Privacy policy

1. Who we are

ARI is a pre-launch app for families raising a child with SEND. The data controller for this website is The ARI App Limited, Unit A Bartholomew Studios, Bartholomew Street West, Exeter, England, EX4 3AJ, registered in England and Wales, company number 17349638.

2. What we collect

Two forms, kept separate. Joining one does not add you to the other.

If you join the waitlist

• Your email address. Required, because it is how we reach you.
• Your first name. Optional, so an email can say hello properly. Leave it blank and nothing changes.

If you offer to get involved

• Your email address. Required, so we can write back.
• Your first name. Optional, same as above.
• How you would like to help. Whichever boxes you tick, from a fixed list of seven.
• Anything you add in the free-text box. Optional, and entirely your choice what goes in it. Please do not put your child's details there.

Confirming your email

Whichever form you use, we send one email asking you to confirm the address. Until you click that link nothing else happens: you are not added to any list, our email provider is not told about you, and we do not write to you again.

What you typed is locked up on our own server in the meantime, using a key we do not keep. The only copy of that key is inside the link in your email, so until you click it, we cannot read what you sent us either. Clicking the link unlocks it, adds you to the list you chose, and deletes the locked-up copy.

The link lasts three days and works once. If it is not used, the locked-up copy is deleted within the hour after it expires. Nobody can read it in the meantime, and once it is gone there is nothing to recover, so if you lose the email you would need to sign up again.

We do this so that nobody can put your address on a list you did not choose, so that a mistyped address does not leave a stranger receiving our email, and so that an address that is never confirmed never reaches anyone but us.

If you tell us what would help

The What would help page asks you to pick three ideas from a list. What happens next depends on how you got there, and the difference is worth knowing.

• If you came to the page yourself, we record only which three you picked and the time. Nothing is stored alongside it: not your address, not your name, not a cookie, and not your browser or IP. There is nothing in that record to trace back to you, by us or by anyone else, so we cannot tell you later which three were yours.
• If you came from a link in one of our emails, the three you picked and the time are saved on your own record at our email provider instead, so that one person counts once. That does mean those choices sit next to your address, which is why that link only ever appears in an email we sent you.

Choosing nothing is a perfectly good answer. Nothing on the page is required, and not answering changes nothing about the emails you get.

However you use the site

• Your cookie choice. Stored in your own browser so we don't ask again on every page.
• Analytics, only if you say yes. Which pages you read, roughly where in the world you are, and what kind of device and browser you used. A random identifier keeps one visit from being counted as several. It is not linked to your name or your email address.

Our own server also keeps ordinary logs, such as IP address and browser type, for security and keeping the site up. The site runs on a machine we rent from Fasthosts in the UK, so how long those logs are kept is our decision, not theirs.

We do not ask for your child's name, age, diagnosis or any health information on this website, and please don't send it to us. This site has no need of it.

If you send us more than we asked for

If a form or an email reaches us carrying details about your child, a name, an age, a diagnosis, a school, a letter or a report, we do not keep it. This is what we do instead.

• We do not reply to that message. A reply would quote it back and make a second copy of it.
• If you asked us something, you still get an answer. We write to you on a new email thread that carries none of those details.
• We delete the original, from the inbox and from the deleted items folder.
• We delete it at our email provider too, so no copy is left sitting in their system. Who that provider is, is listed in section 5.
• If it arrived in the Get involved free-text box, we delete it from Mailjet as well, so no copy is left sitting on the list.
• It goes nowhere else. Never copied into a spreadsheet or any other record, never forwarded, never used to decide anything.

Details about a child's health or additional needs are special category data under UK GDPR Article 9. This website has no need of them and no basis for holding them, so anything that reaches us here is deleted. The app is a different question, and one we are working through properly before it holds anything real.

3. Why, and on what basis

4. How long we keep it

• A signup that is never confirmed: deleted within an hour of the confirmation link expiring, so a little over three days after it was entered. It never reaches our email provider at all, and it is unreadable to us for as long as it is held.
• A note that an address was used recently: up to 24 hours, as a scrambled version of the address that cannot be turned back into it by us. It stops someone entering a stranger's address over and over to bury them in our emails.
• Waitlist details: until you ask us to delete them, or until 12 months after launch, whichever comes first. Unsubscribing stops the emails; on its own it does not delete anything.
• Get involved details: until you tell us you no longer want to help, or 12 months after our last contact, whichever comes first.
• Anything about a child, sent to us by mistake: deleted as soon as we notice it, from our inbox and from our email provider, and not copied anywhere in the meantime.
• Which three ideas you picked, from a link in our email: held on your record at our email provider, so they go when the rest of your details go, or sooner if you ask.
• Which three ideas you picked, coming to the page yourself: kept as a running total while we decide what to build. There is nothing in it to delete on request, because there is nothing in it that is yours.
• Cookie choice: 12 months in your browser, then we ask again.
• Analytics: 12 months.
• Server logs: cleared every three months.

5. Who else sees it

We do not sell your data, and we do not share it for anyone else's marketing. These service providers process it on our behalf, on our instructions only:

• Email delivery and list storage: Mailjet, on its EU servers. Once you have confirmed, your address, your first name, which of the seven boxes you ticked, anything you wrote in the free-text box, and the three ideas you picked if you answered from one of our emails, are held there, so we can send you updates and reply about the right kind of help. If you unsubscribe, that is recorded there too, and it is what stops anything adding you back. Before you confirm, Mailjet is given nothing except the address needed to send you the confirmation email itself.
• Website hosting: Fasthosts, in the UK. Signups wait here, locked, between the moment you send the form and the moment you click the link.
• Analytics, only if you allow it: PostHog, on its EU cloud. It sees which pages are read and what kind of device you are on. It is never given your name or email address.

Hosting is in the UK. Mailjet and PostHog are both set to store data in the EU, and UK law treats the EEA as offering an equivalent standard of protection, so no separate transfer safeguards are needed. If we ever move a provider outside the UK or the EEA, this page says so before it happens.

6. Your rights

Under UK GDPR you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete it;
• restrict or object to how we use it;
• hand it to you, or another provider, in a portable format;
• withdraw your consent, which stops future emails but doesn't undo ones already sent.

Ask us at privacy@theariapp.co.uk and we'll respond within one month. It costs you nothing.

7. Cookies

We store one strictly necessary item to remember your choice, and nothing else unless you allow it. The full detail is in the cookie policy. You can change your choice whenever you like, on any page.

Change my cookie choice

8. Changes to this policy

If this changes in a way that matters, we'll update the date at the top and, if you are on the waitlist, tell you by email rather than quietly editing the page.

Before the app is built we are working through a Data Protection Impact Assessment, a Legitimate Interests Assessment, and the advice of a Data Protection Officer. That work is about what the app can hold and on what basis. None of it will widen what this website collects. This site takes an email address and a first name through its forms, plus anonymous analytics if you allow it, plus the three ideas you pick if you choose to answer that question, and that is where it stays. That last one was added on 12 August 2026, and it is the only thing this page has been widened to cover since it was published. The site still asks for nothing about your child, and it never will.

This is also not the finished thing. Once we know what the app can safely do, it will be a different product on a site built for it, with its own privacy policy written for what it actually does. Nothing on this page gets quietly stretched to cover that.

9. Contact and complaints

Write to us at privacy@theariapp.co.uk. If you are not happy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first, and we will take it seriously.