Privacy.

Who is responsible

Data we process

An account includes your email address, chosen display name, authentication identifiers and security/session data. Commitments may include titles, rules, schedules, time zone, verification events, consequences, reviews and completion history. If you choose social features, we process invitations, witness roles and challenge participation. Public presence is opt-in.

Optional verification can process photos, videos, audio recorded with videos, compact HealthKit-derived workout, distance or step facts, and compact location-visit facts. Raw HealthKit samples are read on-device and are not used for advertising. Location is requested only for a commitment that uses location verification. Push notification tokens are used only to deliver the product notifications you enable.

Purchases

Apple processes payment details. RevenueCat processes an app user identifier, product, entitlement, purchase and subscription status so we can provide Pro and restore it across installs. We do not receive your full payment-card details.

Optional usage analytics

Usage analytics are off by default in the iOS app. If you turn on “Share usage analytics” in Settings, PostHog receives app interaction events and your account identifier to help us understand which features work and where people get stuck. You can turn this off again in Settings. We do not send commitment titles, proof media or raw HealthKit samples as analytics events.

Purpose and legal basis

We process account and commitment data to provide the service and purchases (Article 6(1)(b) GDPR), optional permissions with your consent (Article 6(1)(a)), and limited operational and security records for our legitimate interest in a reliable and abuse-safe service (Article 6(1)(f)). We do not sell personal data or use it for cross-app tracking.

Processors and transfers

Supabase provides authentication, database and private file storage; Vercel hosts the web service; Apple provides App Store, subscription, HealthKit and push infrastructure; and RevenueCat provides subscription entitlement infrastructure. PostHog processes the optional usage analytics described above. International transfers are protected by an adequacy decision or appropriate safeguards such as Standard Contractual Clauses where required.

Retention and deletion

You can start deletion in the iOS app under You → Settings → Delete account. We remove the sign-in identity, private evidence files, device tokens and public challenge presence. Shared integrity records may be retained in anonymized form so another participant’s contract history remains understandable. Operational delivery errors are kept only as long as needed to retry and diagnose delivery. Statutory retention duties may override a deletion request for the required period.

Deleting an account does not cancel an Apple subscription. Manage it in your Apple Account subscription settings before deletion.

Your rights

You may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests by contacting us. You may also complain to a data protection authority, including the State Commissioner for Data Protection Lower Saxony.