Legal

Privacy Policy

Last updated: 13 September 2026

This policy covers the Midnights app and the midnights.co.uk website. It sets out what we collect, why, where it is kept, and what you can ask us to do about it.

The short version

• Your trips and answers stay on your device unless you create an account.
• If you turn on automatic tracking, your location becomes a country, on your device. Raw coordinates never leave your phone.
• There is no advertising, no profiling, and no tracking across other apps or sites.
• We do not sell your data, and we never see your card details.
• You can export or delete everything, at any time, from inside the app.

Who we are

Midnights is operated by Nayeem Moez Janmohamed, a sole trader based in London, United Kingdom, trading as Midnights. For the purposes of UK GDPR this is the data controller for everything described here. The contact address for any privacy question or request is support@midnights.co.uk.

What the app is

Midnights records the periods you spend in different countries and estimates your tax-residency position against published rules — the UK Statutory Residence Test, the US Substantial Presence Test, and the Schengen 90-days-in-180 limit. It is informational only and is not tax, legal, or financial advice.

What the app collects

• Trips you enter — country, arrival and departure dates, and any notes you add.
• Answers you give about your circumstances — for example your main country, UK residence history, UK ties, and declared day adjustments. These are the inputs the residency tests need.
• Location, only if you turn it on — off by default. See below.
• An email address, only if you create an account — with an authentication identifier. An account is optional; the app works fully without one.
• A subscription record, only if you subscribe — handled by Apple and RevenueCat. We never receive your card details.

The app contains no analytics or advertising software of any kind. It does not record which screens you open or how you use it.

Location tracking

Automatic tracking is opt-in: it is off until you switch it on in Settings. When it is on, the app reads your device location in the background so it can count your days without you logging every trip by hand.

Your coordinates are turned into a country on your device, offline. Only the date and the country are stored. The coordinates themselves are never saved and never sent to us or anyone else. If you also enter a trip by hand for the same dates, what you entered always wins. You can delete the whole tracking history at any time from Settings → Auto-track my days.

What this website collects

• Cookieless usage measurement. We use Vercel Analytics and Vercel Speed Insights. These are first-party and set no cookies — they count page views and load times without identifying you, in much the same way a server log would.
• Your email, if you join the waitlist. Stored in a database hosted by Supabase in the London (eu-west-2) region, kept separate from the app's own database, and used only to tell you when the app or Pro becomes available. You can ask us to remove it at any time.

We also use Google Analytics (GA4) and the Meta Pixel to understand what brings people to this site. Neither loads until you choose “Allow” on the cookie banner— nothing is requested and no analytics cookie is set before that choice. You can change your mind at any time via “Manage cookies” in the footer, which re-opens the banner and lets you withdraw consent. Declining leaves the site fully working.

Where your data is kept

• By default, your trips and answers are stored on your device only.
• If you create an account for cloud sync, they are also stored in our database, hosted by Supabase in Frankfurt (Central EU), with row-level security so that your rows are readable only by your own account.
• Your login session is held in your device's keychain or keystore, not in ordinary storage.

International transfers

Your app data and the website waitlist are both stored in Europe — Frankfurt and London respectively. Some of the companies we rely on are based outside the UK and EEA, in particular Apple and RevenueCat for subscriptions, Vercel for website hosting, and Google and Meta for website analytics if you consent to them. Where data reaches them outside the UK or EEA, those transfers rely on the UK and EU standard contractual clauses, or on a country being covered by an adequacy decision.

Our legal bases

• Performing our contract with you — running the app, syncing your data if you have an account, and providing a subscription you have bought.
• Your consent — automatic location tracking, joining the waitlist, and any website analytics cookies. You can withdraw consent at any time, and withdrawing it does not affect what happened before.
• Our legitimate interests — keeping the service secure and working, and understanding overall usage of the website in a way that does not identify you.

We do not make any decision about you by automated means that produces a legal or similarly significant effect. The residency figures the app shows are estimates for you to read and act on yourself.

How long we keep it

We keep your data until you delete it. Deleting your account removes your cloud data immediately through a server-side function; residual copies in backups are purged within 30 days. Waitlist emails are kept until you ask us to remove them or the waitlist closes. Data held only on your device is gone when you delete the app.

Who else processes your data

• Supabase — database and sign-in for the app, and the website waitlist.
• Apple and RevenueCat — taking and validating subscriptions. Payment is handled entirely by Apple.
• Vercel — website hosting and cookieless measurement.
• Google (Analytics) and Meta — website analytics, and only after you consent.

Each acts on our instructions. We do not sell your data or share it for anyone's advertising.

Your rights

Under UK and EU data protection law you can ask us to:

• Give you a copy of the data we hold about you, or explain what we hold and why.
• Correct anything that is wrong.
• Delete your data — in the app, Settings → Account → Delete account, or see the account deletion page.
• Export it in a portable form — Settings → Export your trips gives you a CSV.
• Restrict or object to what we do with it.
• Withdraw consent you previously gave, such as for location tracking.

Email support@midnights.co.ukand we will respond within one month. If you are not satisfied you can complain to your data protection authority — in the UK that is the Information Commissioner's Office, at ico.org.uk.

Security

Data in transit is encrypted. Cloud data sits behind row-level security so one account cannot read another's. Your login session is stored in the device keychain rather than ordinary app storage. Account deletion runs server-side and verifies who you are from your signed-in session rather than trusting anything the app sends. No system is perfectly secure, and we do not claim otherwise.

Children

Midnights is not intended for children under 16, and we do not knowingly collect their data.

Changes

If this policy changes we will update the date at the top, and say so more prominently if the change is significant.

Contact

Midnights · Operated by Nayeem Moez Janmohamed, trading as Midnights · Contact: support@midnights.co.uk