Privacy Notice
Version 1.0, last updated 28 October 2026
The short version
- We collect only what you need to co-parent with the app.
- Your data is stored in the UK and never sold.
- We don't read your messages unless you ask us to help.
- Your co-parent never sees your address, email, phone or journal.
- You can download or delete your data at any time.
Who we are
BothWays is made and run by an independent developer, under the name BothWays for Coparents. BothWays for Coparents is the controller of your personal data.
Questions about your data: chat with us in Support in the app (Settings, then Chat).
What we collect
- Your account: name, email, password (stored scrambled, never readable), role, and when you agreed to the Terms and confirmed you're 18 or over.
- What you add: messages, calendar entries, expenses and receipts, child details, documents and journal entries.
- Safety settings: your safety check answer and Safety mode choices. These are private to you.
- Payments: handled by Apple or Google. We see that you've paid, never your card details.
- Technical: device type, app version, sign-in times and security logs, to keep your account safe.
We never collect your location. Photos you add, such as receipts, have their location data removed on your phone before they're uploaded.
Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Run your account and the app's features | Contract |
| Keep records sealed and exportable | Contract |
| Children's health details, such as allergies | Your explicit consent |
| Safety features and fraud prevention | Legitimate interests |
| Tone suggestions on messages | Legitimate interests, and you can turn them off |
| Product news by email | Consent, which you can withdraw |
We never use your messages to train AI models, and we never show you adverts.
Children's data
Children don't have accounts. Their details are added by a parent so both homes have the same information. We collect as little as possible, follow the ICO Children's Code, and never use children's data for marketing or profiling. Read the Children's Data Notice for more.
Who can see your data
- Your co-parent: the shared record only, meaning messages, the schedule, shared costs and children's details.
- Professionals you invite: only what you allow, for as long as you allow, and every view is logged.
- Our suppliers, under written contracts: Google Cloud and Firebase (storage and servers in London, sign-in, sign-in emails, notifications and app protection), Google's Vertex AI in London for optional tone suggestions (drafts aren't stored), and Apple and Google for Sign in with Apple, Google sign-in, notifications and the app stores. Support chat runs inside BothWays, on the same London servers.
- Courts and the police: only when the law requires it. Read the Court Requests Policy.
Where it's kept
Your data is stored in Google Cloud data centres in London and encrypted in transit and at rest. Two small exceptions: your sign-in details (email, and whether two-step sign-in is on) are held by Google's sign-in service, Firebase Authentication, which runs globally, and phone notifications are delivered through Google's global notification service. Neither contains your messages, records or children's details. These are covered by Google's data processing terms, including the UK transfer addendum. Your private journal is end-to-end encrypted, so only you can read it. If any support or engineering work happens outside the UK, it uses an approved UK transfer agreement and never includes routine access to your messages.
How long we keep it
We keep your data while your account is open. When you delete it in Settings, your personal details, private journal, Access log and support chat are deleted straight away, and from backups within 30 days. Messages you shared stay in your co-parent's sealed record, with your first name so it still reads clearly, because they're part of a shared history that may be needed for the children. Full details are in the Data Retention Policy.
Your rights
- See a copy of your data, which you can download in Settings
- Correct anything that's wrong
- Ask us to delete or restrict your data
- Object to how we use it, or withdraw consent
- Move your data to another service: the download is a standard JSON file, with your journal as a spreadsheet
We reply within one month. If you're unhappy, you can complain to the ICO at ico.org.uk or on 0303 123 1113.