Privacy policy

• Flickerfield asks for no sign-up of any kind, so your identity never reaches us.
• The phone keeps your session log, notes and settings in its own database. Nothing is synced to a cloud or backed up to us.
• Your mood scores and notes are the most private part of the app. They stay on the phone unless you choose to export them.
• We read no advertising identifier and run no ad tracking or ad SDK. We neither sell nor share personal information, and none of it feeds a profile or an automated decision.
• Only two outside companies ever receive data from the app. RevenueCat handles purchases. Sentry gets crash reports, and only from builds made with a Sentry key.
• The website drops no tracking cookies, so it needs no cookie banner.

The controller of this data is Kallos Labs LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States. Write to support@flickerfield.app.

A human reads every privacy question: Kallos Labs LLC, support@flickerfield.app. The law does not require us to have a data protection officer. Should that ever change, this page will name one.

We have appointed no Article 27 representative in the EU or the UK, and you lose nothing by that. Send any request to support@flickerfield.app, where a person reads and answers it.

The site has no contact form. You email us from your own mail client, and that thread, in your mailbox and ours, is the whole record of your message.

Before and after each session the app asks you to rate your mood, and it offers a field for a note. Put those next to a record of when and how long you sat with the light, and a regulator could fairly call it health data. Article 9 of the UK and EU GDPR names that a special category. Several US states use the term consumer health data. We handle it with that level of care, whichever label fits.

What that means in practice:

• Mood scores, notes and session records go into the app’s SQLite database on the phone. They are not copied anywhere else.
• We never receive them. We operate no server built to accept them, and the app contains no code that uploads them.
• No outside company receives them either. RevenueCat sees none of it. Neither does Sentry, whose crash reports hold a stack trace and device details but nothing from a session.
• They play no part in advertising. We do not sell them or share them for cross-context behavioural ads.
• We draw no inferences from them and build no profile. The figures in your log are plain sums worked out on the phone from your own entries.

Your mood score is simply the number you tapped on a scale of one to five. It is not a diagnosis, the app never turns it into one, and you are the only person who sees it.

Since none of it reaches us, a deletion request has nothing to act on here. Erasing it is done on the phone. If you turned on an iCloud or Google backup, that backup may hold the app’s storage. It belongs to your Apple or Google account, and we have no access to it.

The log can be saved as a CSV file. That button is how the app honours your right to data portability.

Each session becomes one row, mood scores and notes included. We play no part in the export. The app writes the file to its own temporary folder, then your phone shows its share sheet. You decide where the file goes. After you send it, the copy is governed by whichever service received it, so be careful about handing it to anyone else.

Remove the app and its data goes with it. Uninstalling wipes the app’s storage: every session, mood score and note, plus your favourites and settings. No second copy exists, so nothing remains. To keep the app but clear it, use the “Delete all my data” button in Settings, which empties every table and starts the app fresh. Single sessions can be removed from the log screen.

Data held outside your phone (an email you sent us, a purchase record at RevenueCat) is covered on our data deletion page. In short, email support@flickerfield.app. When the deletion is finished, we tell you so in writing.

Apple and Google both show shoppers what an app collects. We filled in both forms from the tables here, so the store pages, this policy and the app’s code say the same thing.

App Store privacy label

Google Play data safety

Both answers say no tracking, and that is accurate. The app reads no advertising identifier, sends nothing to data brokers, and never merges its data with what other companies gather in their apps or on their sites. You will not see the iOS tracking permission prompt, because the app has no reason to show it.

Who gets what:

• RevenueCat receives the store receipt, an anonymous App User ID created on the phone, the platform and the app version. It never gets your name, your email or anything from your log.
• Sentry receives a stack trace and device details, and only from builds made with a Sentry key. Session content is never part of it.
• Apple and Google sell you The Color Spectrum and hold your payment details. No card number ever reaches us.
• No service relays your email. You write from your own mail app. One copy sits with your mail provider and one with ours, and that is all.

Below is each company that may handle personal data on our behalf, its task and its location. A written data processing agreement binds every one of them, and none may use the data for anything beyond the task we gave it. Any newcomer is added to this list before its work begins.

Apple and Google do not count as sub-processors. They sell The Color Spectrum to you as merchants of record and follow their own policies.

Once the purpose behind a piece of data ends, so does our reason to keep it.

Only builds made with a Sentry key can report crashes. In any other build the reporting code sits idle with no destination, so nothing goes out. The app has no toggle for this yet. If you want no crash reports at all, email support@flickerfield.app and we will check whether your build reports. Should we add a toggle, it will show up in the app and on this page at the same time.

• Performance of a contract (Art. 6(1)(b)): completing your purchase ofThe Color Spectrum, restoring it, and replying to a support email.
• Consent (Art. 6(1)(a)): crash reports, where consent is the right basis. Email us to withdraw it.
• Legal obligation (Art. 6(1)(c)): dealing with a request to access or delete data, and recording that we dealt with it.
• Legitimate interests (Art. 6(1)(f)): fixing crashes, counting website visits in aggregate and keeping the referral click log. We weighed these against your interests, and none of them can identify you.
• No Article 9 basis is needed for mood scores, notes or session records. We never receive them. You process them yourself, on your own phone.

We make no decision about you by automated means that has a legal or similarly serious effect, and we do no profiling, as Article 22 of the UK and EU GDPR uses those terms. Nothing rates you, forecasts your behaviour or chooses on your behalf. Your mood score never drives a suggestion. The numbers in your log are totals and averages of your own entries, worked out on the phone.

Where you live decides which of these rights apply. They can include: learning what we hold and receiving a copy; having it fixed or erased; limiting how we use it; getting it in a portable format; objecting to processing we base on legitimate interests; withdrawing consent whenever you like; and not being penalised for making a request.

Making a request. Send an email to support@flickerfield.app describing what you want. No form, no portal, no legal citation needed. A single line such as “delete everything you have about me” is enough.

Much of your data is beyond our reach. The session log, mood scores and notes are on your phone. We have no copy to send (the CSV export gives you one), and we cannot erase them remotely. The deletion section above explains how.

Confirming your identity. There are no accounts, so an email address is all we can match. We reply to the address that sent the request. We may also ask about something we already know, such as roughly when you last wrote or what about, so your messages never go to a stranger. We will never ask for an ID document or a photo of one.

Response time. We reply within one month of receiving your request. The deletion page states this as 30 days, and usually we are far quicker. A complex request may need up to two more months. If so, we tell you within the first month and explain the reason.

Cost. Requests are free. If someone sends so many that they become excessive, we may charge a reasonable fee or refuse, and we will tell you which and why.

Agents. Where the law permits, someone you authorise may make a request for you. We will ask that person for proof and check with you directly.

Complaints. Telling us first is often quicker, but it is not required. You may go directly to your regulator. Each regional section below names the right one.

The website respects Global Privacy Control. In practice there is nothing for the signal to stop. We sell no personal information, we share none for cross-context behavioural ads, and we place no tracking or ad cookies. A browser that sends GPC, or the older Do Not Track header, gets the same site as everyone else. Should we ever add something that qualifies as a sale or share, a GPC signal will opt you out the moment we receive it.

For readers in the United Kingdom, you are protected by the Data Protection Act 2018 alongside the UK GDPR, and you hold every right described above. To raise a concern about us, contact the Information Commissioner’s Office through ico.org.uk, by letter, or by phone on 0303 123 1113.

Readers in the European Economic Area are covered by the EU GDPR and hold the same rights. Kallos Labs LLC is not established anywhere in the EU or in the UK. No lead supervisory authority oversees us as a result, and the GDPR one-stop shop offers no route for a complaint about us. You may complain to the data protection authority where you live, where you work, or where the issue arose, and that authority will handle it. We have appointed no Article 27 representative in the EU or the UK, and you lose nothing by that. Send any request to support@flickerfield.app, where a person reads and answers it.

This section covers California law: the California Consumer Privacy Act, together with the amendments the CPRA made to it. Over the last 12 months we collected the categories below from three sources. You supplied it when you emailed us. Your device or browser supplied it when you loaded a page or followed a referral link. RevenueCat supplied it when it confirmed that your subscription was active.

No sale and no sharing. In the CCPA’s sense of those words, we neither sell your personal information nor share it for cross-context behavioural ads. That has been true for the last 12 months, and it covers people under 16 too. The service providers listed above receive personal information only to carry out their task for us.

You can ask to know what we hold, to receive a copy, to have it deleted or corrected, and to opt out of a sale or share, though none takes place. You may also limit our use of sensitive personal information. We hold none, so that right has nothing to act on. Asking will never count against you. Email support@flickerfield.app.

Virginia, Colorado, Connecticut, Utah, Texas and Oregon have each passed a consumer privacy statute. We apply one standard to every state instead of a patchwork. You may confirm what we hold and receive it, fix errors, have it erased, carry it elsewhere, and refuse targeted ads, sale and profiling. We engage in none of those three. We honour opt-out signals like Global Privacy Control, and we process no sensitive data.

In several of those states you may appeal if we refuse a request. A refusal from us always gives the reason and the appeal route. To appeal, email the same address with “appeal” in the subject, and we will respond within 45 days. If you are still unhappy, you can turn to your state attorney general.

Brazil. Under the LGPD you may confirm that we process your data, access it, correct it, have it anonymised or deleted, port it, learn who we share it with, and withdraw consent. Write to the same address. You may also complain to the ANPD.

Canada. PIPEDA, and the provincial laws like it, let you see what we hold and dispute whether it is accurate. Complaints go to the Office of the Privacy Commissioner of Canada or to your province’s commissioner.

Australia. The Privacy Act 1988 and its Australian Privacy Principles let you access and correct your data. Raise a complaint with us first, then with the Office of the Australian Information Commissioner.

RevenueCat, Sentry, Supabase and our host are based in the US and may handle data beyond the UK and the EEA. Every such transfer rests on one of three safeguards: the UK International Data Transfer Agreement or Addendum; the European Commission’s standard contractual clauses; or the provider’s certification under the EU-US Data Privacy Framework and its UK extension. The sub-processor table shows which applies. Your session log never crosses any border, because it never leaves the phone.

Should personal data in our care be lost, leaked or stolen, we start investigating straight away and work to contain it. When the law calls for it, we report to the relevant supervisory authority within 72 hours of learning of the breach. In the EU that means the authority in every country with affected people, because no lead authority covers us. In the UK it means the Information Commissioner’s Office. If the breach is likely to put your rights and freedoms at high risk, we contact you directly and promptly, explaining what happened, how it affects you and what you can do. Anyone we cannot reach personally will find a notice on this page and in the app.

How we built things keeps any breach small. We store no passwords, no card numbers, no health information and no accounts. At worst, someone could obtain the email addresses of people who wrote to us and what they wrote.

Only adults aged 18 or older should use the app. We do not aim it at children, we do not knowingly collect data from anyone below 18, and the store ratings reflect that. The app never asks a child for anything, since it has no sign-up.

Parents and guardians: if you think a person under 18 used the app and that something about them reached us (a contact message, a support email), email support@flickerfield.app and we will erase it and let you know. You do not need to prove anything. Their session log lives on the phone and is removed along with the app.

Data on the phone lives in the app’s private storage, guarded by the operating system’s sandbox and by your passcode. Whatever does leave a phone is sent over TLS. Only server-side code with a secret key can reach our database, and no browser can ever read the contact message table.

Vendor dashboards are open only to the people who need them, and each login requires two-factor authentication. Above all we gather very little, since data we never hold cannot be exposed.

This policy may be revised. Each revision updates the date and version at the top and is added to the list below. For a material change, the app will alert you before it applies. If a revision would mean collecting a new kind of data, we will ask you first.

Kallos Labs LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States · support@flickerfield.app. The terms of use sit alongside this policy.

Effective 9 November 2026 · version 1.4