Terms of Service

1.Who this agreement is with#

The hosted Notchr service at notchr.app is operated by an individual trading as “Notchr” (“Notchr”, “we”, “us”). These terms are the agreement between us and you, the person who keeps a ledger on that service. By creating an account or signing in, you accept them.

Notchr also exists as software you can run yourself on your own machine. These terms cover the hosted service only. If you run your own copy, you are your own operator and nothing here applies to it.

2.Who can use Notchr#

You must be at least 18 years old and able to enter a contract where you live. Notchr is a record of an adult sexual and romantic history, and there is no version of it that is appropriate for a minor. Accounts belonging to anyone under 18 are closed as soon as we become aware of them.

An account is for one person, or for one couple or small group who choose to keep a ledger jointly and say so when they create it. Everyone who is to read it registers their own passkey for it; you may not let anyone sign in as you, and you may not pass your passkey around. If you want a second ledger, create a second account.

A jointly kept ledger has no private corners. Every passkey on the account opens all of it, and anyone holding one can read, change and delete anything in it, including entries somebody else wrote. We cannot tell the holders of an account apart, so we cannot take sides between you, split a ledger, or remove one person's entries at another's request. Agree between yourselves before you keep one this way, and if you stop agreeing, the remedy is in your hands: remove the passkey you no longer want on the account, from Settings.

3.Your account is a passkey#

There is no email address, no password and no username. An account is its passkeys: you create the first one at sign-up, and you can register more from Settings for every device you trust. Any registered passkey can both sign in and unlock the ledger, and removing one takes away both of those abilities for that passkey.

What the account does have is a name for correspondence: its account reference, three random words shown at the top of Settings. Quote it when you write to us — about support, a refund, a data request or a deletion — and we can tell which ledger you mean without ever holding your name or your email address, from any address you choose to use. It is not a credential: it cannot sign in, unlock the ledger or decrypt a single field. Treat it as yours all the same, because it names your account to anyone holding it, so give it to us and to nobody else. The data protection page sets out how we use it.

While Notchr is in early access, sign-up may require an invite code. You agree not to pass an invite code on to anyone you would not vouch for, and not to create accounts in bulk.

You are responsible for the devices and authenticators that hold your passkeys, and for the passcode, fingerprint or face unlock that guards them. Anybody who can use your passkey can read your ledger. If a device is lost or a passkey is compromised, remove it from Settings using another one.

4.There is no recovery. None.#

This is the most important clause in this document, so it is not written in legal language.

You accept that risk as a condition of using the service, and you accept that we are not liable for data you lose this way (see clause 15). Two sensible precautions: register a passkey on more than one device, and use an authenticator that syncs and backs up your passkeys.

The same applies to correcting or restoring your data. We cannot edit an entry, undo a deletion or rebuild your ledger, because to us all of it is ciphertext.

5.What Notchr is, and what it is not#

Notchr is a personal record-keeping tool: a private ledger of partners, dates, places, photos and notes, with statistics, badges and a map computed from it in your own browser.

It is not, and is not offered as:

• a dating, introduction or matchmaking service — there is no way to meet anyone through Notchr;
• a social network — there is no feed, no profile others can see, no sharing and no discovery;
• a medical, sexual-health or contraception record, and nothing in it is health advice;
• a legal record, an evidential archive, or a backup of your photos;
• a safety or background-checking service.

Keep your own copies of anything you would be upset to lose. Notchr is the place you keep the record, not the place you keep the only copy.

6.Your ledger, and what you may put in it#

Everything you enter stays yours. We claim no ownership of it. You grant us only the narrow permission we need to run the service: to store the encrypted bytes you upload, serve them back to your own browser, and delete them when you or the account go. That permission ends when the data does. Because what we hold is ciphertext, it is also the only permission we could technically exercise.

A ledger like this is mostly information about other people, most of whom will never know it exists. That is a responsibility we cannot carry for you, so you take it on:

• you confirm you are entitled, under the law that applies to you, to hold the information and images you record about other people;
• you confirm every intimate photo you upload is one you are lawfully entitled to hold, of an adult, obtained with that person's agreement;
• you accept that details such as someone's ethnicity or sexual history are sensitive in most legal systems, and that recording them about an identifiable person carries obligations that fall on you, not on us (see the data protection page);
• you accept that if you ever use Notchr for something other than your own private, personal purposes, you take on the duties of a data controller for what is in it.

Uploads are limited to images of 10 MB or less, in the formats the app accepts, and to volumes that are plainly consistent with a personal ledger.

7.What we will not host#

You may not use Notchr to store, in any field or as any image:

• any sexual content involving a minor, in any form, at any time, for any stated reason. This is absolute. Accounts are terminated on discovery and reported to the appropriate authority;
• intimate images of anyone who has not agreed to them being made or kept, or any image obtained by deception, coercion or a hidden camera;
• content whose purpose is to stalk, harass, threaten, blackmail or otherwise target a person;
• content you are recording on behalf of someone else, or that you have obtained by hacking, theft or breach of confidence;
• anything unlawful where you are, or where the service is hosted.

You also may not use the service in furtherance of any of the above, and you may not turn a ledger into a distribution channel by handing your passkey or your unlocked device to other people.

8.Why we cannot police this, and what we do instead#

End-to-end encryption is not a loophole we grant reluctantly; it is the product. It also means we have no ability to scan, review, filter, classify or moderate what you store. No automated check runs against your notes or photos, because there is nothing readable to run it against.

What we can do, and will:

• act on credible reports sent to [email protected];
• act on a valid order from a court or authority of competent jurisdiction;
• act on abuse visible in the shape of the traffic — bulk account creation, automated hammering, storage used as a dumping ground rather than a ledger;
• terminate an account, and delete its rows, where clause 7 has been broken.

What we cannot do, and will not claim to: hand over readable content. A demand for the substance of your ledger is a demand we are unable to satisfy, whoever makes it. We can produce only the ciphertext and the structural columns described in the Privacy Policy.

9.Acceptable use of the service itself#

Separately from what you store, do not attack the thing you are using. Specifically, do not:

• probe, scan or test the security of the service except with our written permission, or try to reach another account's data;
• send plaintext where the API expects ciphertext, or otherwise try to defeat the encryption the app applies on your behalf;
• automate the interface at a rate a person could not, resell access, or run the API as a backend for another product;
• interfere with other people's use of the service, or with the infrastructure it runs on.

Security research is welcome when it is coordinated. If you think you have found a vulnerability, tell us at [email protected] before you tell anyone else, and give us a fair chance to fix it. We will not pursue good-faith research that respects other people's data.

10.Availability, early access and changes#

Notchr is in early access. It is a small service, run by one person, on infrastructure of a size that matches it. We aim to keep it up and quick, but we do not offer an uptime commitment, a support-response time or a service-level agreement, and we may take it down for maintenance without notice.

Features can change. We may add, alter or withdraw parts of the app as it develops. Where a change would remove something you rely on or make data inaccessible, we will give notice first if it is reasonably possible to do so.

Because we have no email address for you, notice means a message in the app and a note on this site. That is a deliberate consequence of a service that does not ask who you are, and you accept it as the way you will be told things.

11.Price, the trial, and what happens if you stop paying#

A new ledger is free to use in full for 30 days. Nothing is asked for to start: no card, no email address, no billing detail of any kind. After that, keeping it writable costs £24 a year in the United Kingdom, or the price we have set in your own currency, which the pricing page will show you for any country we sell in. There is no cheaper tier and no advertising-supported version, because there is nothing in your ledger we could sell and nothing in it we can read.

What you pay in. We set a price separately in each currency we sell in rather than converting the sterling one, so the figure you are quoted is a price in its own right and does not move with the exchange rate. Where we have set no price in your currency, you are quoted and charged in sterling and Stripe converts it at the day's rate on their page; that conversion is theirs, not ours.

Tax is inside the price. Every figure we show you is the whole amount that leaves your card. VAT, GST, sales tax or the local equivalent is already included in it and nothing is added at the last step. Because it is included rather than added, the same figure is charged everywhere that currency is used, and how much of it is tax depends on the country you buy from; the split shown beside a price is for information, and Stripe calculates and accounts for the real figure on the invoice.

Who you pay. The subscription is sold by Stripe, acting as merchant of record through its Managed Payments service. The Stripe company named on your invoice depends on the country you buy from. They are the seller on that invoice, they take the card and the email address it goes to, and they charge and account for VAT. We receive a subscription number, its status and its dates — never the card, and we do not store the email address. The Privacy Policy lists exactly what passes between us, and their own terms govern the checkout page.

Renewal and cancellation. The subscription renews automatically each year until you cancel. Cancel at any time from the billing portal in Settings; it then runs to the end of the period you have paid for, and the ledger becomes read-only after that. If a renewal payment fails, Stripe retries for a while before the same thing happens, so an expired card is a delay rather than a cliff.

Refunds and your right to cancel. If you are a consumer in the UK or the EU/EEA you have a statutory right to cancel a subscription within 14 days of taking it out. We keep it simpler than the statute: ask at [email protected] within 14 days of a payment, quoting your account reference, and it is refunded in full, no reason needed. The 30-day trial exists so that you can decide before paying anything at all.

Price changes. We may change the price. A rise applies from your next renewal after at least 30 days' notice in the app and on this site, and you can cancel before it takes effect. The data protection page explains how to take a copy of everything at any time, read-only or not.

Ledgers that predate this. If your account existed before the subscription was introduced, your 30 days start when it was introduced, not when you signed up. That period is also the notice clause 17 requires before a change like this one can bind an account that already exists.

12.Ending the agreement#

You can leave at any time. Stop using the service, remove your passkeys, or ask us to delete the account at [email protected], quoting your account reference so that we act on the right ledger (the data protection page explains what else we need before doing something irreversible). Deletion removes your rows — partners, dates, photos, passkeys, sessions — and what is removed cannot be restored.

We may suspend or close an account:

• immediately, where clause 7 has been broken or where we are lawfully required to;
• on reasonable notice, where you have broken these terms in another way and have not put it right;
• on at least 30 days' notice, if we discontinue the service.

If we discontinue the service we will publish the date well ahead of it, and we will not delete anything before it. Clauses 4, 6, 13, 14, 15, 16, 18 and 19 survive the end of this agreement.

13.Intellectual property#

The Notchr name, the tally-mark mark, the interface, the design and the code behind the hosted service belong to us or to our licensors, and nothing in these terms transfers them to you. You get a personal, revocable, non-transferable right to use the service as it is intended to be used, for as long as this agreement lasts.

Your content remains yours, as set out in clause 6. We will not use it to promote the service, illustrate a feature or train anything — see the AI policy — and the encryption means we could not.

14.What we do not promise#

The service is provided as it is and as it is available. Beyond what the law requires of us, we make no promise that it will be uninterrupted, error-free, fit for a particular purpose you have in mind, or that its statistics, badges or extracted dates are accurate. They are computed from what you typed.

Nothing in these terms excludes or limits the rights you have as a consumer that cannot lawfully be excluded, including under the Consumer Rights Act 2015 where it applies to you.

15.Our liability#

Nothing in this clause limits our liability for:

• death or personal injury caused by our negligence;
• fraud or fraudulent misrepresentation;
• anything else that cannot lawfully be limited or excluded.

Subject to that, and to the extent the law allows:

• we are not liable for the loss of data you cause, or that follows from the design described in clause 4 — in particular, data that becomes unreadable because passkeys were lost, deleted, reset by an operating system, or destroyed with a device;
• we are not liable for anything that happens because someone else obtained access to your device, your authenticator or your unlocked browser;
• we are not liable for indirect or consequential loss, lost profit, lost opportunity, or distress arising from the disclosure of your own records by you or by someone with access to your device;
• our total liability arising out of or in connection with this agreement is limited to the greater of £100 and the total amount you paid us in the 12 months before the claim arose.

That cap is low because the service costs a few pounds a year, and because the architecture deliberately puts your data beyond our control. It is the trade you are making: we cannot lose your secrets, and we cannot save them either.

16.Your liability to us#

If a third party brings a claim against us because of what you stored — for example, a person whose images or private information you kept without being entitled to — you will cover our reasonable losses, legal costs and any award, to the extent the claim arises from your breach of clause 6 or clause 7. We will tell you promptly about any such claim, let you take part in the defence, and not settle it in a way that binds you without asking. This clause does not apply to loss that was not caused by your breach, and nothing in it requires a consumer to pay more than the law permits.

17.Changes to these terms#

We may update these terms as the service changes or the law does. The revision number and effective date at the top of this page always tell you which version is current. For a change that materially reduces your rights or materially increases your obligations, we will give at least 30 days' notice in the app and on this page before it takes effect, unless the change is required by law sooner.

If you keep using Notchr after a change takes effect, you are accepting it. If you would rather not, close your account — clause 12 explains how.

18.Governing law, courts and complaints#

These terms and any dispute arising from them are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.

If you are a consumer resident in the EU/EEA, this does not deprive you of the protection of the mandatory consumer law of your own country, and you may bring proceedings there.

Talk to us first. Most things can be sorted out by email, and we would rather fix a problem than argue about one. Data protection complaints can also go to the regulator named on the data protection page.

19.The rest of it#

These terms, together with the Privacy Policy, the AI policy and the data protection page, are the whole agreement between us about the service.

If any part of them turns out to be unenforceable, the rest still stands. If we do not enforce something straight away, we have not given up the right to enforce it later. You may not transfer your rights under this agreement to anyone else; we may transfer ours if the service changes hands, in which case we will say so in advance and your data protection position will not be worsened by it. Nobody other than you and us has rights under this agreement.

Questions, notices and reports: [email protected].