Privacy Policy
This policy explains what personal data T-Stop Pro collects, why, who else sees it, and what you can do about it. It is written to be read, not to be survived.
1. Who is responsible for your data
The data controller is James Coote, an individual trading as T-Stop Pro. Contact for any privacy question or request:
This policy covers the T-Stop Pro iOS app and the tstoppro.com website, including the online calculator and the feedback board at feedback.tstoppro.com. They are treated separately below, because they collect different things.
2. What the app collects
Your account
You can create an account with an email address and password, with Sign in with Apple, or with Google Sign-In. Accounts are handled by Firebase Authentication (Google). We receive your email address, the name you supply, and a user identifier.
If you choose Google Sign-In, Google's own sign-in component runs inside the app. Google states in that component's privacy manifest, which ships inside the app, that it collects your name, email address, phone number, coarse location, user identifier, device identifier, other usage data and other data types, all linked to your identity, and that it uses the identifiers, the usage data and the other data types for Google's own analytics as well as to make sign-in work. That is Google's collection, under Google's privacy policy, and it is not what reaches us: our own record holds only the fields listed under "Your profile record" below, and we never receive your location.
If you use Sign in with Apple and choose to hide your email, Apple gives us a relay address instead of your real one, and that is all we ever see.
Your profile record
Our own server stores one record per account. It holds exactly these fields: your user identifier, email address, name, phone number if you give one, your profession, your experience level, and a flag recording whether you have unlocked the paid features. Nothing else.
Your purchases
If you buy an unlock in the app, RevenueCat records the purchase against your user identifier so the app knows what you own and can restore it on a new device. Card details never reach us: an in-app purchase is paid to Apple. No web checkout is currently available on tstoppro.com. If web purchases are enabled in future, RevenueCat would record the purchase and Stripe would process the payment.
Notifications
If you allow notifications, the app creates an Expo push token, which is an operational device identifier, and stores it against your user identifier. We use it to send notifications about T-Stop Pro, such as new or corrected lights and modifiers and important service messages. The token and the notification content are relayed by Expo to the Apple Push Notification service for delivery to your device. We do not use the token for advertising or tracking.
What the App Store privacy label declares
Apple's privacy label covers everything the app collects, including collection by a component inside it that we do not control. This is that list in full, with who collects each item and why. Every item is linked to your identity. None of it is used to track you across other companies' apps or websites.
| Data | Linked to you | Why | Who collects it |
|---|---|---|---|
| Email address | Yes | Your account | Us, and Firebase Authentication. Google Sign-In as well, if you use it |
| Name | Yes | Your account and profile | Us. Google Sign-In or Sign in with Apple as well, if you use them |
| Phone number | Yes | Your profile, and only if you give one | Us. Google Sign-In as well, if you use it |
| User identifier | Yes | Your account, and matching your purchases to it | Us, Firebase Authentication and RevenueCat. Google Sign-In as well, if you use it, for sign-in and for Google's own analytics |
| Device identifier | Yes | Delivering the notifications you have allowed | Us and Expo. Google Sign-In as well, if you use it, for sign-in and for Google's own analytics |
| Purchase history | Yes | Knowing what you own, and restoring it on a new device | Apple and RevenueCat |
| Coarse location | Yes | Google states it for its sign-in component. The app asks iOS for no location permission, and we never receive it | Google Sign-In only, if you use it |
| Other usage data | Yes | Google's own analytics for its sign-in component | Google Sign-In only, if you use it |
| Other data | Yes | Sign-in, and Google's own analytics for it | Google Sign-In only, if you use it |
RevenueCat's own privacy manifest describes purchase history as not linked to identity, which is true of that component on its own. It is not true here, because RevenueCat is identified with your user identifier, so we declare it linked.
Optional app analytics
In app versions that offer optional usage analytics, if you choose to share, T-Stop Pro uses PostHog, hosted in the EU, to understand app opens, onboarding, sign-up and sign-in attempts and outcomes, first tool actions, calculator, light-selection, modifier, gel and preset use, and purchase and restore screens and outcomes. We send event names, observation times, a few fixed categories such as the sign-in method, app version/build and platform, and a pseudonymous identifier for this app installation. We do not send your name, email, account identifier, onboarding answers, lighting setups or calculation values to PostHog. We do not record your screen or use these events to follow you across other companies' apps and websites. You can decline without losing any features and change your choice in Account Settings. Turning sharing off stops future collection and discards pending events; it does not automatically delete events already received. Actions taken before consent are not replayed later.
What the app does not collect
The app contains no crash-reporting SDK, no advertising SDK and no tracking SDK. It has no advertising identifier and shows no tracking permission prompt, because there is nothing to ask you for. We do not track you across other companies' apps or websites, and we do not build an advertising profile of you.
If you sign in with Google, Google's sign-in component may collect identifiers and usage data for Google's own analytics, as set out in the table above.
The app asks iOS for no camera, photo library, microphone, location or contacts permission, and no code in it uses any of them. Your calculations, the fixtures you look at, and the setups you save are not sent to us for analysis. Saved setups are stored on your device only.
3. What the website collects
Waitlist and calculator sign-up
If you join the waitlist, or enter your details to use the online calculator, we store your first name, last name, email address, which platform you said you are interested in, where the sign-up came from, and the date and time. This is stored in a database on our own server, and your details are also sent to Loops (loops.so), our email provider, so we can email you about the launch and about the app.
Every email we send includes an unsubscribe link, and using it stops the emails. There is no unsubscribe page on this website, so if you no longer have one of our emails, email james@tstoppro.com and we will unsubscribe you. You can also ask us to delete the record entirely. Nothing you calculate is sent to us.
Feedback board
The feedback board at feedback.tstoppro.com uses Google Sign-In. If you use it, we receive the name, email address, user identifier and basic profile details that Google supplies. The board stores your suggestions, comments, votes and attachments, the name displayed with your contributions, and whether you want updates about feedback you interact with. It may also store private contact fields you choose to supply when you submit feedback.
Your display name, suggestions, comments, vote totals and any attachment you post are publicly visible to anyone, including people who are not signed in. Your email address and any private contact fields are stored but are not shown publicly. The board's database, authentication and file storage are provided by Supabase, and its web interface is hosted by Netlify. Google, Supabase and Netlify may also process ordinary connection and security logs, such as your IP address, browser or device information and timestamps.
Analytics and advertising on the website
If you choose Allow analytics in the website banner, the website uses PostHog, hosted in the EU, to record pseudonymous product events: a landing view, calculator opening and successful waitlist submission. The event contract reserves an App Store link-click event only when a real outbound link is available and clicked. It is not used until you make that affirmative choice. The native app also bundles a PostHog library for the optional app analytics described above. No advertising tracking is present in either.
- PostHog has session recording and autocapture switched off. We do not send it your name, email address, phone number or calculator form contents.
Spam protection
Our sign-up forms are protected by Cloudflare Turnstile, which checks that a submission is from a person rather than a bot. Cloudflare receives your IP address for that check. We also apply a rate limit by IP address, which is held in memory only and never written to our database.
4. Why we use your data, and our lawful basis
| What we do | Lawful basis (EU GDPR / UK GDPR, as applicable) |
|---|---|
| Create and run your account; deliver the app's features | Performance of a contract with you |
| Use RevenueCat to process in-app purchase and subscription records for entitlement delivery, billing, restoration and refunds | Performance of a contract with you |
| Send notifications you have allowed in iOS | Your consent, which you can withdraw in iOS Settings |
| Answer your support messages | Performance of a contract with you; legitimate interests |
| Run the feedback board, publish contributions you submit, and provide updates about them | Performance of a contract with you; legitimate interests in improving T-Stop Pro |
| Send you launch and product emails after you join the waitlist | Your consent, given when you signed up. Withdraw it at any time. |
| PostHog pseudonymous product analytics on the website | Your affirmative consent, given in the analytics banner |
| Spam protection, rate limiting, keeping the service secure | Legitimate interests in protecting the service |
| Prevent a deleted account or its associated data from being recreated by old devices or delayed service events | Compliance with our data-protection obligations and our legitimate interests in enforcing deletion and protecting the service |
5. Who else processes your data
We use the following providers in different roles. Apple is the independent App Store merchant for current in-app purchases. Stripe would process payments only if web purchases are enabled in future. The other providers supply the services described in the table below.
Our own copy of your waitlist or calculator sign-up is stored on a server in France, inside the EEA. Your email address is separately sent to Loops, our email provider, which is in the United States.
Several of the other providers are based in the United States, so some data does go outside the EEA and the UK. Those transfers rely on the European Commission's Standard Contractual Clauses and, where UK data protection law applies, on the UK International Data Transfer Addendum, as set out in each provider's terms.
| Provider | What it does | Where |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, Cloud Run and Google Sign-In) | App and feedback-board sign-in, account storage, our backend, and Google's own analytics for its sign-in component | US |
| Apple | App distribution, Sign in with Apple, in-app purchases and push delivery | US / Ireland |
| Expo | Push-token registration and notification relay | US / global |
| RevenueCat | Purchase and entitlement records | US |
| Stripe | Payment processing for web purchases, if enabled in future | US / Ireland |
| Loops | Email to waitlist sign-ups | US |
| Supabase | Feedback-board database, authentication, file storage and realtime updates | Project cloud region / US provider |
| Netlify | Hosting the feedback-board web interface | Global / US |
| PostHog | Website product analytics | EU |
| Cloudflare | Bot protection on our forms, using Cloudflare Turnstile | Global |
| Hostinger | The virtual private server that runs tstoppro.com and stores waitlist sign-ups | France (EU) |
We do not sell your personal data, and we never have. We will disclose data if the law requires it, or to establish or defend a legal claim.
6. How long we keep it
- Account and profile: for as long as your account exists. Account deletion removes the live sign-in and profile records as described below.
- Push tokens: while they are needed to deliver notifications to your signed-in device. We remove or stop using them when they are no longer valid or are no longer needed for that purpose.
- Purchase and subscription records: deleting your T-Stop Pro account does not cancel an Apple subscription or erase records held by Apple. We submit the identified RevenueCat customer for deletion. If an uncancelled subscription or restored store receipt is used later, Apple and RevenueCat may continue to process it for billing, restoration and refunds under a new anonymous RevenueCat identity. T-Stop does not retain the deleted account's profile, notification records, entitlement projection, webhook body, preorder or pending claim as a tax record.
- Deletion record: after an account is deleted, we keep a one-way account reference, operation status and timestamps for as long as needed to finish the request and prevent old devices or delayed service events from recreating the account. While RevenueCat cleanup is pending, the record also holds an encrypted customer identifier which only the deletion worker can decrypt; it is destroyed within 30 days after confirmed deletion. Cleanup runs at least daily and any detected identified RevenueCat customer is submitted for deletion or retried within 24 hours. We keep the cleanup open until RevenueCat confirms removal and escalate it manually before destroying the encrypted identifier if confirmation is still outstanding. The record contains no raw UID, email or provider identifier, name, notification token, provider credential or purchase details. We use it to fulfil your deletion request and to protect our service and your privacy. We keep the one-way reference only while a supported app or provider can still use the deleted identifier, review that need at least annually, and delete it when recreation is no longer possible. The one-way reference is mirrored in a separate deletion-control store so restoring an older database backup cannot restore the account without the deletion being reapplied first.
- Waitlist and calculator sign-ups: until you unsubscribe or ask us to delete the record, and in any case reviewed once the launch campaign has finished.
- Feedback board: account and private contact details are kept while your board account is active or until you ask us to remove them. Public contributions are kept while they remain useful to the product discussion; if the identifying link is no longer needed, we delete or anonymise it.
- Website analytics events: retained by PostHog under its own retention settings.
- Optional app-usage events are stored in our EU PostHog project. Automatic deletion is not currently active for this project, so events may remain until removed through PostHog's deletion tools. Turning sharing off stops new events and discards pending events; it does not erase events already received. For a privacy or deletion request, contact james@tstoppro.com. We do not send your account identity to PostHog, which can limit our ability to find events belonging to a particular person.
7. Deleting your account
You can delete your account from inside the app, in Account Settings. Deleting your account removes your sign-in, profile, registered notification devices and server-side account data. It removes saved setups and cached account data from the device making the request; other devices are signed out when they next connect. Apple and RevenueCat may continue to process purchase and subscription records for billing, restoration and refunds. A minimal one-way deletion record is kept as described above so old services cannot recreate the account. Apple subscriptions must be cancelled separately. Deleted live Firestore data can remain beyond deletion only in access-restricted backups until automatic expiry, currently no more than 98 days; operational logs expire after 30 days.
To delete a waitlist or calculator sign-up, email james@tstoppro.com and we will remove the row from our database and the contact from Loops.
To remove your feedback-board account, private contact record or contributions, email james@tstoppro.com from the address you used on the board.
8. Your rights
Where the EU GDPR or the UK GDPR applies to you, you have the right to ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you have given. Withdrawing consent does not affect anything we did before you withdrew it.
Send any request to james@tstoppro.com. We will respond within one month. There is no charge.
If you think we have handled your data badly, please tell us first so we can fix it. You also have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where you think the problem happened. For example, that is the CNIL in France and the ICO in the United Kingdom.
9. Security
All traffic to the app and the website is encrypted in transit. The app's account and catalogue database is locked down so that no client can read or write it directly: the app reaches data only through our own authenticated backend, and a user can only ever read or change their own record. Entitlement flags can be written by our payment provider's verified webhook alone, never by a client. The feedback board deliberately serves public contributions, but its public views do not include the private email and contact records stored with the board account.
10. Children
T-Stop Pro is a professional tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
If we change what we collect or who processes it, we will update this page and change the date at the top. If a change materially affects you we will also tell you in the app or by email.
12. Contact
James Coote, T-Stop Pro.
james@tstoppro.com