Privacy Policy

1. Who we are

Delva is made by Episteme Labs Ltd, a company registered in England and Wales (company number 17387745). Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

We are the controller of the personal data described here. Contact us about anything in this policy at [email protected]. We are a two-person company with no appointed Data Protection Officer; the directors handle privacy matters personally.

2. What we collect and how

2.1 When you open the app (no account needed)

The first time you open Delva we create an anonymous account, so that your progress is saved without asking who you are. We collect:

• Identifiers: a random account ID that we create, and a random device identifier we use to keep your progress in sync. Neither is Apple's advertising identifier (IDFA), and neither can be used to track you across other apps.
• Activity in the app:
• which cards were shown to you and for how long;
• whether you swiped past a card or into it, and how far you read;
• cards you liked;
• games you played, with your answers and scores;
• your XP, levels and streaks;
• the display name you choose, if you set one;
• the app version and your time zone.
• Device information: iPhone model, iOS version and language.

2.2 Onboarding answers

During setup we ask a few questions: - your age band; - your gender; - what brings you to Delva; - your daily goal; - when you'd like a reminder; - the topics you're interested in; - how you heard about Delva.

Age band and gender are optional and include "Prefer not to say". We use these answers to tailor your feed and reminders, and, in aggregate, to understand who uses Delva and which marketing works.

2.3 If you sign in (optional)

Signing in lets you keep your progress across devices. - Sign in with Apple: we receive the email address Apple shares with us, which may be a private relay address Apple creates for you. Apple also offers us your name, but we do not keep it. - Sign in with Google: we receive your name, your email address and a link to your Google profile photo. - Email: we receive your email address and send you a one-time sign-in code.

2.4 Notifications

Reminders are scheduled on your iPhone itself. We store the reminder time you chose and whether notifications are on, nothing else; no push token leaves your phone. You can turn notifications off at any time in iPhone Settings → Notifications → Delva.

2.5 Invite codes

Each installation gets a random invite code. If invite links are switched on and someone joins through yours, we record that they did. We never access your contacts.

2.6 Topic searches

If you search for or request a topic we don't have yet, we store the text you typed. It is not linked to your account.

2.7 Product analytics

• We use PostHog to understand how the app is used (for example, how many people finish onboarding) and to compare versions of a feature. PostHog receives your account ID, the events above, device information (model, iOS version, language, time zone, screen size) and your IP address when events are sent, from which it may derive an approximate location. Analytics start when you first open the app.

2.8 Support emails

When you email us, we keep your email address, your message and our reply.

2.9 What we do not collect

We do not collect: - your precise location, contacts, photos, camera or microphone; - health data; - your browsing outside the app; - Apple's advertising identifier.

We do not show advertising in the app. We do not sell personal data or share it with data brokers.

3. Why we use it, and our legal basis

You can object to any use based on legitimate interest by emailing us (section 9).

4. How the feed is personalised

Software ranks Delva's feed; no person chooses what you see. It uses only what you do inside Delva and the answers you gave during setup. It uses no data about you from anywhere else.

This personalisation has no legal or similarly significant effect on you: at worst, you see a card you find dull.

From time to time we show different versions of a feature to different people to see which works better. If you would rather not be profiled, email us and we will reset your history. Your feed will then be less relevant.

5. Who we share data with

We share personal data only with the service providers below, who process it for us on our instructions. Each provider is bound by a written contract (a data processing agreement) to protect your data to the same or an equal standard as this policy, and may not use it for its own purposes. We also share data with authorities when the law requires it.

Sign-in providers. Apple and Google act as independent controllers for Sign in with Apple and Sign in with Google, and their own privacy policies apply. Apple also delivers notifications to your iPhone.

AI. Delva's cards are written with the help of AI models (currently OpenAI), working from Wikipedia and Wikidata. That process handles encyclopedia text only. No personal data about you or your activity is sent to any AI provider.

If we sell or merge the business, your data may pass to the new owner, who must honour this policy.

6. International transfers

Some providers are in the United States. When data leaves the UK, we rely on safeguards recognised by UK law: the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, otherwise the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Data is encrypted in transit. You can ask us for a copy of the relevant safeguard.

7. How long we keep data

• Account and activity data: for as long as your account exists. When you delete your account, an anonymous account is erased at once and a signed-in account within 30 days.
• Product analytics: events already sent to PostHog are kept under your account ID; email us when you delete your account and we delete them too, within 30 days.
• Support emails: 2 years after the conversation ends.
• Website logs: kept by Cloudflare for a short rolling period. We do not keep them.

Deleted data may remain in encrypted backups for a short period before being overwritten.

Before you delete the app, delete your account. Deleting the app does not delete your account: your sign-in is kept in the iPhone keychain, so reinstalling restores it, and until then the account stays on our servers.

8. Security

Data is encrypted in transit (TLS) and at rest with our providers. Only the two directors can access production systems, and that access is protected by multi-factor authentication.

If a breach puts your rights at risk, we will tell you and the Information Commissioner's Office, as the law requires.

9. Your rights and how to use them

Under UK and EU data-protection law you can: - access your data and get a copy of it; - correct it; - delete it; - restrict how we use it; - object to how we use it, including profiling; - port it to another service; - withdraw consent at any time.

• Delete your account and its data: in the app, open the You tab, tap the Settings cog, then Account → Delete account. This works whether or not you ever signed in. The deletion takes effect immediately in the app; an anonymous account is erased from our servers at once, a signed-in account within 30 days.
• Withdraw consent:
• Notifications: turn them off in iPhone Settings.
• Age band or gender: ask us to erase them.
• Everything: delete your account.
• Anything else (a copy of your data, a correction, an objection): email [email protected] from the email address you signed in with, so we can find your data. We reply within one month, free of charge. If you never signed in, we cannot tell which anonymous account is yours, so use Delete account in the app.

10. Children

You must be 13 or over to use Delva. We do not knowingly collect data from anyone under 13. If you believe a child under 13 has used Delva, email us and we will delete their data.

For everyone, Delva applies high-privacy defaults: no advertising, no cross-app tracking, no location, no public profiles.

11. The website

getdelva.com sets no cookies and uses no advertising or tracking pixels. Cloudflare, which hosts it, keeps standard access logs for security, and Cloudflare Web Analytics counts visits without cookies or fingerprinting.

12. Complaints

Please tell us first at [email protected].

You can also complain to the UK Information Commissioner's Office (ico.org.uk/make-a-complaint, 0303 123 1113). If you live in the EU, you can complain to your local data-protection authority.

13. Changes

We will update this policy when the app or the law changes. The date at the top shows when it was last changed. We will tell you in the app about any significant change.