Privacy Policy

Barney - Communication Translator

Introduction

Barney ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.

Please read this Privacy Policy carefully. By using Barney, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Information You Provide Directly

Account Information: - Username - Email address - Password (hashed using industry-standard algorithms — never stored in plain text)

Profile Information: - Communication traits you choose to record. These describe how you communicate, not what you are called: for example "I take things literally", "I need processing time before I respond", or "I go quiet or shut down under stress". You can also add your own in your own words. See "Special Category Data" below - Connection and pairing information for the people you communicate with through the app

Content You Create: - Translation entries (what was said, what was meant, how it was heard), including the context you give about what was happening and how it felt - Repair suggestions, whether you accepted them, and any feedback you give on them - Navigate sessions: the topic, what tends to set you off, and what you need to stay present - Warm Words you save or send

Safety Reports: - If you report someone you are connected with, we keep the report: who reported whom, the reason you chose, anything you write in your own words, which connection it concerned, and when. We need it to look into what happened and to act on it - A report is also information about the person reported. If someone reports you, that report exists and we will read it. We do not show them your account details, and we do not pass reports to anyone else unless we are legally required to - Reports outlive deleted accounts. See "Data Retention" below for why

Information Collected Automatically

Very little, and less than most apps.

• Push notification token, if you turn notifications on. This is required to deliver a notification when someone you are connected with sends you something. We also keep a short record of whether each notification was delivered, so we can stop sending to a device that has stopped accepting them.

That is the whole list.

Barney contains no analytics or crash-reporting software. There is no Google Analytics, no Firebase Analytics, no Sentry, and no equivalent. We do not collect:

• Your device type, model, or operating system version
• Which features you use, or when you use them
• App performance, crash, or error data
• Location data
• Contact lists
• Photos or media
• Browsing history
• Financial information

Special Category Data (Health / Disability)

The communication traits you can tick describe behaviour, not conditions. None of them names a diagnosis. However, you can also add your own traits in your own words, and what you write there may name a condition. What you write in a translation may also reveal something about your health.

We therefore treat your recorded traits as special category data under UK and EU GDPR (Article 9) and process them on that footing, rather than relying on the tickbox wording to keep them out of scope.

We process this data only:

• With your explicit consent, given by adding the trait to your profile
• For the specific purpose of personalising your repair suggestions — your traits are included in the prompt sent to our AI processor (see "Service Providers" below) so that suggestions account for your communication style
• Subject to your control — you can remove a trait at any time from your profile, and you choose per-relationship which traits to disclose to which connection

You can withdraw your consent at any time by removing traits from your profile or deleting your account.

How We Use Your Information

We use the information we collect to:

• Provide the Service: Process your translations, connect you with the people you pair with, and deliver personalised repair suggestions
• Communicate: Send important updates about the service (you can opt out of non-essential communications)
• Ensure Security: Detect and prevent fraud, abuse, or security incidents
• Legal Compliance: Meet our legal obligations

We do not: - Sell your personal information to third parties - Use your relationship content for advertising - Share your translations with anyone except the person you have paired with for that translation - Use your conversations to train any AI model (see "Service Providers" for how AI processing works)

How We Share Your Information

With Your Connections

When you pair with someone in the app, they can see: - Your username - Content you choose to share in translations or messages with them specifically - Traits you have explicitly chosen to disclose to that connection

With Service Providers

We share information with third-party service providers who help us operate the app. Each is contractually obligated to protect your information and only use it as we direct.

About AI processing (Anthropic): Translation text is sent to Anthropic's Claude API to generate repair suggestions. Anthropic acts as a processor on our behalf, and under their commercial terms your data is not used to train their models. They may retain inputs and outputs for a limited period for trust and safety purposes. We do not share your data with Anthropic for any purpose other than generating the specific suggestion you requested. We do not attach your name, username, email address or any account identifier to what we send — the request refers only to "sender" and "receiver". What you typed is sent as you wrote it, so if you have named someone in a translation, or written a name into one of your own traits, that name goes with it.

Legal Requirements

We may disclose your information if required by law, such as in response to a court order or legal process.

Business Transfers

If Barney is acquired or merged with another company, your information may be transferred as part of that transaction. We will notify you of any such change.

Data Storage and Security

Where We Store Your Data

Your data is stored on secure servers provided by Hetzner Online GmbH, located in Germany (European Union). Some processing transits through service providers based in the United States — see "International Data Transfers" below.

How We Protect Your Data

We implement appropriate technical and organisational measures, including: - Encryption in transit: All data is transmitted over HTTPS/TLS - Password hashing: Industry-standard hashing algorithms (PBKDF2) - Authentication: JSON Web Tokens with rotation, stored securely on your device - Access Controls: Only authorised personnel can access user data - Network restrictions: Administrative access to our infrastructure is restricted to a private VPN

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

Data Retention

We retain your information for as long as your account is active or as needed to provide the service.

Deleting your account

You can delete your account yourself, at any time, from Settings inside the app. You do not need to email us and you do not need our permission. Deletion happens immediately, and it cannot be undone.

Because the record you build in Barney is shared with the person you paired with, you choose what happens to it:

• Delete my account only. Everything that identifies you is destroyed straight away: your name, email address, password, recorded traits, disclosure choices and push notification token. The conversations you both took part in stay with your connection, and you appear to them as "Someone who left".
• Delete everything, including our shared history. Your account is destroyed and the shared record is deleted as well. This removes those conversations for the other person too.

After deletion: - Some information may remain in encrypted backups for a period after your account is gone. Routine backups are kept on a rolling 14-day cycle. Encrypted off-site copies are currently held for longer while we finalise our backup retention schedule, and we will update this policy once that schedule is set - Safety reports are kept for 24 months, including the username they were made about, and are then deleted automatically. If someone reported you, deleting your account does not immediately delete the report. This is deliberate: otherwise anyone could erase a report about themselves by deleting their account and signing up again, and reporting would be worthless to the person who needed it. Your account record is still destroyed — what survives is the report and the username it named. We rely on our legitimate interests in protecting people using Barney from abuse, which UK GDPR Article 17(3) allows as an exception to erasure. Legitimate interests are not unlimited interests, which is why there is a fixed 24-month limit rather than an open-ended one

You can also ask us to delete your account by email if you prefer, using the address at the end of this policy. See "Your Rights" below.

Your Rights

Depending on your location, you may have the following rights:

For All Users

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Export: Download your data in a portable format

For UK / EU Users (UK GDPR / EU GDPR)

• Right to be Forgotten: Request complete deletion of your data
• Data Portability: Receive your data in a machine-readable format
• Withdraw Consent: Withdraw consent for data processing at any time, including for special category (trait) data
• Restrict Processing: Ask us to stop processing your data while you contest its accuracy
• Object to Processing: Object to processing based on legitimate interests
• Lodge a Complaint: File a complaint with the UK Information Commissioner's Office (https://ico.org.uk) or your local EU data protection authority

For California Users (CCPA / CPRA)

• Right to Know: What personal information we collect and how it's used
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out of Sale / Sharing: We do not sell or share personal information for cross-context behavioural advertising
• Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise any of these rights, contact us at the email address below. We will respond to your request within 30 days.

Children's Privacy

Barney is not intended for children. We do not knowingly collect personal information from: - Children under 13 (United States, in line with COPPA) - Children under 16 (United Kingdom and most of the European Union, in line with UK GDPR / EU GDPR)

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately and we will delete the account.

Third-Party Links

The app may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by: - Posting the new Privacy Policy in the app and at this URL - Updating the "Last updated" date - Sending a notification for significant changes

Your continued use of the app after changes constitutes acceptance of the updated policy.

International Data Transfers

Our primary servers are in Germany (EU), so your account and your conversations are stored inside the EEA. Some of our service providers (Anthropic, Expo, Google, Apple) are based in the United States. Where data is transferred outside the UK or EEA, we rely on the appropriate safeguards in place between those providers and us, which are the EU Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, or an equivalent approved mechanism.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

Email: lisa@harnessthespark.com

Data controller: Harness the Spark Ltd, a company registered in England and Wales, company number 12936448.

Registered office: Forma House, 40 Bowling Green Lane Farringdon, London EC1R 0NE United Kingdom

We will respond to your request within 30 days.

Governing Law

This Privacy Policy, and any dispute arising out of it or out of our handling of your personal data, is governed by the law of England and Wales, and any dispute may be brought in the courts of England and Wales.

If you live elsewhere in the UK or in the European Union, you keep the benefit of any mandatory data protection and consumer rights that apply where you live, and you may bring a claim, or complain to your local data protection authority, in your own country.

Summary

We never sell your data. Your conversations are private. Traits you record are special category data and are only processed with your explicit consent.

This Privacy Policy is effective as of 16 August 2026.