JouraEffective: September 15, 2026. This EU / UK Privacy Notice supplements the Joura Privacy Policy for people in the European Economic Area (EEA), the United Kingdom, and Switzerland. Where this notice adds detail for those regions, it applies together with the main Policy. It refers to the EU General Data Protection Regulation, Regulation (EU) 2016/679 ("GDPR"), and the UK GDPR.
The short version
- Your child's information and the moments you write stay encrypted on your device. We never receive them and cannot read them.
- Joura works with no account. The little data that reaches us is tied only to a random, pseudonymous identifier, never your name or your child, apart from any text you choose to type into a website demo or send as feedback.
- You have the full set of GDPR rights below. To use them, email contact@wandering-castle.com.
- We do not sell your data, do not use it for advertising, and never use your family's private entries to train AI models.
1. Who is responsible (controller)
The data controller is Wandering Castle LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA, contact@wandering-castle.com.
Data protection officer. Given the small volume and low-risk, anonymous nature of the data we process, we are not required to appoint a data protection officer and have not appointed one. You can raise any question at the contact address above.
EU / UK representative. We consider our processing to fall within the exemption in Article 27(2) GDPR (and its UK equivalent): it does not involve large-scale processing of special categories of data, and is unlikely to result in a risk to your rights and freedoms, because the sensitive content of your use stays on your device and only minimal, pseudonymous, non-content data reaches us. We keep this assessment under review, will confirm it with counsel, and will appoint a representative if the nature or scale of our processing changes.
2. What we process, and why (legal bases)
We process the limited information described in Section 3 of the Privacy Policy, which is anonymous and non-content apart from the optional text you choose to submit (for example, feedback, or words you type into a website demo). For each purpose we rely on a legal basis under Article 6 GDPR:
| Purpose | Data | Legal basis (Art. 6) |
|---|---|---|
| Keep the app reliable, secure, and fix crashes | Anonymous, structural analytics and crash diagnostics | Legitimate interests (Art. 6(1)(f)): running and securing the Service, balanced against your rights, which is reasonable because the data is anonymous and non-content |
| Provide and manage a subscription you buy | Purchase and subscription status tied to an anonymous identifier | Performance of a contract (Art. 6(1)(b)) |
| Read and act on feedback you choose to send | The feedback you type, and an optional email if you give one | Consent (Art. 6(1)(a)): you choose to send it |
| Website analytics (only if you accept) | Privacy-conscious, aggregate site analytics | Consent (Art. 6(1)(a)), via the cookie banner; see the Cookie Policy |
| Interactive website demo (only if you use it) | The words you type into the demo, to learn what parents need and improve Joura | Consent (Art. 6(1)(a)): via the cookie banner, and by choosing to submit it |
| Send occasional product updates (newsletter, opt-in) | The email you submit | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, you can object as described in Section 4. Where we rely on consent, you can withdraw it at any time, and doing so does not affect processing that already happened.
Special-category data. We do not collect special-category data (Article 9 GDPR) about you or your child through our servers. Anything sensitive stays encrypted on your device and never reaches us.
3. Your rights
Under the GDPR and UK GDPR you have the right to: access your data; ask us to correct it; ask us to erase it; restrict or object to processing (including any processing based on legitimate interests); data portability; and to withdraw consent at any time. You are also not subject to any solely-automated decision that produces legal or similarly significant effects (see Section 6).
You can access, correct, export, and delete your on-device information directly in the app at any time, and delete everything we hold through the in-app "delete" control or our web deletion request. To make any other request, email contact@wandering-castle.com. We respond free of charge within one month (extendable by two further months for complex requests, with notice). Because we design for anonymity and hold no account or name, we may be unable to link a request to a specific person without more information, and sometimes cannot identify your data at all (Article 11 GDPR); we will explain if that is the case.
Complaints. You have the right to lodge a complaint with a supervisory authority. In the EEA this is your local data protection authority; in the UK it is the Information Commissioner's Office (ICO), ico.org.uk. We would appreciate the chance to address your concern first.
4. How to object to legitimate-interests processing
You can object at any time to the anonymous analytics and diagnostics we run on the basis of legitimate interests. In the app you can turn analytics off in Settings; for anything else, email us and we will stop the processing unless we have compelling legitimate grounds that override your interests.
5. International transfers
We operate primarily on servers in the United States, and our service providers may process data in the United States and other countries. Where personal data is transferred out of the EEA or UK, we rely on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (and, for the UK, the UK International Data Transfer Addendum or IDTA), included in our agreements with providers, and the EU-U.S. Data Privacy Framework where a provider is certified. You can ask us for more information about these safeguards.
6. Automated decisions and AI transparency
Joura runs on a deterministic, on-device engine, not an AI system. It does not use a large language model, and the content you enter is not sent to us or to an outside AI service. We do not make decisions about you by solely automated means that produce legal or similarly significant effects (Article 22 GDPR).
For transparency: Joura's suggestions are not generated by AI. They are drawn from published expert guidance by a rule-based engine, and are general information for you to weigh with your own judgment, not professional advice, and never a diagnosis of your child. If Joura ever adds a generative-AI feature, we will disclose it here in line with the EU Artificial Intelligence Act, Regulation (EU) 2024/1689 (Article 50), before it ships.
7. Retention
On-device content stays until you delete it or remove the app. Anonymous analytics and diagnostics are kept only as long as needed for the purposes above and then deleted or aggregated. Feedback and subscription records are kept while needed to run the Service and to meet legal, accounting, or security obligations. See the retention detail in the main Privacy Policy.
8. Children
Joura is for parents and caregivers, who must be adults; it is not directed to children and we do not knowingly collect data from a child. Where a child's own consent would otherwise be relevant, the digital-consent age under the GDPR is set by each member state between 13 and 16, and a holder of parental responsibility consents below that age. A parent may record information about their own child; that stays encrypted on the parent's device and never reaches us.
9. Cookies
Our website uses privacy-conscious analytics that only run if you accept them; see the Cookie Policy. The Joura app does not use advertising cookies or trackers.
10. Changes and contact
We will update this notice and the date above as needed. Questions or requests: Wandering Castle LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA, contact@wandering-castle.com. This notice is written in English; any translation is for convenience only and the English version controls.