Privacy Policy

This policy explains what personal data the Siciliapp iOS app and this website handle, why, and what your rights are. It is written to be read, not skimmed past. If anything is unclear, email me.

1. Who is responsible for your data

The data controller is:

Mark Robert Sindoni Houghton
Sole trader (ditta individuale), Italy
Partita IVA (VAT no.): 02779990221
Email: markrsh.apps@gmail.com

I am a single developer. I have not appointed a Data Protection Officer because the law does not require one for an operation of this size and type. For anything about privacy, email the address above.

"I", "me" and "my" in this policy mean the controller named above. "The app" means Siciliapp for iOS.

2. What stays on your device

The app is built to work offline. The following data is created and stored only on your iPhone, in the app's private storage:

• the flashcards and decks (bundled with the app);
• your review history and spaced-repetition scheduling (when each card is next due);
• your settings, such as session size;
• a local record of whether premium decks are unlocked.

I have no server that receives this data, and the app's own code makes no network requests. I cannot see, copy or restore it.

You control it:

• Settings → Reset progress clears your review history.
• Settings → Reset everything returns the app to a fresh-install state.
• Deleting the app deletes all of this data from your device. Copies may remain in your iCloud or computer backups of the device until those backups are replaced or deleted.

If you back up your iPhone to iCloud or a computer, Apple's backup may include the app's data. That backup is between you and Apple and is covered by Apple's Privacy Policy.

3. What RevenueCat receives, and why

Who RevenueCat is

RevenueCat, Inc. (United States) provides the software that handles the in-app purchase inside the app: it shows the purchase screen, confirms the purchase with Apple, and tells the app whether premium decks should be unlocked. RevenueCat acts as my processor: it handles data on my behalf and under my instructions, under a Data Processing Addendum. Its own policy is here: RevenueCat Privacy Policy.

When the app talks to RevenueCat

The app goes online only to check, buy or restore your Lifetime Unlock, using an anonymous ID. To be precise, it contacts RevenueCat:

• when the app starts or returns to the foreground, to check whether this device has an active Lifetime Unlock;
• when you open the purchase screen, to load the screen and the local price;
• when you buy or restore the Lifetime Unlock.

Everything else in the app works without a network connection.

What RevenueCat receives

The app does not send RevenueCat your name, email, phone number, contacts, location, advertising identifier (IDFA) or any of your study data. The app does not ask to track you and does not use RevenueCat's optional features for collecting device identifiers or setting customer attributes.

What I can see

In RevenueCat's dashboard I can see the anonymous ID, the purchase record and approximate country for each customer, plus aggregate totals (for example, how many Lifetime Unlocks were sold this month). I use these to answer support requests, to spot fraud, and to understand how the app is doing as a business.

4. Apple's role

Apple, not me, sells you the Lifetime Unlock. Apple (for Europe, Apple Distribution International Ltd.) acts as merchant of record: it takes the payment, charges VAT, issues your receipt and handles refunds. Apple processes your Apple Account, payment details and purchase history under Apple's Privacy Policy. I never receive your name, email address or payment details from Apple.

Apple also gives me:

• sales reports — aggregated numbers of downloads and purchases by country;
• App Analytics and crash reports — only if you chose to "Share with App Developers" in iOS Settings → Privacy & Security → Analytics & Improvements. App Analytics are aggregated; crash reports are technical logs. Neither identifies you to me.

You can turn app-developer sharing off at any time in iOS Settings.

5. If you email me

If you email markrsh.apps@gmail.com, I receive your email address, your message and anything you attach. I use it only to reply to you and solve your problem. The mailbox is provided by Google (Gmail), which processes it under Google's Privacy Policy.

Please do not send payment card details or anything sensitive. I never need them.

6. Legal bases (GDPR Article 6)

You do not have to give me any data. Without the purchase data described above, however, the Lifetime Unlock cannot be delivered or restored.

I do not make decisions about you based solely on automated processing, and I do not profile you.

7. International transfers

I am based in Italy. RevenueCat is based in the United States and uses sub-processors (such as cloud hosting providers), mostly in the United States; they are listed in RevenueCat's DPA. Transfers of personal data from the EU/EEA and the UK to RevenueCat are protected by the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum for UK data), included in RevenueCat's DPA. Where a recipient is certified under the EU–U.S. Data Privacy Framework, that adequacy decision may also apply.

Google (for email) and GitHub (for this website) also process data in the United States under their own transfer safeguards.

You can ask me for a copy of the safeguards by email.

8. How long data is kept

9. Your rights

If you are in the EU/EEA or the UK, you have the right to:

• access — get a copy of the personal data I hold about you;
• rectification — have inaccurate data corrected;
• erasure — have your data deleted;
• restriction — ask me to limit how your data is used;
• portability — receive data you gave me in a common machine-readable format;
• objection — object to processing based on legitimate interests (section 6), including the aggregate statistics;
• complain to a supervisory authority (see below).

Many other countries give you similar rights, and I will honour the same requests wherever you live.

How to exercise them — honestly

The app is anonymous by design. I do not know your name or email, so I usually cannot tell which purchase record is yours unless you help me find it. Most of your data (your study data) is only on your phone, where you can delete it yourself.

To make a request about your purchase data, email markrsh.apps@gmail.com with:

1. what you want (for example, "a copy of my data" or "delete my purchase record");
2. your Apple order ID. It is on the receipt email Apple sent you, or in Settings → [your name] → Media & Purchases → View Account → Purchase History on your iPhone, or at reportaproblem.apple.com. It looks like MXXXXXXXXX.

With the order ID I can find the matching record in RevenueCat and act on it. I will reply within one month (this can be extended by two further months for complex requests; I will tell you if so). Requests are free.

Please note about deletion: deleting your RevenueCat record does not cancel or refund your purchase — your purchase is recorded by Apple. If you later tap Restore purchases, a new anonymous record will be created so that the premium decks can be unlocked again.

If you cannot find your order ID, write anyway. If I cannot identify you, I will tell you, as the law allows (GDPR Art. 11), and you can still exercise your rights by providing extra information that lets me find your data.

Complaints

If something here worries you, please email me first at markrsh.apps@gmail.com. I read every message and usually reply within 2 working days. Most problems are sorted in an email or two.

You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where you think the problem happened. My lead authority is Italy's Garante per la protezione dei dati personali. In the UK it is the Information Commissioner's Office.

10. No tracking, no sale, no sharing

• The app does not track you across other companies' apps or websites, and never asks for tracking permission.
• The app contains no advertising and no analytics or crash-reporting software.
• I do not sell your personal information and I do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act (as amended by the CPRA). I have not done so in the past 12 months.
• The only recipients of app data are the service providers named in this policy (RevenueCat and, for purchases, Apple), acting to deliver the service. I may also disclose data where the law requires it.

11. Children

Siciliapp is rated 4+ and is suitable for learners of all ages, but it is not designed specifically for children. The app collects no personal data from anyone beyond the anonymous purchase data described in section 3. Purchases are made through Apple, whose controls (such as Ask to Buy in Family Sharing) let parents approve purchases. If you are a parent and want a child's purchase record deleted, follow section 9.

12. Security

• Your study data is kept in the app's private storage, protected by iOS sandboxing and, when your device is locked with a passcode, by iOS data protection.
• Communication between the app and RevenueCat or Apple is encrypted in transit (HTTPS/TLS).
• Access to the RevenueCat dashboard is limited to me.
• I keep only the minimum data I need.

No system is perfectly secure. If a personal data breach affects you and is likely to put your rights at high risk, I will notify the Garante within 72 hours where required and tell you without undue delay, as far as I am able to contact you.

13. This website

This website (markrhoughton.github.io/siciliapp) is a set of static pages.

• It sets no cookies, uses no local storage, runs no analytics and loads nothing from third parties (fonts and images are served from the same site).
• It is hosted by GitHub Pages (GitHub, Inc., United States). Like any web server, GitHub receives your IP address and basic request data (such as the page requested and your browser type) when you visit, and logs it for security and to keep the service running. I do not have access to these logs. See the GitHub General Privacy Statement.

14. Other countries

• United Kingdom: this policy applies equally under the UK GDPR and the Data Protection Act 2018.
• California and other U.S. states: you have the right to know what personal information is collected, to delete it and to correct it, and not to be discriminated against for exercising these rights. Use the process in section 9. The categories collected are: identifiers (the anonymous ID and IP address) and commercial information (purchase history), used for the purposes in section 3. There is no sale or sharing (section 10).
• Australia: I handle personal information consistently with the Australian Privacy Principles. You can ask for access or correction, or make a complaint, by emailing me (section 9). I will reply within 30 days.
• Everywhere else: the same protections described here apply to you.

15. Changes to this policy

If I change how the app handles data, I will update this page, change the version number and effective date, and — if the change is significant — mention it in the app's release notes before it takes effect. I will never start using your data in a materially different way without telling you first.

Previous versions are available on request.

Version 1.0 · Effective 24 September 2026