Sibliny privacy policy

This policy explains what information the Sibliny app collects, why, who it goes to, how long we keep it, and how you can see, change or delete it. It applies to the Sibliny mobile app for Android and iPhone.

Want to delete your account? Jump to Delete your account.

1. Who we are

Sibliny is published by AGENT M, which is the data controller for the personal information described here. In this policy "we", "our" and "us" mean AGENT M.

Contact for anything privacy-related, including all the requests described below: hello@agentm.co.uk.

2. What Sibliny is (and is not)

Sibliny is a family care coordination tool. It helps a family, and the friends and helpers around them, organise care for someone they look after: who is covering when, tasks, appointments, care notes, updates, costs and documents.

Sibliny is not a medical device and not a healthcare provider. It does not give medical advice. It is not a covered entity under the US Health Insurance Portability and Accountability Act (HIPAA), so information you put into Sibliny is not protected by HIPAA. It is protected by this policy and by data protection law, including the UK GDPR and the EU GDPR.

3. What we collect

Your account

Your name and email address.
An account ID that we create for you.
Your phone number and a profile photo, only if you add them (or, for the photo, if your Google account has one and you sign in with Google).
If you sign in with Google or Apple, we receive your name and email address from them (Apple may give us a private relay address instead). We never see your Google or Apple password.

Your care circle

A care circle is the private group you create, or are invited into, around the person being cared for. Depending on which features you use, a circle can hold:

Members' names, their relationship to the person cared for, and their role.
The name of the person cared for and, if you add it, their date of birth.
Tasks, appointments, care shifts and other calendar entries.
Care log entries, including notes, a mood rating and any photos you attach.
Check-ins (for example mood, energy and sleep) and health readings you record, such as blood pressure, blood sugar or weight.
Emergency information you record: allergies, blood type, doctor, pharmacy and preferred hospital, insurance provider and policy number, and emergency contacts' names and phone numbers; plus any emergency plans you write.
Documents and files you upload, such as letters, scans or insurance cards.
Expenses, receipt photos and how costs are split between members.
Updates, comments, help requests and requests for a break (respite) that members post to each other.
Wellbeing check-ins you choose to complete about how you are coping.
Weekly summaries (digests) generated from the circle's activity.

Some of this is information about health. UK and EU law treat health information as a "special category" that needs extra care. See section 5.

Subscriptions

If you buy Sibliny Pro, we receive your subscription status and purchase history (which plan, when it started and renews) from Google Play or the App Store, through RevenueCat. Payment is handled entirely by Google or Apple: we never see your card or bank details.

Your device

A push notification token, so we can send you notifications about your circle (for example "New task for you"). It is removed when you sign out or delete your account.

Usage analytics and crash reports — only if you say yes

During setup Sibliny asks whether you want to share usage analytics and crash reports. Both answers are offered equally, and nothing is sent unless you choose yes. You can change your mind at any time in Settings → Privacy & Security → Share Analytics & Crash Reports, and turning it off stops collection straight away. If you say yes, we receive:

Which screens you open and which buttons you tap.
When something goes wrong: the error, and the kind of phone and operating system it happened on.
Your account ID, so reports from one person can be told apart. Never your name, email address or phone number.

The app filters these reports before they leave your phone so that they never contain health information, names, email addresses, phone numbers, notes you write or files you upload.

What we do not collect

Your location, your phone's contacts, or your browsing history.
Photos or files, except the ones you choose to attach. Sibliny asks for camera and photo access only so you can do that.

4. How we use it

To run your account and your care circles, and show each member the information the circle has shared.
To send the notifications you have turned on, and weekly summaries if you want them.
To process and restore Sibliny Pro subscriptions.
To keep the service secure, for example limiting how many invitations can be created per hour to prevent abuse.
To answer you when you contact us.
Only if you said yes: to find and fix bugs and understand which features are used.

We do not sell your information. We do not show ads, and we do not use your information for advertising or marketing profiles. We do not share it with insurers, employers or data brokers.

5. Our legal reasons (UK and EU users)

To provide the service you signed up for (performance of a contract): your account, your circles and everything you and your family put into them, notifications and subscriptions.
Your consent: usage analytics and crash reports. You can withdraw it at any time in Settings, as described above.
Our legitimate interests: keeping the service secure and preventing abuse, and handling your messages to us.
Legal obligations: for example keeping records we are required to keep, and responding to lawful requests.

Health information is only processed to provide the care-coordination features you use it for, and only inside the care circle it was entered in. It is never used for analytics, advertising or any other purpose.

6. Who can see your information

People in your care circle

Everyone in a circle can see the care information in that circle, and each member's name, relationship and role. Roles control who can change things:

Admin: can see and add everything, invite people, change roles and remove members.
Member: can see and add care information.
Observer: can see the circle's care information but cannot add or change it.

Wellbeing check-ins are stored with the circle, and a high score may be shown to other members so they can offer support. Only invite people you trust with this information, and choose their role with care.

Service providers

We use the providers below to run Sibliny. They act on our instructions under their data processing terms and may not use your information for their own purposes.

Google Firebase (Google) — sign-in, database, file storage, server functions and push notifications. Your circles' data and files are stored in the European Union: Cloud Firestore in Google Cloud's eur3 European multi-region, Cloud Storage in an EU multi-region bucket, and our server functions run in europe-west1 (Belgium). Firebase Authentication and Firebase Cloud Messaging are global services that Google may operate from outside the UK and EEA.
Apple Push Notification service (Apple) — delivers notifications to iPhones. A notification can include a task title and a member's name.
Google Sign-In (Google) and Sign in with Apple (Apple) — only if you choose to sign in that way.
RevenueCat — manages Sibliny Pro subscriptions. Receives your account ID and purchase history. Based in the United States.
PostHog — usage analytics, only if you say yes. We use PostHog's EU cloud, hosted in the European Union.
Sentry — crash reports, only if you say yes. Sentry may process data outside the UK and EEA.
Microsoft (Outlook) — hosts our support email address, so it processes any email you send us.

Google Play and the App Store handle payments as independent companies under their own privacy policies.

Transfers outside the UK and EEA

Where a provider processes personal information outside the UK or EEA, the transfer is covered by the safeguards in that provider's data processing terms, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or by an adequacy decision where one applies. You can ask us for more detail about these safeguards.

Legal requests

We may disclose information if the law requires it, or to protect someone's safety.

7. How we protect it

All data is encrypted in transit between the app and our servers.
Data stored with Google Firebase is encrypted at rest.
Database security rules mean you can only read a circle's information if you are a member of that circle, and observers cannot change anything.
Joining a circle needs an invitation from that circle. Invitations expire after 30 days.
Deleting your account requires you to confirm your password, or sign in again with Google or Apple, first.

No system is perfectly secure. If a breach puts your information at risk, we will tell the relevant data protection regulator where the law requires it and tell you without undue delay.

8. How long we keep it

Your account and circles: for as long as your account exists. Anything you delete inside the app (a task, a note, an entry) is removed from the circle when you delete it.
When you delete your account: see Delete your account for exactly what is deleted, what is anonymised and what stays with your family's circle.
Invitations: expire 30 days after they are created.
Analytics and crash reports (only if you said yes): held by PostHog and Sentry against your account ID for as long as they are useful for fixing problems, then deleted under those providers' retention settings. Email us if you want them deleted sooner.
Subscription records: kept by RevenueCat, Google and Apple for as long as they need them to manage purchases and meet their legal obligations.
Emails you send us: kept for as long as we need to deal with your request.

9. Delete your account

You can delete your Sibliny account, and the data linked to it, at any time. Deleting the app from your phone does not delete your account.

In the app

Open the More tab.
Tap Settings, then Account Settings.
Under Danger Zone, tap Delete Account.
Confirm twice, then enter your password (or sign in again with Google or Apple) to prove it is you.

Deletion starts straight away. If you are the only admin of a circle that other people still use, the app will ask you to make someone else an admin first, so the family is not left with a circle nobody can manage.

Without the app

Email hello@agentm.co.uk from the email address on your account, with the subject "Delete my Sibliny account". We may ask you to confirm the request, and we will complete it within 30 days.

What is deleted, and what is kept

Deleted: your sign-in account, your profile (name, email, phone number, photo), your notification token and settings, your personal weekly summaries, and your membership of every circle.
Deleted: any circle where you are the only member, with everything in it, including its photos and files.
Anonymised: things you added to a circle that other people still use. Your name is removed from them, the text you wrote in care log entries, check-ins, updates, comments, expenses and help requests is erased, and the photos you uploaded are deleted. The remaining record (for example that a visit happened, or an expense amount) stays so the care record your family relies on is not broken.
Kept with the circle: documents you uploaded and health readings you recorded about the person being cared for, because they are that person's records, not yours. Your name is removed from them, and any note you added to a health reading is erased.
Held by providers: analytics and crash reports (if you said yes) and subscription records, as described in section 8. Email us to have analytics and crash reports deleted too.

Deleting your account does not cancel a Sibliny Pro subscription. Cancel it in Google Play or the App Store — see how to cancel a subscription.

10. Your rights

Under UK and EU data protection law you have the right to:

get a copy of your personal information;
have inaccurate information corrected (you can edit most of it yourself in the app);
have your information deleted (see above);
receive your information in a portable format;
object to, or ask us to restrict, how we use your information;
withdraw consent at any time where we rely on it (for analytics and crash reports, use the switch in Settings).

To use any of these rights, email hello@agentm.co.uk (in the app: Settings → Privacy & Security → Request a Copy of Your Data). We will reply within one month.

You can also complain to a data protection regulator: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the regulator in the country where you live. We would appreciate the chance to put things right first.

If you live elsewhere, for example in California, you may have similar rights under local law. Contact us at the same address. We do not sell personal information or share it for targeted advertising.

11. Children and the people you care for

You must be at least 16 to create a Sibliny account. We do not knowingly let children under 16 create accounts. If you think a child has created one, email us and we will delete it.

The person being cared for does not use Sibliny themselves, and may be a child or an adult who cannot manage their own affairs. Their information is entered by the people caring for them, and they have the same data protection rights as anyone else. Only enter information about someone if you have the right to do so: for a child, you must have parental responsibility for them; for an adult, you should have their agreement or the legal authority to act for them. A parent or other legal representative can make requests on the person's behalf by emailing us.

12. Changes to this policy

If we make an important change we will tell you in the app before it takes effect, and update the "Last updated" date above.

13. Contact us

AGENT M, publisher of Sibliny
Email: hello@agentm.co.uk

Kept with the app’s source code and published here unchanged.

How AgentM handles data across all its products

Sibliny Privacy Policy