Privacy Policy

We collect only the information necessary to provide the app's core features: Account Information: When you create an account, we collect your email address and a password (stored as a secure hash — we never store your plain-text password). Profile Information: We collect your first name, which you provide during onboarding. This is used solely to personalize your dashboard. Habit Data: We store the names of habits you create and a log of the dates on which you mark each habit as complete. Journal Entries: We store the text you write in response to the app's daily journal prompts and any free-form notes you add. This content is private to your account. We do not collect your location, contacts, camera, microphone, financial information, or any other device data.

We use the information we collect solely to operate and improve the app: — To authenticate you and maintain your session securely. — To display your habits, streaks, progress, and journal entries within the app. — To calculate streak and completion statistics shown on your dashboard. — To send transactional emails required for account management (email confirmation, password reset). We do not send marketing emails. We do not use your data for advertising, profiling, or any purpose beyond operating the app.

Your data is stored on Supabase, a secure cloud database platform. All data is encrypted in transit using TLS and encrypted at rest. Access to your data is enforced at the database level using Row Level Security (RLS) policies, meaning each user can only access their own data — even within the database itself. Your password is never stored in plain text. Authentication is handled by Supabase Auth, which uses industry-standard bcrypt hashing. We do not have access to your password. If you forget it, you must reset it via email.

We use a small number of third-party services to operate the app: Supabase (supabase.com) — Database, authentication, and backend infrastructure. Your account data and app data are stored on Supabase servers. Supabase is SOC 2 Type II certified. See their privacy policy at supabase.com/privacy. Vercel (vercel.com) — Web hosting and content delivery. Vercel serves the web version of the app. See their privacy policy at vercel.com/legal/privacy-policy. Apple Inc. — If you use the iOS app, your download and any in-app purchases are subject to Apple's Privacy Policy at apple.com/privacy. RevenueCat (revenuecat.com) — Manages in-app subscriptions and purchases. When you upgrade to Viceless Pro, RevenueCat receives your anonymous user identifier and Apple-issued purchase receipt to validate your subscription and entitlement status. RevenueCat does not receive your name, email, or app content. See their privacy policy at revenuecat.com/privacy. Resend (resend.com) — Sends transactional emails such as email verification and password reset. Receives your email address only when an email is sent. See their privacy policy at resend.com/legal/privacy-policy. We do not sell, rent, or share your personal data with any third party for advertising or marketing purposes. We do not use any analytics, tracking, or advertising SDKs.

We retain your data for as long as your account is active. You may delete your account and all associated data at any time by contacting us at privacy@viceless.co. Upon receiving your request, we will permanently delete your account, habits, habit logs, and journal entries within 30 days. Note: Deletion is permanent and cannot be undone.

Depending on where you live, you may have the right to: — Access a copy of the personal data we hold about you. — Correct inaccurate data. — Request deletion of your data. — Request that we restrict or stop processing your data. To exercise any of these rights, contact us at privacy@viceless.co. We will respond within 30 days.

Viceless is not directed at children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@viceless.co and we will delete it promptly.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the app after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: privacy@viceless.co We take privacy seriously and will respond to all inquiries within 30 days.