Privacy Policy

1. Data we collect

When you create an account and use the App, we collect:

• Account details — your email address and password. Your password is never stored in plain text; it is kept only as a secure cryptographic hash. We also record whether, and when, you confirmed your email address.
• Profile details — the display name you choose and your date of birth, used to confirm you meet the minimum age of 13.
• Challenge & progress data — the challenges you create (title, frequency, duration) and your daily or weekly check-ins, streaks, and statistics.
• Account email tokens — when you confirm your address or reset your password, we store a single-use token so the link in that email can be checked. Only a cryptographic hash of the token is kept, never the value in the email, and it expires (24 hours for confirmation, 30 minutes for a password reset).
• Technical data — authentication tokens stored securely on your device (via the device keystore), and basic server logs such as IP address and timestamps needed to run and secure the service.
• Push notification data — if you turn notifications on, a push token identifying your device, together with your device platform and the language the app is set to, so reminders reach the right phone in the right language. We also record which notifications we have already sent you, so you are never sent the same one twice. You can turn notifications off at any time in the app, or in your device settings.

We do not collect your location, contacts, or photos. The App contains no third-party advertising and no third-party analytics or tracking SDKs.

2. How we use your data

We use your data only to:

• create and manage your account and keep you signed in;
• store and display your challenges, check-ins, streaks, and statistics;
• send you account emails — confirming your email address, and letting you reset your password if you forget it. These are not marketing emails and you cannot be signed up to a mailing list;
• send the notifications you have switched on — a reminder when you have not checked in yet, and news from a challenge you share with friends;
• verify that you meet the minimum age requirement;
• keep the service secure and prevent abuse;
• respond to your support requests.

3. Legal bases (GDPR)

For users in the EU/EEA, we process your data on these legal bases (Art. 6 GDPR):

• Performance of a contract (Art. 6(1)(b)) — to provide the App’s core features to you.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure and functioning.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data by law.

4. Sharing and processors

We do not sell your personal data. We share it only with the service providers that process it on our behalf to run the App:

• Hosting & database provider — Railway — stores your account and challenge data.
• Email delivery — Google (Gmail) — receives your email address and the contents of account emails (address confirmation and password reset) in order to deliver them to you. It receives nothing else about you.
• Push notification delivery — Expo (Expo Development Tools / 650 Industries, Inc.) — receives your push token and the text of a notification in order to deliver it to Apple’s and Google’s push services. It receives nothing if you leave notifications off.

These providers act as processors under a data processing agreement and may use the data only to provide their service to us.

5. International transfers

Your data is stored on infrastructure provided by Railway. Depending on the region configured for the service, it may be processed within the EU/EEA or in the United States. Account emails are delivered through Google in the United States, which means your email address is transmitted there. If you turn notifications on, your push token and the text of each notification are additionally transmitted to Expo in the United States, and from there to Apple or Google, in order to deliver it. Where data is transferred outside the EU/EEA, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses.

6. Data retention

We keep your data for as long as your account exists. If you delete your account (in the App under Account & settings → Delete account), your account, challenges, and check-ins are permanently deleted. Limited backup or legally required records may be retained for a short period before being erased.

7. Your rights

If you are in the EU/EEA (and in many other regions), you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at weitersoapp@gmail.com. You can also delete your account and all associated data directly in the App at any time.

8. Children

The App is not intended for children under 13. You must be at least 13 years old to create an account. If we learn that we have collected data from a child under 13 without appropriate consent, we will delete it.

9. Security

Passwords are stored only as secure hashes, authentication tokens are kept in your device’s secure storage, and data is transmitted over encrypted connections (HTTPS). No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the App after changes take effect means you accept the updated policy.

11. Contact

Questions about this policy or your data? Contact the Weiter so! team at weitersoapp@gmail.com.