Privacy Policy
Last Updated: October 6, 2026
Aston Smith Ltd, trading as SitApp ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our desktop application and website (collectively, the "Service").
1. Information We Collect
1.1 Information You Provide
When you create an account or use our Service, you may provide:
- Account Information: Name and email address when you register
- Authentication Data: Login credentials or social login tokens (Google, GitHub, Apple)
- User Preferences: App settings and preferences you configure
- Communications: Information you provide when contacting us for support
1.2 Information Collected Automatically
When you use our Service, we may automatically collect:
- Usage Analytics: Which features you use and how often (anonymized)
- Technical Data: App version, operating system, device type
- Performance Data: App crashes and error reports (with your consent)
- Calibration Progress: Setup completion status (no images)
1.3 Webcam and Posture Data
Important: SitApp uses your webcam for posture detection. Here's how we handle this sensitive data:
- Local Processing Only: All webcam images are processed entirely on your device using on-device AI
- No Transmission: Webcam images, video, or detailed posture data are NEVER transmitted to our servers or any third party
- No Storage: We do not store webcam images or recordings
- Posture Metrics: Only anonymized, aggregated posture improvement statistics may be collected (e.g., "posture improved by X%"), never detailed body positions or images
1.4 Information NOT Collected
- Webcam images or video recordings
- Detailed body measurements or positions
- Location data
- Contacts or address book information
- Financial information (payments handled by third parties)
1.5 Download-Link Emails
If you visit our download page on a phone, you can ask us to email you the download link so you can install SitApp on your computer. We use your email address only to send that link and, if you haven't signed up a day or so later, one reminder. We don't add you to a newsletter or any other mailing. The emails are sent through Resend (see section 4). Every email has a link to stop them, which deletes your address straight away. When you sign up, we delete your email address from this list and keep only a keyed hash of it, with the dates and the campaign tags of the page you came from, so we can count how many requests led to a sign-up. We delete that record 12 months after you sign up. If you don't sign up, we delete the whole record after 30 days. To stop the form being misused, we also count requests against a keyed hash of your email address and of your IP address. Those counters are deleted within 48 hours. Before we send anything, the form runs a Cloudflare Turnstile check to tell people from bots (see section 4).
2. How We Use Your Information
We use the information we collect to:
- Provide and maintain the Service
- Create and manage your account
- Send you important notifications about the Service
- Respond to your inquiries and provide customer support
- Improve our Service and develop new features
- Detect, prevent, and address technical issues
- Analyze usage patterns to enhance user experience
- Comply with legal obligations
3. Legal Basis for Processing (GDPR)
Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and management | Performance of contract |
| Essential Service operation | Performance of contract |
| Analytics and improvement | Legitimate interests |
| Error reporting | Consent |
| Marketing communications | Consent |
You may withdraw your consent at any time by contacting us or adjusting your settings within the app.
4. Third-Party Services
We use the following third-party services:
4.1 Firebase (Google)
- Purpose: Authentication, database, and hosting
- Data Shared: Account information, user preferences
- Privacy Policy: firebase.google.com/support/privacy
4.2 Google Analytics
- Purpose: Website and app usage analytics
- Data Shared: Anonymized usage patterns, device information
- Privacy Policy: policies.google.com/privacy
4.3 Sentry (Error Reporting)
- Purpose: Error tracking and performance monitoring
- Data Shared: Error logs, device information (only with your consent)
- Privacy Policy: sentry.io/privacy
4.4 Paddle (Payments)
- Purpose: Processing subscription and one-time payments. Paddle.com Market Limited acts as our merchant of record and is the seller of record for your purchase.
- Data Shared: Name, email address, billing address, country, and payment details. Card details are collected by Paddle directly and are never received or stored by us.
- Privacy Policy: paddle.com/legal/privacy
4.5 Apple (Mac App Store purchases)
- Purpose: Processing in-app purchases where you installed SitApp from the Mac App Store. Apple is the seller of record for those purchases, and Paddle is not involved.
- Data Shared: Your purchase is made with your Apple Account. We receive a transaction identifier confirming your entitlement; we do not receive your name, billing address, or payment details.
- Privacy Policy: apple.com/legal/privacy
4.6 Resend (Email Delivery)
- Purpose: Sending our emails, including the download-link emails described in section 1.5. Resend is based in the United States and acts as our processor.
- Data Shared: Your email address and the content of the email we send you.
- Privacy Policy: resend.com/legal/privacy-policy
4.7 Cloudflare Turnstile (Bot Check)
- Purpose: Checking that a person, not a bot, is using the download-link form described in section 1.5. Cloudflare processes this data to run the check; see its Turnstile privacy addendum below. The check loads only when that form is shown.
- Data Shared: Your IP address and signals from your browser that Cloudflare uses to tell people from bots. We pass Cloudflare your IP address when we verify the result. Cloudflare does not receive your email address.
- Turnstile Privacy Addendum: cloudflare.com/turnstile-privacy-policy
4.8 On-Device AI
- Purpose: Posture detection and monitoring
- Data Shared: None - all processing is local
5. Cookies and Tracking Technologies
Our website uses cookies and similar technologies. For detailed information, please see our Cookie Policy.
Types of cookies we use:
- Essential Cookies: Required for the website to function
- Analytics Cookies: Help us understand how visitors use our site (Google Analytics)
- Functionality Cookies: Remember your preferences
6. Data Storage and Security
6.1 Where We Store Your Data
Your data is stored on servers located in the United Kingdom and European Union via Firebase (Google Cloud Platform). By using our Service, you consent to this data storage.
6.2 Data Security
We implement appropriate technical and organizational measures to protect your data, including:
- Encryption in transit (HTTPS/TLS)
- Encryption at rest for stored data
- Secure authentication mechanisms
- Regular security assessments
- Limited access to personal data
6.3 Data Retention
| Data Type | Retention Period |
|---|---|
| Account information | Until account deletion (immediately removed upon request) |
| Posture history | Until account deletion (immediately removed upon request) |
| Download-link email address | Until you sign up or stop the emails, and at most 30 days |
| Download-link sign-up record (keyed hash, dates, campaign tags) | 12 months after sign-up |
| Download-link abuse counters (keyed hash of email or IP address) | Up to 48 hours |
| Usage analytics | 26 months (anonymized) |
| Error reports | 90 days |
| Support communications | 3 years |
7. Your Rights Under GDPR
If you are in the European Economic Area (EEA) or United Kingdom, you have the following rights:
- Right of Access: Request copies of your personal data
- Right to Rectification: Request correction of inaccurate data
- Right to Erasure: Request deletion of your data ("right to be forgotten")
- Right to Restrict Processing: Request limitation of data processing
- Right to Data Portability: Request transfer of your data in a machine-readable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
- Right to Lodge a Complaint: File a complaint with a supervisory authority
We will respond to your request within one month. There is no charge for exercising these rights.
To exercise your rights, please contact us at privacy@sitapp.app.
8. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to Know: What personal information is collected, used, shared, or sold
- Right to Delete: Request deletion of personal information
- Right to Opt-Out: Opt out of the sale of personal information
- Right to Non-Discrimination: Not be discriminated against for exercising your rights
To exercise your California privacy rights, contact us at privacy@sitapp.app.
9. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.
When we transfer data outside the EEA/UK, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses approved by the European Commission
- Transfers to countries with an adequacy decision
- Other legally approved transfer mechanisms
10. Children's Privacy
SitApp is intended for users who are at least 18 years old. We do not knowingly collect personal information from children under 18.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@sitapp.app. We will take steps to delete such information.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the new Privacy Policy on this page
- Updating the "Last Updated" date
- Sending you an email notification (for significant changes)
We encourage you to review this Privacy Policy periodically.
12. How to Complain
If you have concerns about our use of your personal information, you can:
- Contact us directly at privacy@sitapp.app
- Lodge a complaint with the Information Commissioner's Office (ICO) if you are in the UK
ICO Contact Details:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk
13. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
Email: privacy@sitapp.app
General Inquiries: info@sitapp.app