Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use the App, you may provide us with the following information:

• Account Information: Your name, email address, and profile picture (when signing in via Google Sign-In or email authentication).
• User-Generated Content: Goals, habits, streak data, progress entries, and any motivational or belief-related data you input into the App.
• Communication Data: Information you provide when you contact us for support or feedback.

1.2 Information Collected Automatically

When you use the App, we may automatically collect certain information, including:

• Device Information: Device type, operating system version, unique device identifiers (such as Android Advertising ID), device model, and language settings.
• Usage Data: App interaction data, feature usage patterns, session duration, screens viewed, and timestamps of activity.
• Analytics Data: Aggregated and anonymized analytics data collected through Firebase Analytics, including app opens, in-app events, and user engagement metrics.
• Push Notification Tokens: Firebase Cloud Messaging (FCM) tokens used to deliver push notifications to your device.
• Crash and Performance Data: Diagnostic information including crash logs, performance metrics, and error reports to help us improve the App.

1.3 Information from Third-Party Services

• Google Sign-In: If you choose to sign in using Google, we receive your name, email address, and profile picture from your Google account, as authorized by you.
• Google Play Billing: Transaction identifiers and subscription status are provided by Google Play. We do not receive, process, or store your payment card details, banking information, or other financial account data.

1.4 Information We Do NOT Collect

BetonSelf does not knowingly collect:

• Biometric data
• Health or medical data
• Racial or ethnic origin
• Religious or philosophical beliefs
• Political opinions
• Sexual orientation
• Financial account details (credit/debit card numbers)
• Precise geolocation data

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and Maintain the App: To operate the App, authenticate your identity, and deliver the core features including habit tracking, streak monitoring, progress dashboards, and motivational graphs.
• Personalization: To personalize your experience, including reminders, notifications, and content recommendations based on your usage patterns.
• Push Notifications: To send you reminders, motivational messages, and updates about your streaks and goals via Firebase Cloud Messaging.
• Subscription Management: To manage your premium subscription status and provide access to advanced features.
• Analytics and Improvement: To analyze usage trends, monitor App performance, diagnose technical issues, and improve the App's functionality and user experience.
• Customer Support: To respond to your inquiries, requests, and feedback.
• Security and Fraud Prevention: To detect, prevent, and address fraud, abuse, security risks, and technical issues.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or any other jurisdiction that requires a legal basis for processing personal data, we rely on the following legal grounds:

• Performance of a Contract (Article 6(1)(b) GDPR): Processing is necessary to provide you with the App's services, manage your account, and fulfill our obligations under our Terms of Service.
• Legitimate Interests (Article 6(1)(f) GDPR): Processing is necessary for our legitimate interests, including improving the App, ensuring security, preventing fraud, and conducting analytics, provided such interests are not overridden by your data protection rights.
• Consent (Article 6(1)(a) GDPR): Where required by law, we obtain your consent before processing your personal data, such as for sending marketing communications or push notifications. You may withdraw your consent at any time.
• Legal Obligation (Article 6(1)(c) GDPR): Processing is necessary to comply with a legal obligation to which we are subject.

4. Data Retention

We retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

• Account Data: Retained for as long as your account is active. Upon account deletion, your personal data will be deleted or anonymized within thirty (30) days, except where retention is required by law.
• Usage and Analytics Data: Retained in aggregated or anonymized form for up to twenty-four (24) months for analytical purposes.
• Transaction Records: Subscription transaction identifiers may be retained for up to five (5) years to comply with financial and tax regulations.
• Communication Records: Support correspondence is retained for up to twelve (12) months following the resolution of your inquiry.

When personal data is no longer required, we will securely delete or irreversibly anonymize it.

5. Cookies and Tracking Technologies

The BetonSelf mobile application does not use browser cookies. However, the App utilizes the following tracking technologies:

• Firebase Analytics: Uses device identifiers and instance IDs to collect anonymized usage and engagement data. This helps us understand how users interact with the App and improve our services.
• Firebase Cloud Messaging: Uses device tokens to deliver push notifications. These tokens are unique to your device and app installation.
• Android Advertising ID: The App may access your device's Advertising ID for analytics purposes. You can reset or opt out of personalized advertising through your device settings (Settings → Google → Ads).

We do not use any third-party advertising SDKs or serve advertisements within the App.

6. Third-Party Services

The App integrates with the following third-party services, each of which has its own privacy policy governing the use of your information:

• Google Firebase (Analytics, Authentication, Cloud Messaging, Hosting, Firestore/Realtime Database)
  Privacy Policy: https://firebase.google.com/support/privacy
• Google Play Services
  Privacy Policy: https://policies.google.com/privacy
• Google Play Billing
  Terms of Service: https://play.google.com/about/play-terms/
• Google Sign-In
  Privacy Policy: https://policies.google.com/privacy

We encourage you to review the privacy policies of these third-party services to understand how they collect, use, and share your information.

7. Data Security

We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols.
• Encryption of data at rest within Firebase infrastructure.
• Secure authentication mechanisms via Firebase Authentication.
• Access controls and role-based permissions for data access.
• Regular security reviews and monitoring of our systems.

While we strive to protect your personal data, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information.

8. Children's Privacy

The App is not intended for use by individuals under the age of thirteen (13). We do not knowingly collect personal data from children under 13. If you are a parent or guardian and you become aware that your child has provided us with personal data without your consent, please contact us at betonself10@gmail.com. If we become aware that we have collected personal data from a child under 13 without verification of parental consent, we will take steps to delete that information from our servers promptly.

For users in the European Economic Area, the relevant age threshold may be higher (up to 16 years) depending on the applicable Member State legislation. We comply with the age requirements of each applicable jurisdiction.

9. International Data Transfers

Your personal data may be transferred to, stored, and processed in countries other than the country in which you reside, including the United States, where Google's servers and data centers are located. These countries may have data protection laws that differ from the laws of your jurisdiction.

Where we transfer personal data outside the EEA or the United Kingdom, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions by the European Commission or the UK Secretary of State.
• Other legally approved transfer mechanisms under applicable data protection laws.

By using the App, you acknowledge and consent to the transfer, storage, and processing of your personal data in accordance with this Privacy Policy.

10. Your Rights

10.1 Rights Under GDPR and UK GDPR

If you are located in the EEA or the United Kingdom, you have the following rights under applicable data protection law:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request deletion of your personal data, subject to certain legal exceptions.
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data under certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your Member State or country of habitual residence.

10.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the CCPA/CPRA:

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share your information.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising purposes. Therefore, no opt-out mechanism for sale or sharing is required.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

10.3 Rights Under India DPDP Act, 2023

If you are a resident of India, you have the following rights under the Digital Personal Data Protection Act, 2023:

• Right to Access: You have the right to obtain a summary of your personal data being processed and the processing activities undertaken.
• Right to Correction and Erasure: You have the right to correct inaccurate or misleading personal data and to erase personal data that is no longer necessary for the purpose for which it was collected.
• Right to Grievance Redressal: You have the right to have your grievances addressed in a timely manner. You may contact our Grievance Officer at the contact details provided below.
• Right to Nominate: You have the right to nominate another individual to exercise your rights in the event of your death or incapacity.

11. Opt-Out and Deletion Rights

11.1 Push Notifications

You may opt out of receiving push notifications at any time by adjusting your notification preferences in your device settings or within the App's settings.

11.2 Analytics Opt-Out

You can limit analytics data collection by resetting your Android Advertising ID or opting out of personalized ads through your device settings (Settings → Google → Ads → Opt out of Ads Personalization).

11.3 Account Deletion

You may request deletion of your account and all associated personal data by using the account deletion feature within the App (Settings → Delete Account).

Upon your request, we will delete or anonymize your personal data within thirty (30) days, except where retention is required by applicable law.

11.4 Data Export

You may request a copy of your personal data in a portable format by contacting us at betonself10@gmail.com. We will respond to your request within thirty (30) days.

12. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. As the App is a mobile application and does not operate through a web browser in normal use, we do not currently respond to DNT signals. However, you can exercise your privacy choices as described in this Privacy Policy.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Effective Date" at the top of this Privacy Policy.
• Notify you through the App or via email, as appropriate.
• Where required by law, obtain your consent to the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the App after any changes to this Privacy Policy constitutes your acceptance of such changes.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For users in the European Economic Area, the United Kingdom, or India, you may also lodge a complaint with your local data protection authority or supervisory body if you believe that your data protection rights have been violated.

We will endeavor to respond to all legitimate requests within thirty (30) days. In certain circumstances, we may need to request additional information from you to verify your identity before processing your request.