Privacy Policy
This page explains what data Setlyr collects — on this website (including the waitlist) and in the Setlyr app — why we collect it, and what your rights are. We've tried to write it in plain English. If anything isn't clear, email hello@setlyr.com and we'll explain.
1. Who we are
Setlyr Limited (company number 17305710, registered in England and Wales) builds the Setlyr app for people settling in the UK. Our registered office is at 238 Wednesbury Road, Walsall, WS2 9QN, England. For the purposes of the UK GDPR and the EU GDPR, we are the data controller for the information described on this page. You can reach us at hello@setlyr.com.
2. The short version
- The Setlyr app contains no advertising, no tracking and no third-party analytics SDKs.
- Your account data is stored with Supabase in the EU (Frankfurt, Germany).
- We never sell or rent your data to anyone.
- Subscriptions are bought through Google Play — Google handles the payment, and we never see your payment details.
- The app only knows what you type into it — it requests no access to your location, contacts, photos, camera or microphone.
- You can delete your account and all its data at any time with one email.
3. What we collect on this website
If you just browse, we see only anonymous, aggregated page-view counts — no cookies, no personal data (see section 9). If you join the waitlist:
| What | Why | Legal basis |
|---|---|---|
| Your email address | So we can tell you when Setlyr launches and apply your 3-months-free credit. | Consent (you typed it in and clicked join). |
| A referral code we generate for you, plus a count of friends who signed up using it | To make the "skip the queue" referral mechanic work. | Legitimate interest (running the waitlist as advertised). |
| A one-way hash of your IP address and your browser's user-agent string | Soft anti-abuse — to stop someone scripting thousands of fake signups. We do not store your raw IP. | Legitimate interest (preventing abuse of the service). |
| The time you joined | To assign your position in the queue. | Legitimate interest. |
That's it. We don't ask for your name, phone number, address, or any other personal information on this website.
4. What we collect in the Setlyr app
The app is built around information you choose to enter:
| What | Why | Legal basis |
|---|---|---|
| Your email address and password (the password is stored only as a cryptographic hash — we can never read it) | To create your account, confirm your email address, sign you in and reset your password. | Contract (providing the service you signed up for). |
| The profile you enter during onboarding: your first name, the country you're moving from, the stage of your move, your (planned) arrival date, your UK city, your visa type, your interests, and household details such as whether you're moving with children | To personalise your guides, your plan and everything else the app shows you. It's the whole point of Setlyr. | Contract. |
| Your progress and activity in the app: which tasks and steps you've ticked off, which guides you've saved, liked or recently opened, and how far you've read | So the app can pick up exactly where you left off — including on a new phone. | Contract. |
| Cost Planner entries (optional): income and pension contribution, household make-up (adults, children, childcare), housing type and rent, utilities, transport and other monthly spending estimates, plus one-off moving costs | To estimate what your life in the UK will cost. Only stored if you use the planner — you can skip it entirely. | Contract. |
| Your subscription status: which plan you're on, whether it's active, and when it renews or expires — plus the Google Play purchase token that proves the purchase | To unlock the paid parts of the app for you and keep them unlocked, including on a new phone. The purchase itself happens entirely inside Google Play — see below and section 6. | Contract. |
| Access-code redemptions: if you unlock the app with an access code instead, we record which code your account redeemed and when | To give you the access the code promises and to make sure each code is only used as intended. | Contract. |
If you take out a subscription, the payment itself is handled entirely by Google Play. Google is the merchant of record: your payment card, billing address and invoices are processed by Google under its own privacy policy, and none of that ever reaches us. All we learn is whether your account has an active subscription.
Your profile, progress and planner data are saved on your device and synced to your account, so you don't lose them if you switch phones. The app requests no device permissions beyond internet access — no location, no contacts, no photos, no camera, no microphone, and no push notifications.
5. What we don't do
- No advertising and no ad networks.
- No third-party analytics, crash-reporting or tracking SDKs in the app — we can't watch how you use it, and we're fine with that. (The only third-party SDK in the app is RevenueCat's billing SDK, which handles subscriptions — see section 6 — and does no advertising or cross-app tracking.)
- No selling, renting or "sharing for value" of your data. Ever.
- No automated decisions about you with legal or similarly significant effects.
- Messages you type into the in-app chat are currently processed on your device only and are not stored on our servers. If we connect the chat to a live AI service in the future, we'll update this policy first and tell you in the app.
6. Who processes your data, and where it lives
We use a small number of companies as data processors — they handle data on our behalf, under contract, and are not allowed to use it for their own purposes:
- Supabase — runs our database and the app's sign-in. Your app account data and the waitlist database live in Supabase's Frankfurt (EU) region. Supabase also sends account emails such as the address-confirmation and password-reset email. (Supabase privacy notice)
- Cloudflare Inc. — hosts this website, processes traffic, and provides cookieless visitor analytics (Cloudflare Web Analytics). (Cloudflare privacy notice · About Cloudflare Web Analytics)
- Resend Inc. — sends waitlist emails such as your signup confirmation and the launch announcement. (Resend privacy notice)
- RevenueCat, Inc. — validates in-app subscriptions bought through Google Play and tells the app which features to unlock. RevenueCat receives your account's random user ID (a pseudonym — not your name or email address), the Google Play purchase token and your subscription state. It never sees your payment details. (RevenueCat privacy notice)
Google is not a processor for us: when you buy a subscription, Google acts as the seller (merchant of record) and processes your payment data as an independent controller under its own privacy policy.
Cloudflare, Resend and RevenueCat are US-headquartered and may process data in the US and other countries; these transfers rely on recognised safeguards such as the EU–US Data Privacy Framework and standard contractual clauses, as permitted under the UK and EU GDPR — with RevenueCat we have a data processing agreement in place that incorporates the standard contractual clauses. Your account data itself stays in Frankfurt.
7. How long we keep it
- App account data (profile, progress, planner entries): for as long as you have an account. Delete your account and it's permanently gone — see section 8.
- Subscription state and access-code redemptions: for as long as you have an account — they're deleted with it. Google keeps its own record of your Google Play purchases under Google's policies.
- The copy on your device: removed when you sign out; uninstalling the app removes it too.
- Waitlist signups: until you ask us to delete them, or until 6 months after launch (whichever is sooner), at which point we remove signups that didn't convert into an account.
- Hashed IP and user-agent from the waitlist: up to 90 days for abuse review, then deleted.
8. Delete your account
Email hello@setlyr.com with the subject "Delete my account" from the address you signed up with. We'll confirm and permanently delete your account and everything attached to it — profile, progress, Cost Planner data, subscription state and access-code records — within 30 days.
One thing we can't do for you: cancel a Google Play subscription. If you have one, cancel it yourself in the Play Store (Profile → Payments & subscriptions → Subscriptions) — deleting your Setlyr account does not stop Google from billing you.
Two things that are not the same as deletion: "Clear all progress" in the app's settings resets your checklists and saved items but keeps your account, and uninstalling the app removes the copy on your phone but not the copy in your account.
9. Cookies and analytics
This site sets no cookies. To understand how many people visit the site, we use Cloudflare Web Analytics — a cookieless, privacy-first analytics tool that does not collect personal data, set cookies, use cross-site identifiers, or fingerprint your device. It records only aggregated page-view metrics (such as the number of visits and which page they landed on) and the standard request headers any website receives. Because no personal data is processed, this falls outside the UK PECR consent requirement, so we don't ask you to accept any cookies.
You can read more on the Cloudflare Web Analytics page and in Cloudflare's privacy notice. The only other network requests this page makes are to load our own self-hosted fonts, stylesheet and script, and — when you submit the form — to our own signup endpoint at /api/waitlist. We no longer load anything from Google Fonts on this website; all fonts are served from this domain.
The app sets no cookies and contains no analytics. It stores your data locally on your device so it can work offline, plus a session token that keeps you signed in.
10. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- Ask what data we hold about you ("subject access request")
- Ask us to correct anything that's wrong
- Ask us to delete your data ("right to be forgotten")
- Ask us to restrict how we use it, or to give you a copy in a portable format
- Object to how we're using it
- Withdraw your consent at any time — replying "unsubscribe" to any email from us, or emailing hello@setlyr.com, is enough
We aim to respond within 7 days, and never longer than the 30 days required by law.
11. Children
Setlyr is made for adults organising a move to the UK and is not directed at children. We don't knowingly collect data from anyone under 16. If you add household details about your family — for example, that you're moving with children — that's information you choose to enter, and you can remove it at any time.
12. Security
All traffic between the app or this website and our servers is encrypted in transit (TLS). Passwords are stored only as cryptographic hashes. Database access is protected by row-level security, meaning your account can only ever read its own data. Our database runs in the EU (Frankfurt).
13. Complaints
If you think we've handled your data badly, please tell us first so we can fix it. You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office at ico.org.uk or on 0303 123 1113; in the EU, the data protection authority of your country of residence.
14. Changes to this policy
We'll update this page if we ever start collecting different data or using new processors. If the changes are material we'll tell you by email or in the app before they take effect.
15. Contact
Questions about this policy? Email hello@setlyr.com.