Privacy Policy

1. Data we collect

When you create an account and use the App, we collect:

• Account details — your email address and password. Your password is never stored in plain text; it is kept only as a secure cryptographic hash. We also record whether, and when, you confirmed your email address.
• Profile details — the display name you choose. We do not ask for your date of birth: when you sign up, you confirm that you are at least 13. (Accounts created with an earlier version of the App may have given a date of birth; it is no longer used or shown.)
• Challenge & progress data — the challenges you create (title, frequency, duration) and your daily or weekly check-ins, streaks, and statistics.
• Account email tokens — when you confirm your address or reset your password, we store a single-use token so the link in that email can be checked. Only a cryptographic hash of the token is kept, never the value in the email, and it expires (24 hours for confirmation, 30 minutes for a password reset).
• Technical data — authentication tokens stored securely on your device (via the device keystore), and basic server logs such as IP address and timestamps needed to run and secure the service.
• Proof photos — only if you choose to add one to a check-in in a group challenge. The photo is shown to the members of that group for 7 days and then deleted. Location and other metadata are removed on your phone before it is uploaded. If someone reports a photo, we record who reported it and when, to review it.
• Push notification data — if you turn notifications on, a push token identifying your device, together with your device platform, its time zone, and the language the app is set to, so reminders reach the right phone at a sensible hour and in the right language. We also record which notifications we have already sent you, so you are never sent the same one twice. You can turn notifications off at any time in the app, or in your device settings.

We do not collect your location or contacts, and the App only accesses your camera or photos when you choose to add a proof photo — and then only the one photo you take or pick. The App contains no third-party advertising and no third-party analytics or tracking SDKs.

2. How we use your data

We use your data only to:

• create and manage your account and keep you signed in;
• store and display your challenges, check-ins, streaks, and statistics;
• send you account emails — confirming your email address, and letting you reset your password if you forget it. These are not marketing emails and you cannot be signed up to a mailing list;
• send you a weekly email about your own challenges: how your week went, your streak, and — in a group challenge — the display names of the members who reached the week’s goal (never their email addresses). Until you confirm your email address, it shows only your own progress. You can turn it off for each challenge under the bell in the app, or for all challenges with the unsubscribe link in every email;
• show the proof photos you choose to share to the other members of your group, and review photos that someone has reported;
• send the notifications you have switched on — a reminder when you have not checked in yet, and news from a challenge you share with friends;
• apply the minimum age of 13, which you confirm when you sign up;
• keep the service secure and prevent abuse;
• respond to your support requests.

3. Legal bases (GDPR)

For users in the EU/EEA, we process your data on these legal bases (Art. 6 GDPR):

• Performance of a contract (Art. 6(1)(b)) — to provide the App’s core features to you.
• Consent (Art. 6(1)(a)) — for proof photos, which you share only if you choose to. You can delete a photo at any time, and it is deleted automatically after 7 days.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure and functioning, including reviewing reported photos.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data by law.

4. Sharing and processors

We do not sell your personal data. We share it only with the service providers that process it on our behalf to run the App:

• Hosting & database provider — Railway — stores your account and challenge data.
• Email delivery — Resend — receives your email address and the contents of the emails we send you (address confirmation, password reset and the weekly email) in order to deliver them to you. It receives nothing else about you.
• Photo storage — Cloudflare (Cloudflare, Inc., R2 storage) — stores the proof photos you share, for 7 days. Photos are private: only members of your group can open them, through links that expire after an hour.
• Push notification delivery — Expo (Expo Development Tools / 650 Industries, Inc.) — receives your push token and the text of a notification in order to deliver it to Apple’s and Google’s push services. It receives nothing if you leave notifications off.

These providers act as processors under a data processing agreement and may use the data only to provide their service to us.

5. International transfers

Your data is stored on infrastructure provided by Railway. Depending on the region configured for the service, it may be processed within the EU/EEA or in the United States. Account emails and the weekly email are delivered through Resend in the United States, which means your email address and the contents of those emails are transmitted there. If you turn notifications on, your push token and the text of each notification are additionally transmitted to Expo in the United States, and from there to Apple or Google, in order to deliver it. Proof photos you share are stored with Cloudflare, Inc., a US company, and may be stored or processed outside the EU/EEA. Where data is transferred outside the EU/EEA, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses.

6. Data retention

We keep your data for as long as your account exists. If you delete your account (in the App under Account & settings → Delete account), your account, challenges, check-ins, and photos are permanently deleted. Proof photos are kept for 7 days at most and are deleted earlier if you delete them, undo the check-in they belong to, or delete your account. Limited backup or legally required records may be retained for a short period before being erased.

7. Your rights

If you are in the EU/EEA (and in many other regions), you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at weitersoapp@gmail.com. You can also delete your account and all associated data directly in the App at any time.

8. Children

The App is not intended for children under 13. You must be at least 13 years old to create an account. If we learn that we have collected data from a child under 13 without appropriate consent, we will delete it.

9. Security

Passwords are stored only as secure hashes, authentication tokens are kept in your device’s secure storage, and data is transmitted over encrypted connections (HTTPS). No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the App after changes take effect means you accept the updated policy.

11. Contact

Questions about this policy or your data? Contact the Weiter so! team at weitersoapp@gmail.com.