Privacy Policy
Who we are
Uncover is published by Day Two (CVR: 38 02 36 83), a company registered in Denmark. Under GDPR, Day Two is the data controller for any personal data described in this policy.
Contact: hello@daytwolabs.dev
The short version
Almost everything you do in Uncover stays on your device. The decks you've saved, the cards you've rated, and your session progress are stored locally and are never sent to any server we operate. The two exceptions are our in-app purchase system, which uses RevenueCat to verify your Uncover Pro subscription, and anonymous product analytics via PostHog.
What data is collected and why
1. App content
Everything you do in Uncover (saved decks, card ratings, session progress, category preferences, language setting) is stored on your device using local storage. We never see it, receive it, or store it anywhere. This data is not transmitted off your device and does not constitute processing by Day Two under GDPR.
2. Purchase verification
When you subscribe to Uncover Pro, we use RevenueCat to verify your subscription and restore it if you reinstall or switch devices.
| Data | Purpose |
|---|---|
| Anonymous app user ID | Identify your subscription session |
| Device identifier (iOS) | Link the subscription to your device |
| Apple purchase receipt | Verify and restore the Pro subscription |
| App version, OS version | Support and issue diagnosis |
Legal basis (GDPR Art. 6(1)(b)): Processing is necessary for the performance of the contract - delivering the Pro subscription you purchased.
RevenueCat acts as a data processor on our behalf. We have a Data Processing Addendum (DPA) in place with RevenueCat as required by GDPR Article 28. RevenueCat stores data on AWS servers in the United States; transfers from the EU are covered by standard contractual clauses (SCCs) under GDPR Article 46(2)(c). RevenueCat does not use this data for advertising or cross-app tracking. See RevenueCat's privacy policy.
3. Product analytics (PostHog)
Uncover uses PostHog to understand anonymous, aggregate usage patterns - which decks and cards get used, whether a session is completed, whether a purchase completes. This helps us fix broken flows and prioritize what to build next.
| Data | Purpose |
|---|---|
| Anonymous, randomly generated device ID | Group events from the same install together - not linked to your identity or any account (Uncover has none) |
| Event names (e.g. “deck opened,” “card rated,” “paywall shown”) and non-personal IDs of the deck/card involved | Understand which decks and cards are used and where people drop off |
| App version, OS version, device type | Diagnose issues tied to specific versions or devices |
What PostHog never receives: the actual text of any card or question, or any personal information - Uncover has no text-entry fields to begin with. No advertising identifier (IDFA) is collected or used.
Legal basis (GDPR Art. 6(1)(f)): legitimate interest in understanding and improving our product, balanced against your privacy since no personal data is collected.
PostHog acts as a data processor on our behalf, hosted on PostHog Cloud's EU servers (data stays in the EU/EEA, no international transfer). We have a Data Processing Addendum (DPA) in place with PostHog as required by GDPR Article 28. See PostHog's privacy policy.
What we do not collect
- No advertising SDK or advertising identifier (IDFA)
- No user accounts
- No email addresses or contact information
- No location data
- No push notifications
- No card or question text, or any app content, sent to any analytics or purchase processor
International data transfers
Your purchase data is processed by RevenueCat, Inc. (United States). This transfer is covered by standard contractual clauses approved by the European Commission under GDPR Article 46(2)(c). Analytics data is processed by PostHog on EU-based servers and does not leave the EU/EEA. We do not transfer any other personal data outside the EU/EEA.
Data retention
App content is stored on your device until you delete the app. Subscription data is retained by RevenueCat for as long as necessary to provide purchase verification and comply with legal obligations - see RevenueCat's privacy policy for their full retention terms. Analytics data is retained by PostHog per their standard retention policy - see PostHog's privacy policy for their full terms.
Your rights under GDPR
As a data subject, you have the right to access, correct, or delete personal data we hold about you; to restrict or object to processing; to receive your data in a portable format; and to withdraw consent where processing is based on consent.
Because all app content stays on your device, most rights requests relate to RevenueCat's processing. For subscription data deletion, contact RevenueCat directly at compliance@revenuecat.com, or contact us at hello@daytwolabs.dev and we will coordinate on your behalf. We will respond within 30 days.
Right to lodge a complaint
If you believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with the Danish supervisory authority:
Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
datatilsynet.dk · dt@datatilsynet.dk
You may also lodge a complaint with the supervisory authority in the EU member state where you live or work.
Children
Uncover is not directed at children under 13 (or under 16 where applicable EU law requires a higher age). We do not knowingly collect personal data from children.
California (CCPA)
The California Consumer Privacy Act does not apply to Day Two. We do not meet the applicable thresholds: we do not have gross annual revenue over $25 million, do not buy or sell the personal information of 100,000 or more California residents, and do not derive 50% or more of annual revenue from selling personal information.
Changes to this policy
If we make material changes, we will update the effective date at the top of this page. Continued use of Uncover after changes take effect constitutes acceptance of the updated policy.
Contact
Day Two · CVR 38 02 36 83 · Denmark
hello@daytwolabs.dev