Privacy Policy

We collect only the information necessary to provide the app's core features: Account Information: When you create an account, we collect your email address and a password (stored as a secure hash — we never store your plain-text password). Profile Information: We collect your first name, which you provide during onboarding. This is used solely to personalize your dashboard. Habit Data: We store the names of habits you create and a log of the dates on which you mark each habit as complete. Journal Entries: We store the text you write in response to the app's daily journal prompts and any free-form notes you add. This content is private to your account. Usage Events: We keep a short record of actions you take in the app — for example finishing onboarding, logging a habit for the first time, opening a notification, or viewing the upgrade page. Each record holds only the name of the action, the screen it came from, when it happened, and your account identifier. Usage events never contain your habit names or anything you write in your journal. Advertising Measurement Data (iOS app only): The iOS app includes Meta's measurement SDK, which we use to tell which of our ads actually bring people to the app. It reports events such as app installs, launches and purchases to Meta, together with device-level information: a device identifier, device model, operating system and app version, language and time zone. It never receives your name, email address, habit names, or anything you write in your journal, and it is not joined to your Viceless account. We have turned Meta's advertising-identifier collection off, and the app never asks for permission to track you across other companies' apps and websites, so Meta's measurement is limited to Apple's privacy-preserving SKAdNetwork and to aggregated reporting. The Android app does not include this SDK. We do not collect your location, contacts, camera, microphone, or financial information. Apart from the advertising measurement data described above, we collect no device data.

We use the information we collect solely to operate and improve the app: — To authenticate you and maintain your session securely. — To display your habits, streaks, progress, and journal entries within the app. — To calculate streak and completion statistics shown on your dashboard. — To send you emails about your own account and your own progress, described in full in Section 5. — To understand how the app is used, so we can find where it is confusing or broken and improve it. This is what the usage events in Section 1 are for, and we read them in aggregate. We do not sell your data, and we never use anything you write — your habits, your journal entries, your name — for advertising or profiling. We do not send you marketing emails about other products. The advertising measurement described in Section 1 tells us only how many installs and purchases a campaign produced; it never touches your app content.

Your data is stored on Supabase, a secure cloud database platform. All data is encrypted in transit using TLS and encrypted at rest. Access to your data is enforced at the database level using Row Level Security (RLS) policies, meaning each user can only access their own data — even within the database itself. Your password is never stored in plain text. Authentication is handled by Supabase Auth, which uses industry-standard bcrypt hashing. We do not have access to your password. If you forget it, you must reset it via email.

We use a small number of third-party services to operate the app: Supabase (supabase.com) — Database, authentication, and backend infrastructure. Your account data and app data are stored on Supabase servers. Supabase is SOC 2 Type II certified. See their privacy policy at supabase.com/privacy. Vercel (vercel.com) — Web hosting, content delivery, and website traffic measurement. Vercel serves the web version of the app. Vercel Web Analytics records aggregate visit information for the website — such as pages viewed, the referring site, country, and device or browser type — so we can see which marketing channels bring people to the site. It is not linked to your account, is not used to build advertising profiles, and is switched off inside the iOS and Android apps. See their privacy policy at vercel.com/legal/privacy-policy. Apple Inc. — If you use the iOS app, your download and any in-app purchases are subject to Apple's Privacy Policy at apple.com/privacy. Google LLC — If you use the Android app, your download and any in-app purchases are subject to Google's Privacy Policy at policies.google.com/privacy. RevenueCat (revenuecat.com) — Manages in-app subscriptions and purchases. When you upgrade to Viceless Pro, RevenueCat receives your anonymous user identifier and the store-issued purchase receipt (Apple on iOS, Google Play on Android) to validate your subscription and entitlement status. RevenueCat does not receive your name, email, or app content. See their privacy policy at revenuecat.com/privacy. Meta Platforms, Inc. (meta.com) — Advertising measurement, iOS app only. Receives the install, launch and purchase events and the device-level information described in Section 1, so that we can tell which ad campaigns bring people to the app. Meta does not receive your name, email address, habit names, or journal entries, and receives nothing that identifies your Viceless account. See their privacy policy at facebook.com/privacy/policy. Resend (resend.com) — Sends the emails described in Section 5, including account emails such as email verification and password reset. Receives your email address, your first name, and (for the Weekly Ledger) your habit names and completion figures at the time an email is sent. See their privacy policy at resend.com/legal/privacy-policy. We do not sell, rent, or share your personal data with any third party for advertising or marketing purposes. The usage events described in Section 1 are written to our own Supabase database and are never sent to an outside service. Apart from Meta's measurement SDK in the iOS app, described above, the iOS and Android apps contain no third-party analytics, tracking, or advertising SDKs. The public website uses Vercel Web Analytics for aggregate traffic measurement only, as described in Section 4.

We send two kinds of email, and you control the second kind. Account emails. These are required to use your account and cannot be turned off while the account exists: email address confirmation, and password reset. We only send these in response to something you did. Progress and reminder emails. These are about your own account and your own habit data. They are: — A welcome email when you finish onboarding. — At most two reminder emails during your first several days, if you have not started logging or have stopped. — The Weekly Ledger, sent on Mondays to users who logged at least one habit during the previous week. It contains your habit names and how many days you held each one. You can stop all progress and reminder emails at any time. Every one of them carries an unsubscribe link at the bottom, and we also include the standard one-click unsubscribe header that lets your mail app do it for you. Opting out takes effect immediately and applies to every future email of this kind. The same link lets you turn them back on if you change your mind. You can also simply reply to any of these emails and we will stop them by hand. We do not send you marketing about other products or services, we do not email you on behalf of anyone else, and we never sell, rent, or share your email address.

We retain your data for as long as your account is active. You may delete your account and all associated data at any time directly within the app (Settings → Delete account). Account deletion is immediate and permanently removes your account, habits, habit logs, and journal entries. If you prefer, you may also request deletion by contacting us at privacy@viceless.co, and we will permanently delete your data within 30 days of receiving the request. Step-by-step instructions, including what is deleted and what is retained, are at vicelessdisciplinetracker.app/delete-account. Note: Deletion is permanent and cannot be undone.

Depending on where you live, you may have the right to: — Access a copy of the personal data we hold about you. — Correct inaccurate data. — Request deletion of your data. — Request that we restrict or stop processing your data. To exercise any of these rights, contact us at privacy@viceless.co. We will respond within 30 days.

Viceless is not directed at children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@viceless.co and we will delete it promptly.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the app after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: privacy@viceless.co We take privacy seriously and will respond to all inquiries within 30 days.