Privacy Policy

Who we are

Set Straight is operated by Eduardo Cardoso Brandes EPP, trading as Brandes Tech, Porto Alegre, RS, Brazil, 91787-772 ("Set Straight", "we"). It is the data controller for the information described here. Privacy questions: privacy@setstraight.app. Everything else: support@setstraight.app.

This product is for adults

You must be 18 or older to create an account. Children cannot be users. A parent may record information about their child; that is the parent acting, not the child using the service. Set Straight is not directed at children under 13, and we do not knowingly collect personal information from a child as a user.

If we learn that an account belongs to someone under 18, we close it and delete the account data.

What we collect

Account: email, password (stored only as a hash), date of birth — we keep the date, not just the check, so we can show we did check — your display name and every earlier display name with the date you changed it, language, notification, quiet-hours and read-receipt settings. If you sign in with Apple or Google, the identifier that provider gives us and the email it shares, which may be a private relay address.

The child's record: the child's name and date of birth, who the child lives with, the parenting arrangement in your own words (never shown to the other parent), the state or country whose rules apply to the case, and the case time zone. Then everything either parent adds: entries — including health, school and money details — attachments, messages, disputes, invitations, confirmations, and the audit trail (created, sent, delivered, read, disputed, expired) with server timestamps.

Invitations: we do not collect the other parent's contact details. You share the invitation link yourself. Whoever opens it sees your display name and the child's first name before signing up.

App and payments: device type and operating system, app version, language, the push-notification token for your device, and the subscription status that Apple, Google and RevenueCat send us with a purchase identifier. We never receive your card number.

Access logs: the time and IP address of sign-ins and requests, kept for security — and, in Brazil, for the period the law requires.

Support and reports: whatever you write to us, including a report about the other parent, and the protocol we open for it.

What we never collect

Location. Not precise, not coarse, not in the background. The app does not have the permission.

Presence. There is no "online", no "typing", no last-seen.

Your face or fingerprint. If you lock the app with Face ID or a fingerprint, that stays on your phone. It never reaches us.

A public profile, a feed, or contacts beyond the co-parent you invite to a specific child's record.

Your voice. Dictation uses the speech recognition built into your phone. We never receive audio; we store only the text you confirm.

How we use it

To run the record: store what you log, notify the other parent, run the seven-day response window, and produce a certified export when you ask.

To keep you safe: batched notifications, the daily message cap, one-sided block, and reports. We do not use your record to advertise, to train a public model, or to score you.

The in-app assist that reads a receipt or warns that a draft may be used against you runs on the text or image you just submitted. It does not browse the rest of your record to do that. We do not use those prompts to build a profile of you.

On iPhone we require on-device speech recognition. On Android the system recognizer decides whether it can work offline; when it can't, your phone may send the audio to the recognizer's provider under that provider's terms — never to us.

Who else sees it

The co-parent on that child's record sees entries, attachments, the audit trail, and messages, including history written before they joined.

A lawyer, a court, or anyone else sees a record only if you export it and give it to them.

Processors who run the service for us: cloud hosting, file storage, email and push delivery, and in-app purchases (Apple, Google, RevenueCat). They get what they need to do that job, under contract, not a copy of the whole record to use as they like.

We disclose information if the law requires it — a valid subpoena, court order, or similar process — and we keep a record of that request. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

How long we keep it

The purpose of Set Straight is a durable record. Entries, attachments, messages, and the audit trail are kept for as long as the child's record exists.

If you delete your account, we remove your login, your name and earlier display names, date of birth, email, and settings, and you stop using the app. Entries, disputes, messages and the audit trail you wrote stay in the child's record with your name and account removed; what you wrote may still identify you by its content. They stay because they are also the other parent's record and because they may be needed to establish, exercise, or defend a legal claim. That is not a blanket "we never delete": if you ask us to delete a specific item, a person looks at it and tells you in writing whether we will and, if not, which exception we rely on. Anything we keep under an exception is not used for any other purpose.

Support mail and reports are kept as long as needed to handle them and to keep a record of what we did.

Your rights

You can access and export your record in the app. You cannot edit or erase an entry; you add a correction that points to it. That is a product rule, described again in the Terms.

If you live in a place with a privacy law that gives you extra rights — including the CCPA/CPRA in California, and the LGPD in Brazil — you can ask us for a copy of what we hold about you, to correct account data, to delete what the law says we must delete, and to appeal a refusal. Write to privacy@setstraight.app. We answer within 45 days (15 days if you are in Brazil), and we do not charge for a request we are required to honor. We answer within 45 days (15 days if you are in Brazil), and we do not charge for a request we are required to honor.

We may refuse to delete a record, or part of one, when an exception applies — for example, to establish, exercise, or defend a legal claim, or to comply with a legal obligation. When we refuse, we say so in writing and explain the reason. Data we keep under an exception is not used for anything else.

We will not discriminate against you for exercising a privacy right.

Security

Access to a record requires an account. Sessions expire. Attachments are stored outside the database; the database holds a hash. You can require Face ID, Touch ID, or a fingerprint on your own phone before the app opens. We cannot see that biometric, and we cannot unlock your phone for you.

International transfers

Set Straight is operated from Brazil, and our servers and file storage are in the United States. Your data is processed in both places. Where a privacy law gives you rights over international transfers, those rights apply, and we use contractual safeguards with our providers. Ask at privacy@setstraight.app for a copy.

Changes

If we change this policy in a way that matters, we will update the date above and notify you in the app or by email. Continued use after that notice is acceptance of the revised policy, except where the law requires a new consent.