Afterglow privacy policy

Who we are

Afterglow is made by Marc Wieland, who is the controller responsible for the personal data this policy describes. Write to hiafterglow.ing with any question about your privacy.

What stays on your phone

Everything you write: your moments, your partners, your notes, your pictures, your video and your audio. It’s encrypted on your phone with a key made from your recovery phrase. Afterglow has no account, and your journal is never sent to a server of ours. The one thing that can pass through one is a share you send to a partner, and only once you turn that on, as the next sections say.

Afterglow locks with Face ID, your fingerprint or a code, and it blocks screenshots and screen recordings.

Keep your recovery phrase safe. Nobody can give it back to you, and that includes us. If you lose it and your phone, the journal is gone.

What Afterglow asks your phone for

Afterglow asks only when you use something that needs it, and you can say no.

• The camera, to scan a partner’s pairing code and to take photos and videos in Afterglow.
• The microphone, to record videos and audio in Afterglow.
• Your photo library, to add the photos and videos you pick.
• Face ID or your fingerprint, to unlock your journal. Your phone checks it, and Afterglow never sees it.

What you take or record in Afterglow goes straight into your journal, encrypted, and never into your photo library. Afterglow never asks for your location. To fill in a card from a contact, your phone’s own picker hands over only the one you pick. On Android before version 17, Afterglow asks for access to your contacts when you tap Fill in from contacts, and reads only the one you pick. When you share something into Afterglow from another app, such as photos or a link to a profile, it’s read only on your phone. A link is never opened, and Afterglow deletes the copy the other app handed over once your journal has its own, encrypted.

Your backup, in your own cloud

If you connect iCloud, Google Drive or Dropbox, Afterglow saves an encrypted backup to your account there. Only your recovery phrase opens it, so neither we nor the cloud provider can read it. The provider can still see how many files there are, how big they are and when they changed.

On Google Drive and Dropbox, Afterglow works only in its own folder and never sees the rest of your files. It reads the account’s email address to show you which account is connected, and that stays on your phone. Disconnecting stops the backups.

Files you export

Settings > Moving your journal makes two kinds of file. The encrypted one holds everything, pictures included, and opens only with the recovery phrase it was made with, though the number of pictures in it and their sizes can be read. The two plain files hold everything you wrote, without the pictures, and anyone who gets them can read them.

Sending something to a partner

When you send a partner a card, a moment or pictures, Afterglow encrypts it so only the two of you can open it. It then hands the file to the app you pick, such as a messenger, and that app’s own privacy rules apply from there.

Tapping WhatsApp or Instagram on a partner’s page opens that app. Afterglow never looks anybody up on its own.

If you turn on direct sharing

Sending a card, moments or an album straight to a paired partner’s phone is off until you turn it on, when you pair or in Settings. It goes through Afterglow’s server, which runs on Cloudflare, and this is what that server holds:

• The share itself, encrypted on your phone so that only your partner’s phone can open it. Afterglow can’t read it, and neither can Cloudflare.
• The two public codes your phones swapped when you paired, which is how a share finds the right phone, and which partners may send to you.
• When something was sent, how big it was, and whether it arrived.
• A push token, if you allow notifications, so your phone can be told that something is waiting.

A share is deleted from the server once your partner’s phone has it, when you cancel it, or after seven days, whichever comes first. What a sender can read back afterwards, that it arrived or didn’t, is kept for thirty days with no size and no recipient attached. A registration nobody uses for a year is removed. Cloudflare keeps its own recovery copy of the server’s database for up to seven days, so a deleted row can outlive its deletion there.

If a code is used to abuse the server or to run up what it costs, Afterglow can stop taking shares from it. The server then keeps that code and when it was stopped, removes its registration and everything waiting to or from it, and refuses it from then on. Sending a file still works.

You can block a sender, which refuses them on your phone and on the server for good: they can no longer send you anything, and their code can’t pair again. The server then keeps their public code next to yours, until your registration is removed. You can report a sender too. A report is an email you write from your own mail app, naming their public code, what arrived and when, and the facts of your app, which you read before it opens. Afterglow can’t read what they sent, so a picture or a message goes along only if you add it afterwards. Afterglow scans nothing, because nothing it carries can be read by it. Nothing enters your journal unless you look at it and save it, and what you don’t keep is thrown away. A report is answered within a day, by removing the reported code from the server.

The notice your phone gets says only that something is waiting, never who sent it or what it is. The server hands it to Apple or Google, who deliver it, and a notice is never guaranteed to arrive. Your phone also looks for new shares whenever you open Afterglow, and a few times a day asks whether the server is running, which tells it nothing about you.

You can take back pictures you sent, and give them a lifetime when you send them: one look, an hour or a day. A take-back travels through the server as a share of its own, so the server can tell it apart from other shares, because it is small and asks for no notice, and the record of it kept for thirty days still says so. The server can’t read it or see which pictures it names. A picture sent for a lifetime stays on your partner’s phone: it never goes to their cloud, their backup or an export, and it’s deleted when its time is up. A take-back is honoured by the other copy of Afterglow and promises nothing beyond that. A picture your partner already passed on, a copy made outside Afterglow and a cloud’s own version history are out of its reach, and it reaches only what you sent directly in the last thirty days.

If you chat with a partner

A chat works only while you and your partner both have direct sharing on, and goes through the same server. Every message, a line of text included, is encrypted on your phone so that only your partner’s phone can open it. A line waits on the server as one small encrypted message, and a picture, a clip or a recording as a share. The server also sees when each was sent, how big it was, and whether it was a message or the note that one arrived, was read or was saved, which asks for no notice.

Each is deleted from the server once your partner’s phone has it, or after 48 hours, whichever comes first. On both phones a message is deleted 48 hours after the server took it, and nobody can change that time. Nothing in a chat goes into a backup, an export or your phone’s photos. A picture leaves the chat only if you keep a copy in your own album as you send it, or let your partner save it to theirs, where it can’t be passed on. You can take back a message while it’s in the chat. When your partner saves one, your phone hears of it and lists it under Sent, where you can take that copy back for 30 days after you sent it. Until then your phone keeps only what kind of item it was and the day it went.

The server counts, day by day, how many shares and chat messages it held, delivered or let expire, and how many notices it sent. These are totals with no code, phone or partner attached.

Turning direct sharing off stops anything new, removes your registration and whatever was still waiting for you, and leaves what already arrived on your phone. If you’re offline at that moment, the server is told as soon as your phone can reach it.

This is all a lawful order to Afterglow could ever reach: that two codes exchanged something, when, how much, and whether it was a take-back, a chat message or the note that one arrived, was read or was saved. Never what was in it.

What leaves your phone, and to whom

Afterglow sends no usage data until you turn on Settings > Your privacy > Help improve Afterglow. It’s off when you install the app. About a week in, Afterglow asks you once whether to turn it on, and you can turn it off again in the same place at any time.

While it’s on, Afterglow sends this usage data to Aptabase, an analytics company in the European Union:

• How you use the app, such as which screens you open and whether you searched your partners or sent a card. Never what you wrote, and never which partner.
• Once a day, how the app is set up, such as its language, how it locks, which cloud it backs up to and roughly how full the journal is.
• What went wrong when something breaks, as a fault code and the place in Afterglow’s own code where it happened. Never what was on the screen.
• If you try to buy Plus, which price you picked and whether the purchase went through. Never your payment details.
• A few words you typed yourself: a tag you made up, such as how you met someone, or a place that isn’t on Afterglow’s list. That’s how Afterglow learns which words it’s missing. Each goes on its own, never if it matches a name in your journal, and a tag waits before it goes so you can delete it.

Nothing that identifies you goes with it: no name, no email address and no advertising identifier. A phone identifier goes only from a phone holding an invite code, as the next section says. Aptabase reads a country and region from the network address the usage data arrives from, and doesn’t keep the address.

A tag can say something about your sex life, which the law treats as sensitive. That’s why Help improve Afterglow is off until you turn it on, and why turning it on is your explicit consent. Turning it off stops everything from that moment. What was already sent stays, because nothing in it points back to you.

Write to us under Settings > What’s missing? and Afterglow opens your own mail app with your message in it. It adds the app version, your phone’s system and its version, your language and the failures the app ran into, all there to read before you send. Nothing goes until you send it yourself.

If somebody gave you an invite code

We hand invite codes to a few testers we know, and they can pass codes on to people they know. Nobody sells them. Afterglow’s servers check once that each invite code is used on one phone only. A code unlocks Plus and turns on Settings > Your privacy > Help improve Afterglow, which stays on while Plus from the code lasts. The invitation says so before you take it. You can say no: the journal is free and complete without Plus, and anybody can buy Plus at a price they choose.

While the code is on your phone:

• The usage data your phone sends carries where your code sits among the codes passed on, and a random number your phone drew, instead of the code. So we can see how the people each code brought use Afterglow, and tell one phone from another.
• Making a code to pass on, or sending one again, is counted too, with where it sits.
• If you leave Help improve Afterglow on after Plus from the code ends, your usage data keeps carrying both until you remove the code.
• What your phone sends via Afterglow’s infrastructure can be used in legal action against unlawful behaviour.

If we gave you the code ourselves, we know it’s yours. A code somebody passed on to you tells us nothing about who you are.

Removing the code under Settings > Afterglow Plus > Invite code stops all of this from then on. It can’t take back what was already sent.

Who else is involved

Afterglow shares nothing beyond what this policy lists.

• Aptabase, an analytics company in the European Union, receives the usage data. It handles it only on our instructions and must protect it at least as well as this policy does.
• Apple and Google sell Plus in their stores and handle the payment under their own privacy policies. Afterglow checks the purchase on your phone and never sees your payment details.
• iCloud, Google Drive or Dropbox hold your encrypted backup, if you connect one.
• Cloudflare hosts afterglow.ing and may process your network address to deliver and protect the site, as its own privacy policy explains. The site sets no cookies, runs no analytics and keeps no log of visits.
• If you turn on direct sharing, Cloudflare runs Afterglow’s server for it as our processor, and Apple and Google deliver the notice that something is waiting.
• On Android, the phone itself asks afterglow.ing for one public file when Afterglow is installed or updated. From Android 15 it also asks every so often. This checks that invite links really belong to Afterglow, and it carries nothing from the app. An iPhone asks Apple instead.

What Afterglow never does

No advertising and no advertising identifier. No tracking across apps or websites, so Afterglow never asks to track you. Nothing records which link or advert brought you here. No analytics kit other than Aptabase, and no crash reporting kit. Nothing about you is sold, and no advertising profile of you is built.

How long things are kept

• Your journal stays on your phone and in your backup for as long as you keep them. Deleting the app, or Settings > Reset app, clears it from the phone. A backup stays in your cloud until you delete it there.
• Aptabase keeps usage data for five years, then deletes it.
• Aptabase doesn’t keep your network address. The daily number it works out from it, to group one phone’s usage data within a day, can’t be worked out again after two days.
• Mail you write to us is kept to answer it and to make Afterglow better, and deleted whenever you ask.

Your choices and rights

What the app sends rests on your consent, which you give by turning on Help improve Afterglow or by taking an invite code. Direct sharing is a second consent of its own, given by turning it on after Afterglow says what the server holds, and withdrawn by turning it off.

• To withdraw your consent, turn off Settings > Your privacy > Help improve Afterglow at any time.
• For direct sharing, turning it off is the erasure: it removes your registration and everything waiting for you from the server.
• To remove an invite code, go to Settings > Afterglow Plus > Invite code and tap Remove code.
• To export everything you wrote as plain files, without the pictures, go to Settings > Moving your journal > Read it without Afterglow.
• Ask for access to your personal data, or to have it corrected, deleted, restricted or handed over, at hiafterglow.ing.

There’s one honest limit. Without an invite code, nothing your phone sends points back to you, so we can’t pick out your usage data to show or delete it. With a code, what your phone sent can be found by that code.

You can also complain to a data protection authority, such as the one where you live.

Children

Afterglow is for adults. It won’t store an age under eighteen, and it isn’t meant for anyone younger.

Changes to this policy

If a change affects what leaves your phone or how Afterglow uses your cloud, the app will tell you and ask you before it happens. The date at the top shows when this policy last changed. Questions go to hiafterglow.ing.