, and no cookies set by us. The site loads no third-party fonts and no third-party scripts, so simply reading these pages doesn't tell anybody anything.

The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes the technical information needed to deliver a page to you — your IP address and browser type — and keeps short-term security and abuse logs. We don't have access to an analytics view of those logs, and we don't use them to build any picture of who visits.

The waitlist

If you enter your email address to hear when Spoondraw launches, that address is stored by Kit (formerly ConvertKit), an email service based in the United States, on our behalf. Joining the waitlist is entirely optional and nothing else on the site depends on it.

• What's stored: your email address, the date you signed up, and whether you've opened or clicked our emails. That's it — we don't ask for your name and we don't ask why you're interested.
• What it's used for: telling you when Spoondraw is available to try, and occasionally when something significant changes. Nothing else. We won't pass your address to anybody, and we won't use it to advertise anything that isn't Spoondraw.
• Where it goes: because Kit is based in the United States, your address is stored outside Australia.
• Getting out: every email has an unsubscribe link that works immediately. You can also email us and we'll delete your address entirely rather than just marking it unsubscribed.

The app

Your tasks stay on your phone

Everything you enter into Spoondraw — task names, what they cost you, which ones matter most, what you got done — is stored on your device. It is not uploaded to us. We operate no server that receives it, so there is no copy of your task list for us to read, lose, hand over or be breached out of.

We are deliberate about this because of what a task list looks like for the people Spoondraw is built for. "Take meds." "Call the psychiatrist." "Shower." That is health information about your own life, and the safest way to handle it is not to have it.

iCloud sync

Spoondraw can sync your tasks between your own Apple devices. That runs through your iCloud account using Apple's CloudKit, in a private database only you can reach. We cannot see the contents, and no data passes through us. Apple's handling of it is covered by Apple's Privacy Policy. If you'd rather it stayed on one device, turn iCloud off for Spoondraw in your iOS settings.

Anonymous usage analytics

The app records how it is being used, so we can see which parts work and which parts quietly don't. This runs on PostHog, configured to store data in the European Union.

What is recorded: which screens you open, actions like starting a day or swapping a task out, how many spoons a day was set to, how many tasks were completed, roughly when in the day things happen, plus your app version, iOS version and device model.

What is never recorded, under any circumstances:

• Task names, notes, or any other text you have typed about your own life.
• Your name, email address, phone number or contacts.
• Your precise location.
• Screen recordings or session replays. This feature is switched off and stays off, because it would capture your task names by definition.

The data isn't tied to your identity — there's no account for it to be tied to. It is grouped under a random identifier for that installation, which disappears when you delete the app.

You can turn it off. It's a single switch in Spoondraw's Settings, we tell you about it during onboarding rather than burying it, and nothing in the app stops working or nags you if you use it.

When you send feedback

Spoondraw has a feedback option in Settings. If you use it, we receive the category you picked, whatever you chose to write in the message box, your app and iOS version, and your email address only if you fill in that optional field — it's there so we can reply, and leaving it blank is a perfectly normal thing to do.

Your task names are never attached to feedback, not even as debugging context.

Subscriptions and payment

Spoondraw is sold as a subscription through the App Store. Apple handles the payment, and we never see your card details — not the number, not the expiry, not your billing address. What we get from Apple is whether a subscription is currently active, which is what unlocks the app. Apple also provides aggregate sales reports that don't identify individual buyers.

What we don't do

• We don't sell or rent your information. There's no scenario in which we would.
• There is no advertising in Spoondraw, and no advertising SDK in the app.
• We don't track you across other apps or websites, and the app doesn't ask for permission to, because it has no use for it.
• We don't build profiles of users, and we don't attempt to work out anybody's health condition, diagnosis or disability.

How long things are kept

• Your tasks: for as long as you keep them, on your device. Deleting the app deletes them.
• Usage analytics: retained for up to 12 months, then deleted.
• Feedback messages: kept while we're acting on them, and cleared out once they're resolved or clearly stale.
• Waitlist addresses: until you unsubscribe, or until the waitlist has served its purpose and we close it — whichever comes first.

Your rights

Wherever you are, you can email [email protected] and ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted. We'll respond within 30 days, and we won't charge you for it.

Realistically, for most people the answer is "an email address on a waitlist, and some anonymous counters" — but you're entitled to ask, and we'd rather you did.

If you are in the European Economic Area or the United Kingdom, the GDPR gives you rights of access, correction, erasure, restriction, portability and objection, and a right to complain to your national data protection authority. Our lawful basis is legitimate interests for anonymous product analytics, and consent for the waitlist — which you can withdraw at any time by unsubscribing.

If you are in Australia and you're unhappy with how we've handled a privacy matter, you can raise it with the Office of the Australian Information Commissioner.

Children

Spoondraw isn't designed for or aimed at children under 13, and we don't knowingly collect information from them. If you believe a child has sent us something, email us and we'll delete it.

Security

The honest version: the strongest security measure here is that we don't hold the sensitive material in the first place. Your tasks are protected by your iPhone's own encryption and passcode. The site is served over HTTPS only. The services we do use — Kit, PostHog, Cloudflare, Apple — are established providers with their own security programmes. No system is perfectly secure, and we're not going to pretend otherwise.

Changes to this policy

If we change this policy we'll update the date at the top. If a change actually matters — new data being collected, or a new company involved — we'll say so in the app and to anyone on the waitlist, rather than quietly editing this page and hoping you don't notice.

Contact

Rhys Trevethan, trading as Spoondraw
Australia
[email protected]