Legal

Privacy Policy

Last updated: 12 October 2026

This policy covers the Midnights app and the midnights.co.uk website. It sets out what we collect, why, where it is kept, and what you can ask us to do about it.

The short version

• Your trips and answers stay on your device unless you create an account.
• If you turn on automatic tracking, your position stays on your device and is never sent to us or included in cloud sync. Naming the country may send it to Apple's or Google's mapping service — the same one your phone's Maps app uses.
• There is no advertising, no profiling, and no tracking across other apps or sites.
• We do not sell your data, and we never see your card details.
• You can export your trips from inside the app, and delete your account, with everything in it, at any time.

Who we are

Midnights is owned and operated by So Sorry Group Ltd, a private limited company registered in England and Wales (company number 15328249), with its registered office at Flat 5 Richbourne Court, 9 Harrowby Street, London W1H 5PT, United Kingdom. For the purposes of UK GDPR, So Sorry Group Ltd is the data controller for everything described here. The contact address for any privacy question or request is support@midnights.co.uk.

What the app is

Midnights records the periods you spend in different countries and estimates your tax-residency position against published rules — the UK Statutory Residence Test, the US Substantial Presence Test, and the Schengen 90-days-in-180 limit. It is informational only and is not tax, legal, or financial advice.

What the app collects

• Trips you enter — country, arrival and departure dates, and any notes you add.
• Answers you give about your circumstances — for example your main country, UK residence history, UK ties, and declared day adjustments. These are the inputs the residency tests need.
• Location, only if you turn it on — off by default. See below.
• An email address, only if you create an account — with an authentication identifier. An account is optional; the app works fully without one.
• A subscription record, only if you subscribe — handled by Apple and our subscription-management provider. We never receive your card details.
• A support report, only if you send one — what you write, plus your app version, platform, operating system, device name and language so the problem can be reproduced, and a one-way identifier derived from your network address to stop the form being abused. If you are signed in, your account email address is attached so we can reply; if not, you can add one. These outlive a deleted account — see How long we keep it.

The app contains no analytics or advertising software of any kind. It does not record which screens you open or how you use it.

Location tracking

Automatic tracking is opt-in: it is off until you switch it on in Settings. When it is on, the app reads your device location in the background so it can count your days without you logging every trip by hand.

Your position is stored on your device, so a day can be worked out even if it can't be named straight away. To turn it into a country, it may be sent to Apple's or Google's mapping service — the same one your phone's Maps app uses. This is how the country is confirmed, because offline map data alone can't always tell, for example, Monaco from the French street beside it. Your position is never sent to us and is never included in cloud sync. If you also enter a trip by hand for the same dates, what you entered always wins. You can switch tracking off at any time from Settings → App settings → Location tracking. To delete the days it has already recorded, delete your account from the app, or email support@midnights.co.uk and we will delete them for you.

What this website collects

• Cookieless usage measurement. Our website host provides first-party page-view and page-speed measurement that sets no cookies — it counts visits and load times without identifying you, in much the same way a server log would.
• Your email, if you join the waitlist. Stored in a database hosted by our cloud database provider in Frankfurt (Central EU), in its own table with no link to any app account, and used only to confirm you have joined and to tell you when the app or Pro becomes available. The confirmation is sent as soon as you join; nothing else follows until there is something to announce. You can ask us to remove it at any time.
• Your email, if you email yourself a summary from one of our tools. We use your address once, to send that summary, and we don’t keep it on our systems. The summary is built from your answers, which are carried in the link back to the tool rather than saved in any database of ours. Your address joins the waitlist above only if you tick “Also send me Midnights updates”.
• Your name, email and message, if you use our contact form. Sent to us as an email through our email delivery provider in London, so we can reply. The website itself keeps nothing: the message is not stored in any database, only in our inbox, where we keep it as long as needed to deal with what you asked.

We also use Google Analytics (GA4) and the Meta Pixel to understand what brings people to this site. Neither loads until you choose “Allow” on the cookie banner — nothing is requested and no analytics cookie is set before that choice. You can change your mind at any time via “Manage cookies” in the footer, which re-opens the banner and lets you withdraw consent. Declining leaves the site fully working.

Where your data is kept

• By default, your trips and answers are stored on your device only.
• If you create an account for cloud sync, they are also stored in our database, hosted by our cloud database provider in Frankfurt (Central EU), with row-level security so that your rows are readable only by your own account.
• Your login session is held in your device's keychain or keystore, not in ordinary storage.

International transfers

Your app data and the website waitlist are both stored in Europe, in Frankfurt. Some of the companies we rely on are based outside the UK and EEA, in particular our subscription and website-hosting providers, and — only if you consent to them — the analytics providers named below. Where data reaches them outside the UK or EEA, those transfers rely on the UK and EU standard contractual clauses, or on a country being covered by an adequacy decision.

Our legal bases

• Performing our contract with you — running the app, syncing your data if you have an account, and providing a subscription you have bought.
• Your consent — automatic location tracking, joining the waitlist (including from a tool's updates box), and any website analytics cookies. You can withdraw consent at any time, and withdrawing it does not affect what happened before.
• Our legitimate interests — keeping the service secure and working, answering a message you sent us through the contact form, sending a summary you asked us to email you from one of our tools, and understanding overall usage of the website in a way that does not identify you.

We do not make any decision about you by automated means that produces a legal or similarly significant effect. The residency figures the app shows are estimates for you to read and act on yourself.

How long we keep it

We keep your data until you delete it. Deleting your account removes your cloud data immediately, apart from the support reports described below; residual copies in backups are purged within 30 days. Waitlist emails are kept until you ask us to remove them or the waitlist closes. Data held only on your device is gone when you delete the app.

Support reports are the exception. A bug report or other feedback you send us from inside the app is kept after your account is deleted, so the problem it describes can still be fixed. It is kept anonymised: the report is no longer linked to any account, and your email address, the name of your device and the identifier we keep to prevent abuse are removed from it. Nobody can reply to it after that. What you typed is kept as you wrote it, so please keep personal details out of the text of a report.

Messages sent through the contact form are kept in our inbox only as long as needed to deal with what you asked. Summary emails sent from our tools are not retained by the website; your address is kept only if you ticked the updates box, on the waitlist terms above.

Who else processes your data

• Cloud database and authentication providers — storing your account, your synced data, and the website waitlist.
• Payment and subscription providers — taking and validating subscriptions. Payment is handled entirely by Apple; we never see your card details.
• Website hosting and measurement providers — serving this site and counting visits without cookies.
• Email delivery providers — sending the waitlist confirmation, the one-off summaries emailed from our tools, the messages sent through our contact form and, later, the launch announcement. Sending is handled from our London region, while the waitlist itself is stored in Frankfurt; both are inside the UK and EEA.
• Analytics providers — Google Analytics (GA4) and the Meta Pixel, only after you consent. These two are named rather than described, because you are asked to consent to them by name.

Each acts on our instructions. We do not sell your data or share it for anyone's advertising.

Your rights

Under UK and EU data protection law you can ask us to:

• Give you a copy of the data we hold about you, or explain what we hold and why.
• Correct anything that is wrong.
• Delete your data — in the app, Settings → Account → Delete account, or see the account deletion page.
• Export it in a portable form — Settings → Export your trips gives you a CSV.
• Restrict or object to what we do with it.
• Withdraw consent you previously gave, such as for location tracking.

Email support@midnights.co.uk and we will respond within one month. If you are not satisfied you can complain to your data protection authority — in the UK that is the Information Commissioner's Office, at ico.org.uk.

Security

Data in transit is encrypted. Cloud data sits behind row-level security so one account cannot read another's. Your login session is stored in the device keychain rather than ordinary app storage. Account deletion runs server-side and verifies who you are from your signed-in session rather than trusting anything the app sends. No system is perfectly secure, and we do not claim otherwise.

Children

Midnights is not intended for children under 16, and we do not knowingly collect their data.

Changes

If this policy changes we will update the date at the top, and say so more prominently if the change is significant.

Contact

Midnights · Operated by So Sorry Group Ltd, company number 15328249 · Contact: support@midnights.co.uk