Privacy Policy

Controller

The controller within the meaning of the GDPR is:

[Operator name]

[Street and number]

[Postal code and city]

Email: [Contact email]

Data collected and purposes of processing

Account data: To provide your user account, we process your email address. It is used for signing in and for associating your data with you.

Reflection and habit data: The habits you create as well as your daily reflection entries (ratings, values, dates) are stored in order to provide you with trends, streaks and summaries and to sync them across your devices.

Push notifications: If you enable reminders, we store a push token for your device in order to send you smart reminders.

Technical data: When operating the application, technically necessary connection data (e.g. IP address, time of the request) is generated, which is required to deliver and secure the service.

Legal bases for processing

The processing of your account, habit and reflection data is carried out to perform the usage agreement pursuant to Art. 6 (1) (b) GDPR.

The processing of the push token for reminders is based on your consent pursuant to Art. 6 (1) (a) GDPR, which you can withdraw at any time with effect for the future.

The processing of technically necessary connection data for the secure and stable provision of the service is based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR.

Hosting and data processing

We host the application and its associated database with Supabase. The project is located in a data center region within the European Union.

Your data is stored encrypted in transit via TLS and at rest. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

Registration and authentication

Sign-in is passwordless via a one-time code (email OTP): we send a code with a limited validity period to your email address, which you use to authenticate. No password is stored.

Retention period

We store your personal data for as long as your account exists and it is required for the purposes described. If you delete your account, your data, including all habits and reflection entries, is deleted completely, unless statutory retention obligations apply.

Your rights as a data subject

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and the right to object to processing (Art. 21 GDPR).

You can delete your account and all associated data completely and irreversibly at any time directly within the app.

You can withdraw any consent you have given at any time with effect for the future.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement.

Contact

For questions about data protection or to exercise your rights, you can reach us at:

[Contact email]