2mins
Privacy policy
The short version
- You sign in with Apple or Google to use 2mins. We store the account ID they give us and your email (and your name if you share it). You can delete your account in the app at any time.
- We record a few simple reading events (which card you read and for how long, how your sessions end) and delete them after 90 days.
- The app also uses a random ID it makes up on your phone, never your phone's advertising ID.
- No ads, no advertising or analytics SDKs, and we never sell your data.
Who we are
2mins is run by [operator legal name and address] (“we”, “us”). We are the controller of the personal data described here. Contact us at [email protected] about anything in this policy.
What we collect
Your account
You need to sign in with Apple or Google to use 2mins. When you do, we receive and store:
- the account ID Apple or Google gives us for you;
- your email address (with Apple this may be a private relay address if you choose to hide your email);
- your name, only if you choose to share it;
- sign-in tokens that keep you signed in (we store them in a scrambled, hashed form).
We never see or store your Apple or Google password.
Your device
- A random device ID. On first launch the app creates a random identifier and keeps it on your phone. It is not your phone's advertising ID or hardware ID, and we don't use fingerprinting. The app sends it to our server to get a signed token, which it stores in your phone's secure storage.
- Platform and app version (for example “ios” and “1.0.0”), so we can fix problems on a particular version.
- When the device was last seen by our server.
When you sign in, this device record is linked to your account.
Reading events
The app saves these on your phone and sends them to us in small batches when you're online. Each one is tied to your device ID (and so to your account) and has the time it happened on your phone and the time we received it.
| Event | What it contains |
|---|---|
| Card read | Which card, its topic, and how long it was on screen |
| Check-in answer | Your answer when your time is up: “done” or “one more” |
| Session | How long the session lasted, the time limit you had set, and whether you stopped within it |
Server logs
When the app talks to our server, the server's logs record technical details such as your IP address, the time and the request made. We use these only to keep the service secure and to fix faults, and keep them for [log retention period].
What stays on your phone
Your chosen topics, settings, which cards you've read, your session history and the downloaded daily decks are stored on your phone. They aren't sent to us, except as the events listed above.
What we don't collect
- No advertising ID, location, contacts, photos or microphone.
- No ads, no ad SDKs and no third-party analytics or tracking in the app or on this website.
- The app does not currently send crash reports. If we add them, we will update this policy first.
How we use it, and our legal basis
- To run the app: sign you in, deliver daily decks and let you delete your account. The basis is performing our agreement with you (our terms).
- To understand and improve 2mins: which topics and cards people read, how long reading takes and whether the time limit helps people stop. The basis is our legitimate interest in making the app work well; we use the least data we can and keep it for a short time.
- To keep the service secure: rate limits, abuse prevention and fixing faults, also based on legitimate interests.
We don't use your data for advertising, we don't build profiles about you for anyone else, and we never sell it.
How long we keep it
- Reading events: 90 days from when we receive them. A scheduled job deletes older events automatically every day.
- Account and device records: until you delete your account. Deleting your account in the app deletes your account details, sign-in tokens, device records and reading events.
- Server logs: [log retention period].
Who we share it with
We use a small number of service providers who process data for us under contract:
- Cloudflare delivers the daily decks (from cdn.2minsapp.com) and protects our servers. It processes your IP address to do this.
- [server hosting provider] hosts our server and database.
- Apple and Google sign you in, depending on which you choose. Their own privacy policies cover what they do.
We use AI tools to help draft cards from public sources such as Wikipedia. None of your data is sent to them. We may also disclose data if the law requires it.
International transfers
Some of our providers may process data outside the UK. When they do, we rely on UK adequacy regulations or approved safeguards such as the UK International Data Transfer Addendum.
Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have it corrected if it's wrong;
- have it deleted;
- restrict or object to how we use it (including our use based on legitimate interests);
- receive a copy in a portable format.
Delete your account any time in the app under Settings → Account → Delete account. To use any other right, email [email protected] from the address on your account. We'll reply within one month.
If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put it right first.
Children
2mins is not meant for children under 13, and we don't knowingly collect data from them. If you think a child under 13 has given us data, contact us and we'll delete it.
Security
All traffic between the app and our servers is encrypted (HTTPS). Device tokens are kept in your phone's secure storage, and sign-in tokens are stored hashed on our side.
This website
2minsapp.com uses no cookies, analytics or third-party scripts. Like any website, the server that delivers it may briefly log your IP address to keep it running.
Changes to this policy
If we change this policy we'll update the date at the top, and if the change is significant we'll tell you in the app before it takes effect.
Contact
Email [email protected].