Privacy Policy
Myw Lefty Writing
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Myw Lefty Writing stores your optional local name, selected level, practice goal, writing style, reminder preferences, language choice, practice dates, exercise results, accuracy, duration and unfinished finger-stroke coordinates on your iPhone. Exercises and technique illustrations are bundled with the app. No account is created. If you enable optional backup, the app sends an installation identifier, an encrypted notebook snapshot and its update timestamp to our backend. A random installation authorization secret and a separate encryption key are kept in the iPhone Keychain. The server stores a hash of the authorization secret, not the secret itself. Requests to the API and this public website also expose network information, such as IP address and request metadata, to the hosting infrastructure.
How we use information
Local information provides handwriting practice, saves unfinished work and results, calculates your history and daily streak, and applies your chosen plan. Local notifications remind you to practice when enabled. Optional backup keeps the latest encrypted notebook for the same installation. Installation authorization limits access to that snapshot. Network metadata supports request handling, rate limiting, service operation and troubleshooting. Handwriting practice is a coordination activity and is not a medical diagnosis or treatment.
Service providers and sharing
Public HTTPS for the API and website is terminated by Cloudflare, which proxies requests to the backend hosted on Railway. Cloudflare processes connection information, request metadata and traffic passing through this route, including encrypted notebook payloads and installation authorization headers. The backend and its PostgreSQL database are hosted on Railway. Railway processes requests and infrastructure information to operate the service and may retain operational logs according to its own service practices. The app does not include advertising, analytics or social sign-in SDKs and does not sell personal information. Apple supplies iOS, Keychain and local notifications. Reminder content is scheduled locally; it is not sent through a third-party email or messaging provider. The backend receives encrypted notebook content and does not receive its decryption key. We may disclose information when legally required.
Data retention
Your notebook stays on your iPhone until you erase it in Settings or remove the app, subject to iOS storage and any device backup settings you control. Keychain installation material can remain after app removal; this is controlled by iOS and must not be assumed to survive. When optional backup is enabled, the backend retains one latest encrypted snapshot per installation until an authorized deletion request. There is no automatic expiry in the application. Rate-limit counters are held temporarily in server memory and reset when their window expires or the process restarts. We do not specify a fixed retention period for Cloudflare or Railway infrastructure logs or any provider-managed backups because one has not been established for this product.
Deleting your information
Use Erase local notebook in Settings to clear the local name, plan, unfinished strokes and result history and cancel pending reminders. Use Delete server backup separately to remove the encrypted snapshot, installation identifier and authorization hash from the active backend database. This action turns optional backup off and leaves your local notebook intact. Turning backup off alone does not delete an existing server copy. Provider-managed backups or infrastructure logs may persist under the provider's policies and are not immediately purged by the app's database deletion. The app has no account recovery mechanism. If the installation secret is lost, the app cannot authorize access to or deletion of that snapshot; contact MadocWrotham@icloud.com about available assistance without sending your secret or encryption key.
Permissions and your choices
The only optional permission requested is notification authorization, requested when you enable practice reminders. You can disable reminders in the app or withdraw notification permission in iPhone Settings. Disabling reminders cancels the app's pending reminders when the app can apply the change. Finger input requires no camera, microphone, contacts, photos or location permission. The app does not embed geographic maps. Optional backup can be disabled at any time and offline practice remains available.
Your privacy rights
Depending on your location, you may have rights to access, correct, delete or restrict processing of personal information, object to processing, or complain to your local data protection authority. You can review your practice history and change local preferences in the app, and use its local and server deletion controls. For privacy questions or rights requests, contact MadocWrotham@icloud.com. This address is a privacy contact only; the app has no email-delivery or support-ticket feature. Do not send installation secrets, encryption keys or sensitive medical information. Requests involving encrypted server content may be limited by the absence of an identifiable account or decryption key.
Security
The app connects to the public API using HTTPS. Cloudflare terminates public TLS and proxies requests to the pinned Railway HTTPS service origin. Notebook content remains encrypted at the application layer while passing through this route. Optional notebook snapshots are encrypted on the iPhone with AES-GCM using an installation-specific key. An independently generated installation bearer secret authorizes server requests, and the backend stores its SHA-256 hash and checks authorization before reading, updating or deleting a snapshot. The local notebook uses iOS file protection and installation material uses Keychain protection restricted to this device. The backend validates payloads and limits requests. These measures reduce risk but do not guarantee absolute security. There is no shared client credential, password account or promise of recovery after loss of installation material.
Children’s privacy
Myw Lefty Writing is intended for people aged 16 and older and is not designed for children under 16. It does not ask for a birth date or create age-based profiles. If you believe a child has provided information that should be removed, use the app's deletion controls where possible or contact MadocWrotham@icloud.com.
Changes to this policy
This policy may be updated when the app's processing or hosting practices change. The current version is available at this public privacy page and from Settings in the app. The effective date above identifies the current policy. Material changes will be described in the updated policy and, where required, communicated through an appropriate app notice.