HONEYBEACON

HoneyBeacon Privacy Policy

Version 2.2 · 28 October 2026

Who is responsible for your information

HONEYBEACON LIMITED, company number 17440812, is the controller for the personal information described here. Our registered office is 5 Semaphore Road, Guildford, GU1 3PS, United Kingdom. Contact hello@honeybeacon.app for privacy questions, support, complaints or to exercise your rights.

This is a privacy notice, not a contract or a request to waive your rights. Our Terms of Use explain the service agreement. This notice covers the HoneyBeacon app, optional cloud and family features, our website and early-access or beta forms, and information we receive to administer Kickstarter rewards.

The essentials

Core focus sessions, Screen Time blocking, schedules, rewards and Wake alarms operate on your device. Optional cloud accounts support backup, Family Hive and Bee Together. We use pooled feature counts to improve HoneyBeacon, with a visible notice and an easy off switch. Our aggregate-count policy offers an opt-out in the UK, US, Australia and New Zealand; elsewhere, or if the country is unknown, sharing stays off unless an adult agrees. Session recording and automatic tracking are disabled. Optional AI milestone wording and reward-emoji suggestions also require a separate adult choice. Setup answers stay on your device unless you separately choose to share your own answers for adult research. Skipping setup questions does not upload optional answers.

Family and Bee Together features share information with the people you join. Family, Bee Together and hive photos are stored in private object-storage buckets. Authorised members receive short-lived signed URLs to view them. Anonymous public bucket access is disabled. Anyone who receives a signed link may use it until it expires, even without a HoneyBeacon account. Links normally expire after one hour. Removing a member prevents new authorised access but does not instantly invalidate a link already issued. Replacing or removing a photo cannot recall downloaded or cached copies. Do not upload a child's photograph or identifying image without considering that visibility.

Information used on your device

We process your focus settings, schedules, permitted-app selections, session history, Honey, streaks and reward progress to provide the functions you select. Apple's Family Controls and Screen Time frameworks use opaque selection tokens. We do not receive a readable installed-app inventory for advertising. Device Activity reports show permitted usage insights through Apple's protected reporting facilities.

Location and Bluetooth permissions allow your phone to detect a HoneyBeacon or a partner phone for proximity features, including background detection where enabled. We do not collect a GPS route history. Relevant session or presence status may be shared with a household or Bee Together group through the cloud. Turning off these permissions prevents the associated proximity functions from working.

When signed in with Apple, your selected profile and family photos are saved to your HoneyBeacon account in Supabase and restored when you sign in again. Your most recently selected sharing-card photo is also saved in a separate private bucket that other members cannot access. It is only shared when you export or share a card. Replacing or removing it updates that saved choice; deleting your account removes it. A failed upload remains on your phone for a later retry, so do not erase the app before it has finished saving.

The camera scans pairing QR codes. The photo picker supplies images you select for profiles or sharing. Local notifications communicate session events; optional remote notifications support group features. Wake uses alarm permission and local alarm settings on supported versions of iOS. Device permissions can be changed in iOS Settings. They are separate from any consent to optional research or marketing.

Short operational logs, local preferences and identifiers help the app function and diagnose faults. Device credentials and a migration identifier may be stored in Keychain. None of these local operations requires you to share optional research answers.

Optional accounts, Family Hive and Bee Together

When you sign in with Apple, we process the identifiers and any account information Apple supplies, our user identifier, profile and reward information, display name, device migration identifier and the information needed to restore your account. We do not receive your Apple password or full payment-card details. When you buy or restore The Hive Family, the app sends Apple's signed transaction record to our server so the membership can be shared with your Family Hive.

Signed-in setup backup also keeps your chosen product mode, weekly schedule preferences, Wake alarm times and settings, and saved Home HoneyBeacon names and identifiers. These private backups are available only to your account and are removed when that account is deleted. They do not contain permitted-app tokens, location history, calibration readings, active-session state or permissions to end a session. On a new phone, restored schedules and alarms start switched off for review. Setup questionnaire answers remain subject to the separate research choice below.

Family Hive processes household membership, organiser and member roles, invitations, agreed supervision settings, schedules, session requests and responses, and group progress. If a member chooses to share their age range through Apple, we store only whether Apple shows them as under 18 or 18 and over, how that age was set (for example by a parent or guardian), and when it was shared. We never receive a birthday or exact age. Bee Together processes circle membership, invitations, agreed session windows and relevant status or proximity coordination. Push tokens allow us to deliver requested service notifications.

Other members can see information needed for these features, such as your chosen name and picture, shared progress, session or request status and supervision settings. A Beekeeper is a product role, not proof of parental responsibility. Adults must not use the app to coerce or secretly monitor others. Please read the Family privacy information before joining a group.

The photo visibility and copied-link limitations described above apply to personal and shared hive photos. Use an illustration if you do not want your face or a child's face shared.

HoneyTags

Registering an official HoneyTag requires a verified account and internet access. We process the tag identifier, official inventory record, your account registration and the authorisation information needed for the action you request. Each user can register the same physical tag separately; a registration does not give access to another user's account or routine.

Tag names, personal saved routines and assignments are held in the app. Notification scanning uses an official tag link to open HoneyBeacon and verify the requested action. The link identifies official stock and does not contain account credentials or your routine settings. Shared tag sessions use household or circle membership, participant scans, permissions and session status so the selected group can start together. Internet access is required for registration, notification routes and shared authorisation. Some personal in-app permissions can operate offline. Removing one person's registration does not remove other users' registrations.

Setup answers and optional research

Answers about goals, approximate daily phone use, household type and commitment personalise your experience locally. Skipping does not upload optional answers. In Privacy & legal, adults aged 18 or over can send their own setup answers, app version and submission time to improve HoneyBeacon. Sharing is off by default. Only turn it on if you are 18 or over and these are your own answers. Completing setup or accepting the Terms does not consent to research. It is not required to use or pay for the app. Do not use this option to submit a child's answers.

Turning the option off clears queued submissions and stops future research uploads; a request already received by our server cannot be recalled by the switch alone. This does not undo processing that was lawful before withdrawal. Contact us about answers already submitted. Research information may include an account-linked copy when you sign in and sync. Some earlier or unsigned-in submissions are not attached to an account; if we cannot reasonably identify a record, we will explain this rather than collect extra identifiers solely to link it to you.

Optional AI insights and reward emojis

AI is off by default and separate from research sharing. In Settings → Privacy & legal, signed-in adults can choose AI insights and reward emojis after reading the disclosure and confirming that they are 18 or over and using their own information. Do not enable it for a child or use it to submit another person's information. This confirmation records your choice; it is not independent age verification.

When enabled, opening or refreshing a milestone card sends its locally selected setup and punchline, including their numbers, through Supabase to OpenAI for wording suggestions. Creating or updating a reward may send its name for an emoji suggestion. Selected milestone text can reflect personalisation done on your phone. We do not include raw questionnaire answers, photos, names, email addresses or account identifiers as separate fields in the OpenAI prompt. Free-text reward names are sent as entered, so do not put names, contact details, children's information or sensitive details in them. Supabase verifies your signed-in account to authorise the request.

We rely on your consent for this optional AI processing. Turning AI off stops future requests, and signing out resets the choice on that device. A request already transmitted cannot be recalled by the switch. Contact hello@honeybeacon.app for help exercising rights over information already sent. Declining or withdrawing AI does not affect milestone detection, Honey, streaks, rewards, local insight text or local emoji choices. AI suggestions may be inaccurate; review wording before sharing it. They do not decide rewards or blocking.

OpenAI receives the prompt and generates the suggestion. Its API does not use submitted content for model training by default. OpenAI may retain inputs and outputs in abuse-monitoring logs for up to 30 days, or longer when required by law or necessary for safety. Our request disables optional stored completions; that does not remove abuse-monitoring retention. Processing can take place outside the UK, subject to the international-transfer arrangements described below. We do not keep a separate AI conversation history; selected emojis can remain in your reward profile and cards you export remain wherever you save or share them. Google Gemini is not used by these updated features.

Website, messages and Kickstarter

For early access, we use the email address you provide to send the launch updates you requested. Beta applications may also include city/country and household information to organise testing. Optional newsletters and offers require a separate choice. You can unsubscribe or email us at any time. Essential replies, beta administration and reward-fulfilment messages are kept separate from promotional subscriptions.

Our website makes a connection to Cloudflare to estimate your country from your internet connection and show regional prices. Cloudflare receives the connection information, including your IP address. We use only the returned country code for pricing and temporarily store that code and its lookup time in session storage for up to 15 minutes. We do not request GPS location or send your app activity or account details with this request. A VPN may affect the result. If the lookup fails or the country is outside our launch markets, we show clearly labelled UK reference prices. Your App Store country determines subscription pricing.

Our website and service providers process technical connection information, such as IP address and request logs, to deliver and protect their services. Invite URLs can contain a code; treat that code as private. The app's research setting does not control website cookies or analytics. The website must provide separate information and any choice required for non-essential storage or tracking before it is used.

If you back our Kickstarter campaign, Kickstarter provides the information needed to administer your pledge and fulfil rewards, such as your name, contact details, reward selection and delivery details. We use this for campaign administration, fulfilment and support. We also share the delivery and contact information needed by our fulfilment providers, postal services or couriers to send and support your reward. A pledge does not automatically subscribe you to unrelated marketing. Kickstarter and its payment providers have their own privacy notices. Some device packs include a period of The Hive membership, supplied as an App Store offer code. Redeeming it opens Apple's redemption sheet, which shows the length and any renewal terms before you confirm.

Why we process information

We rely on legitimate interests to provide the local functions you choose, protect the service, respond to general enquiries, and enable proportionate participation in family features where a contract with the individual is not appropriate. Those interests are providing the requested focus tool and safeguarding users; we must balance them against your rights, particularly a child's interests.

We rely on contract to provide the account and paid services requested by the person who enters the service agreement, administer purchases and fulfil campaign commitments. Essential service messages form part of those services. We rely on consent for optional adult research, optional adult AI features, feature counts where our consent-first policy applies, and requested promotional emails. We rely on legal obligation for records the law requires us to keep, and legitimate interests to establish, exercise or defend legal claims.

Providing account, purchase or delivery details may be necessary to provide the feature or fulfil the reward you request. Without those details we cannot provide that particular service. Optional research and marketing information is not a condition of using core features. We do not ask you for health diagnoses or other sensitive information; avoid putting these in reward names or support messages unless needed for your request.

Children and families

HoneyBeacon supports family use, including teenagers. There is no minimum age for local focus tools, subject to Apple's platform requirements. A parent or legal guardian should be involved in a child's use and must provide any authorisation required for optional cloud or paid services. An in-app Beekeeper label does not verify age or legal authority.

We explain sharing and supervision to members, keep optional research off unless an adult actively chooses to share their own answers, do not use advertising tracking, and do not ask children to opt into research, AI or marketing. Local milestone insights and emojis remain available to children without AI. Where processing relies on consent and the law requires a parent's permission, we must obtain the necessary parental consent. We do not claim that this notice itself verifies a parent, that an Apple permission prompt establishes parental responsibility, or that the app guarantees a child's safety.

If you believe a child's information has been provided without appropriate authority, contact hello@honeybeacon.app. We will investigate and take appropriate action. Parents' requests must also take account of the child's own rights and maturity.

Who receives information and international processing

Supabase provides cloud authentication, databases, storage and server functions. The project's saved connection configuration points to Supabase's eu-west-1 region in Ireland. Framer provides the website and associated forms. GoDaddy provides domain services and supplies our Microsoft 365 email service. Microsoft processes email content and related service information for that service. Their subprocessors or support teams may process information in other countries. We check processor terms and applicable international-transfer arrangements for the services we use. Contact hello@honeybeacon.app for information about recipients and processing locations, and to request a copy of applicable international-transfer safeguards.

Where UK data is transferred to a country without an applicable adequacy arrangement, the transfer must have a lawful safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any required assessment. An EU hosting region alone does not rule out international access.

Apple independently processes information for its platform, Sign in with Apple and App Store services. Kickstarter independently operates its crowdfunding platform. Other household or circle members and sharing destinations receive information you choose to share with them. We may disclose information where required by law or for a business transfer with appropriate protection.

Aggregate feature counts

We measure which features are used so we can improve HoneyBeacon. We use the information only for aggregate statistics about our service, never for advertising, profiling, decisions about particular people, or tracking across apps. We do not sell these statistics as personal information or share them for targeted advertising. Core features work whether counts are on or off.

A visible first-use notice explains the choice before counting starts. For this limited statistical design, our reviewed launch-market policy offers an opt-out in the UK, US, Australia and New Zealand. In the UK we rely on the statistical-purposes exception for device storage/access and legitimate interests in improving our service for necessary personal-data processing. In the other reviewed markets we apply applicable service-improvement and data-minimisation rules. We do not treat absence of a consent requirement as permission for other tracking. In other or unreviewed countries, if the country cannot be checked, or if you select Always ask before sharing, counts stay off unless an adult separately agrees. Children should not select the adult consent option. An existing refusal remains off when you update.

You can select Turn off in the first-use notice, or turn off Share aggregate feature counts in Settings → Privacy & legal. Turning it off immediately stops new counting, discards unsent counters and cancels pending uploads. The off choice survives signing out. Signing out resets an affirmative consent for the next person using the device. Research and AI each keep their separate choices; neither enables these counts.

When permitted, the phone keeps short-lived counters for fixed feature categories, such as Home, Focus, Bedtime, Bee Together, Schedule, Quick Session, Always On, Lockdown, Wake, rewards, rankings, insights, Family Hive and HoneyTag controls. It sends a UTC day, feature counts and a development/production label to HoneyBeacon’s service in Supabase. Counters are held in memory, attempted approximately every five minutes or when the app goes into the background, and discarded after an attempt. There is no persistent offline analytics queue, installation identifier, account identifier or individual-event timestamp in this payload. Repeated updates are throttled, and failed or offline submissions may be lost. These are approximate feature-use counts, not unique-person or exact-session counts.

The service immediately adds accepted counts to shared daily counters. It does not create a device, person, session or individual-submission record. It does not read or store an IP address in the analytics tables. PostHog receives only pooled totals for completed UTC days, normally from the next day onwards, with a feature category and development/production label. Its technical event key identifies a shared daily counter, not an installation or person. It receives requests from our server, not from your phone. The PostHog SDK is not loaded in the app. Replay, automatic screen/interaction/lifecycle capture, crash collection, advertising tracking and feature-flag requests are disabled.

No selected apps, names, emails, account/member IDs, reward text, photos, questionnaire answers, beacon identifiers or distances, Honey totals, streaks, session durations, alarm times or precise location are included in these analytics. We do not join the shared counters to account, household, session-history, advertising or security-log records, or use the counters to reconstruct individual activity.

For country-specific privacy settings, the app makes an encrypted connection to Cloudflare to estimate the country from the internet connection. Cloudflare necessarily receives network connection information, including the IP address. The app reads only the returned country for this decision, keeps the country temporarily in memory, and does not save the response, IP address or country to analytics or send it to PostHog. No GPS lookup, device-locale assumption or App Store billing-country assumption is used. We recheck on foreground use and the opt-out policy expires after six hours without a fresh check. A VPN or proxy can make the estimate inaccurate; if the estimate is wrong, choose Always ask before sharing. An explicit opt-out skips automatic country checks; Check country again makes a new check only when you request it.

Our service and its infrastructure providers necessarily handle connection information to deliver and protect requests. Separate operational/security logs may follow the providers’ service retention schedules; this is not a claim of zero network logs. The analytics handler does not log request bodies, account tokens, IP addresses or individual counters, and those logs are not imported into PostHog or used for feature analysis. Supabase and Cloudflare process information under their applicable terms and safeguards; PostHog processes the pooled statistical totals through its EU service. EU hosting does not rule out international access; the international-transfer provisions above apply where personal data is involved.

Unsent local counters disappear when sharing is turned off or the app process ends. HoneyBeacon’s daily counter table is removed by scheduled cleanup after 400 days. PostHog’s pooled, non-identifying totals may be kept for trend analysis and are reviewed for continued necessity; they are not retained individual histories. Once a contribution has been pooled, we cannot separate it back into a person’s contribution. Earlier-build analytics records remain subject to their applicable retention and erasure obligations; contact hello@honeybeacon.app for help with those records or any privacy rights.

OpenAI is used only for the optional adult AI features described above; Google Gemini is not used.

How long information is kept

Ordinary local information remains until you clear it or remove the app. Keychain, shared containers or device backups may retain some information according to their lifecycle and your device settings. Signing out or deleting a cloud account does not automatically clear local Honey and settings.

Cloud account and membership information is kept while needed to provide the account or group service. On a valid deletion request, we remove the account and associated information without undue delay, with a target of 30 days for completing associated erasure, unless a specific legal requirement or valid exception applies. We explain any exception rather than keeping everything indefinitely. Backup copies must expire under the provider's applicable backup schedule and must not be restored into active use without reapplying deletion requests.

Optional research answers are retained for up to 12 months. Rate-limit identifiers are retained for up to 24 hours. Closed routine support enquiries are retained for up to 12 months. Early-access details are reviewed when the launch invitation programme ends and removed within 12 months after the final launch invitation unless you have separately subscribed to ongoing updates. Beta application details are kept for up to 12 months after the beta programme ends.

For ongoing marketing subscriptions, we retain contact details until you unsubscribe or the list is closed; a minimal suppression record may be retained to honour your opt-out. Accounting and transaction records that we are legally required to hold are retained for the applicable statutory period, normally six years from the end of the relevant company financial year. Specific dispute records may be retained for the relevant claim period. We review whether information is still necessary; a lack of deletion requests is not a reason to retain it indefinitely.

Your rights and account deletion

Depending on the processing and applicable law, you can request access, correction, erasure, restriction or portability, withdraw consent and object to processing based on legitimate interests. You can object to legitimate-interests processing, and you can stop direct marketing at any time. Contact hello@honeybeacon.app. We may need proportionate information to verify a request. Requests are normally free. We normally respond within one month, subject to any lawful verification, clarification or extension rules, and explain any delay or exception that applies.

In the app, use Settings → Account → Delete account to start account deletion. This does not cancel an Apple subscription: manage that separately in your Apple subscription settings. It does not erase Honey or settings already on your phone. Email us if you cannot use the in-app route, need help with associated information, or want to raise a problem with deletion. A parent is not automatically entitled to every detail of a child's account; we consider authority and the child's rights.

We do not make solely automated decisions producing legal or similarly significant effects about you. Blocking and subscription checks carry out the app functions you request.

Privacy complaints

Tell us about a privacy concern by emailing hello@honeybeacon.app or writing to our registered office. You do not need to use legal language or a particular form. We acknowledge a data protection complaint within 30 days of receipt, investigate it without undue delay, keep you informed and explain the outcome and any steps taken. Tell us if you need help or an accessible way to complain. Making a complaint does not remove your separate information rights or your right to complain to the Information Commissioner's Office at https://ico.org.uk.

Security and changes

We use security measures appropriate to the information and risks, including encrypted connections and access controls. Photos use private storage with short-lived signed URLs for authorised members, as explained above. No service is perfectly secure; protect your device, account and invite codes.

We update this notice when practices change and provide prominent information about material changes. New optional processing requiring consent will not begin simply because you continue using the app.