Privacy policy

Last updated: 5 November 2026.

This policy covers the Section apps for iPhone (from the App Store) and Android (from Google Play), Section Pro tools and the Section website. Section is an independent UK police reference project and is not an official police or government service.

Section is operated by Andrew Dunn, a sole trader trading as HANDYANDY3d, 124 City Road, London, EC1V 2NX, United Kingdom. He is the data controller for the personal data described in this policy and is registered with the Information Commissioner's Office (registration number ZC289056). For privacy questions, email support@sectionapp.co.uk or use the Section support form.

Core app

The core reference library works offline on both iPhone and Android. Bookmarks, preferences, disclaimer acceptance and the local offence database stay on your device. Section has no user accounts, advertising SDKs, advertising identifier or cross-app tracking. On Android, Section asks for no runtime permissions. It uses the network only when you use an online tool or send feedback; nothing is sent when the app starts or in the background.

If you use your phone's own backup (Google backup on Android, iCloud Backup on iPhone), your bookmarks, recent offences, settings and terms acceptance may be included in it so they come back on a new phone. That backup is held by Google or Apple in your account, not by Section, and Section cannot read it. The free-allowance key and the Statement Writer draft are never included.

Pro AI tools and the free monthly allowance

When you use an online Pro tool on iPhone, the text you enter, Apple's signed subscription evidence and, where available, an Apple device-verification identifier are sent over encrypted connections to Section's Cloudflare-hosted service. The service uses these to provide the feature, verify Pro access, prevent abuse and apply daily usage limits.

On Android, when you use Search Section or Statement Writer, the text you enter and a signature from the app's attestation key (with the key's identifier and a counter) are sent over encrypted connections to Section's Cloudflare-hosted service, which uses them to provide the feature, apply the free allowance, prevent abuse and apply daily usage limits. On both iPhone and Android, Search Section sends only descriptions of conduct of eight characters or more; questions and short searches are answered on the phone.

Without a subscription, Search Section and Statement Writer can be used a few times each month (3 statements and 10 searches), on iPhone and on Android. To make this possible without an account, the iPhone app uses Apple's App Attest service: on first use it creates a key held in your iPhone's Secure Enclave, Apple certifies that the key belongs to a genuine copy of Section distributed through Apple, and each free request is signed with that key. Section's service stores the key's public half, a one-way hash of its identifier, its App Attest environment and a signature counter, and counts free use per key and UTC calendar month, with a daily total across all free users. To limit abuse, the short-lived registration challenge carries a daily one-way network fingerprint and is deleted within five minutes; the raw network address is not stored. This identifies the app installation, not you. Deleting the app discards the key on your iPhone; the server's key record (with its signature counter) and the monthly counts for that key are deleted after 12 months without use, and are not linked to any account, name or Apple ID. A phone that comes back after that simply registers again. Because the record is not linked to your name, email or account, Section cannot find it from those details; once the key is gone from your phone, the record can never be used again.

App Attest is not available on Android, so the Android app uses Android Keystore key attestation instead. On first use it creates a key in your phone's secure hardware (its Trusted Execution Environment or StrongBox chip); the private half cannot leave the phone. The phone then provides a certificate chain, issued by keys that lead back to Google's attestation root, which states that the key is held in secure hardware, that the phone's bootloader is locked and its software verified, and that the key belongs to Section as signed for Google Play. Section's service checks that chain against Google's published roots and Google's public list of revoked certificates; checking the list sends Google no information about you or your phone, and Section does not use Google Play Integrity. Each free request is then signed with that key. Section's service stores the key's public half, a one-way hash of its identifier, its security level (TEE or StrongBox), the attestation format version, its environment, a signature counter, and the serial numbers of the key's certificate and the certificates that issued it, so that it can stop accepting the key if Google later revokes one of them. It counts free use per key and UTC calendar month, within the same daily total as the iPhone app. It does not keep the rest of the certificate chain or the device details in it, such as the Android version or security patch level. The registration challenge is handled as on iPhone. To stop one network registering many installations, Section's service also counts registrations per day against the same one-way network fingerprint (for IPv6, the network's /64 prefix) and deletes those counts after two days. The raw network address is not stored. Phones that cannot prove a locked bootloader and verified software, such as emulators and phones with an unlocked bootloader or modified system software, cannot use the free allowance. This identifies the app installation, not you. Uninstalling the app or clearing its data discards the key; the server's key record (with its counter and certificate serial numbers) and the monthly counts for that key are deleted after 12 months without use, as on iPhone, and are not linked to any account, name or Google account.

• Statement Writer keeps one working input and generated draft encrypted on this device until one hour after your last change, including after the app is closed. On Android, the draft and its key are excluded from Android backup and device transfer. A new statement, expiry, or Delete all Statement Writer drafts removes it. Copy and Share are separate actions you control.
• Section's service does not write Statement Writer prompts or outputs to its application database or usage records. Section cannot retrieve a statement from those records.
• The usage database stores an opaque one-way subscription-derived quota key, UTC day, count and update time. These daily Pro usage records are deleted after 90 days. For the free allowance it stores the App Attest key record (iPhone) or the Android Keystore key record (Android) described above and a count per key, feature and UTC month. It does not store the raw StoreKit proof, Apple device identifier, Android certificate chain or statement text.
• Cloudflare processes the request and network, routing, security and invocation metadata needed to deliver and protect the endpoint. Section's application error logs record bounded error codes or upstream status values, not prompt or output bodies.
• Statement Writer sends the constructed prompt to Anthropic's commercial Messages API and returns Anthropic's output to the app. It does not use OpenAI or Cloudflare Workers AI.

Anthropic's current standard commercial API policy says it deletes API inputs and outputs from its backend within 30 days, except where a different retention arrangement or a longer-retention feature applies, where content must be retained for Usage Policy enforcement, or where law requires retention. Content flagged for a Usage Policy violation may be retained for up to two years and safety classification scores for up to seven years. Statement Writer uses the Messages API and does not use the Files API. Anthropic's Commercial Terms say it may not train models on customer content. See Anthropic API retention, Anthropic Commercial Terms and Anthropic's Data Processing Addendum.

For Statement Writer, use placeholders only. Do not enter names, addresses, identifiers, or personal, sensitive or operational information. The app does not use a personal-information detector and cannot reliably identify every name or identifier. It does not reject ordinary wording merely because it resembles a name or uses a particular format. See the Statement Writer Terms of Use.

Section does not use Pro input for advertising or tracking. Cloudflare Web Analytics applies to public website pages for aggregate measurement; it is not embedded in either app's Statement Writer request flow.

Subscriptions

On iPhone, Section Pro subscriptions are purchased through Apple. Apple processes payment details and controls trial eligibility, renewals, cancellation and refunds. Section receives StoreKit entitlement information needed to unlock Pro; it does not receive your card or bank details.

Section Pro is not yet available in the Android app. When it is, it will be purchased through Google Play, which will process payment and control trial eligibility, renewals, cancellation and refunds, and this policy will be updated before then to describe the purchase information Section's service receives to check a subscription.

Website

The website uses Cloudflare hosting and may use cookieless Cloudflare Web Analytics for aggregate traffic measurement. It does not use advertising pixels.

In-app feedback

When you send feedback, Section stores the category and message, the related offence when applicable, and any contact email you choose to provide. You can also choose whether to include the app version, build, operating system version (iOS or Android) and device model; in the feedback form this choice starts switched on, and you can turn it off before sending. Section does not include a device identifier in feedback reports. Cloudflare processes the request and a daily one-way network fingerprint is used only to limit abuse; the raw network address is not retained in the feedback record. Each report, including any reply email and diagnostics, is emailed to the Section team so it can be read and answered, and a copy is kept for 90 days, then deleted. To have a report deleted sooner, send its reference (and the reply email you gave, if any) through the support form.

Search Section and Statement Writer have a Report this answer option for AI output that is wrong, unsafe or offensive. A report is sent as feedback and kept the same way. By default it includes only the tool, the reason you choose and any short note you add. Your question and the AI answer (for Search Section) or an excerpt of the draft (for Statement Writer) are included only if you tick the option to include them, see exactly what will be sent and confirm. App and device diagnostics and a reply email are added to a report only if you choose to include them.

Do not include names, addresses, crime references or other sensitive operational information. Feedback is used to investigate faults, correct content, provide support and plan product improvements.

Sharing and retention

Data is shared only with service providers needed to deliver Section, including Apple (iPhone app distribution and subscriptions), Google (Android app distribution through Google Play), Cloudflare, Anthropic and, for Pro tools other than Statement Writer where configured, OpenAI. Statement Writer itself is Anthropic-only. We do not sell personal data. Feedback, quota and service records are retained only while needed for access, support, security, accounting or legal obligations. Email addresses previously collected on the website waitlist are retained on the same basis and are not used for unrelated marketing.

Your choices

You can avoid all online Pro processing by using the offline reference features only. On iPhone, you can manage or cancel a subscription in your Apple Account subscription settings. To ask about Section's processing, access, correction or deletion, use the in-app feedback form or the Section support form. Do not include statement content or operational personal data in the request.

Changes

If Section adds accounts, advertising, new analytics, or materially different data use, this policy, the App Store privacy answers and the Google Play Data safety answers will be updated before that change ships.