Privacy Policy

Self Streak (“we”, “our”) is a free personal productivity tracker (web + Android app + API). This policy explains what data we collect, why, how long we keep it, and the choices you have. It applies in every country where the service is available, including under the EU GDPR, India's DPDP Act 2023, and California's CCPA/CPRA.

1. Who we are

Self Streak is an independent project. For privacy questions, requests, or complaints, contact us at support@selfstreak.space. We aim to respond within 30 days.

2. Data we collect

Account data (required to run your account): name, username, email address, and a password hash (we never store your password itself). If you sign in with Google, we receive your name, email address, and profile picture from Google.

Your content: daily tasks (names, tracked time, descriptions, source links, schedules, reminders), checklist items, money wallets, categories and transactions, motivation settings, and feedback messages. This is stored so the service works and syncs across your devices.

Journal entries — end-to-end encrypted: your journal text, moods, and tags are encrypted on your device before upload. We store only ciphertext plus non-sensitive metadata (account id, date, and time) needed to sync and list entries. We cannot read your journal content.

Technical data: login sessions, password-reset tokens (hashed), error logs, and privacy-friendly usage analytics (page views without cookies or cross-site tracking). Push-style reminders are scheduled on your own device, not from our servers.

3. Data we do NOT collect

• No advertising identifiers and no ad networks.
• No sale of personal data, ever.
• No bank credentials — the expense tracker is fully manual.
• No precise location — time-zone settings are used only to time reminders.

4. Why we use your data (legal bases)

• Contract: running your account, syncing, reminders, and support.
• Consent:product update emails (opt out anytime via any email's unsubscribe link or profile settings) and optional analytics where applicable.
• Legitimate interests: security, fraud prevention, and fixing bugs — balanced against your privacy.

5. Cookies and local storage

We do not use advertising or cross-site tracking cookies. Details are in our Cookie Policy. In short: sign-in tokens live in your device's secure storage, analytics are cookieless, and Google's own cookies apply only if you use Google sign-in.

6. Who else sees your data

• Hosting & infrastructure: our servers, databases, and file storage providers process data only to operate the service.
• Email delivery (AWS SES): sends password resets, feedback confirmations, and release updates you opted into.
• Google:only when you choose Google sign-in, under Google's own policies.
• Legal: we disclose data only when required by applicable law.

7. How long we keep data

• Account and content data: until you delete your account.
• Deletion grace period: requesting deletion signs you out immediately and schedules permanent erasure 15 days later. We email you when it is scheduled, again 48 hours before, and once more after it completes. Signing in at any point during the 15 days cancels the deletion and keeps everything.
• Login sessions: expire automatically (about 30 days of inactivity).
• Password-reset tokens: expire 30 minutes after issue.
• Feedback messages: kept to improve the service unless you ask us to remove them.

8. Your rights

Regardless of where you live, you can:

• Access & portability: view everything in the app and export your log as CSV from Profile / More.
• Correction: edit your profile, tasks, wallets, and entries at any time.
• Deletion: delete individual items in the app, or delete your entire account (Profile → Delete account). Deletion takes effect after a 15-day grace period so an accidental request can be undone by signing back in; afterwards everything is permanently erased. You can also email us to request deletion.
• Opt out: unsubscribe from product emails with one click, or turn them off in settings.
• Complain: contact us first; you also have the right to approach your local data-protection authority.

9. Security

Passwords are hashed, sessions are revocable, journal content is end-to-end encrypted, and administrative access is limited. No system is perfectly secure, so we encourage a unique password and locking devices you sign in on.

10. Children

Self Streak is for users aged 13 and older. Users under 18 should only use it with a parent or guardian's permission. If we learn a child's account lacks required consent, we will delete it.

11. Changes to this policy

We will update this page when our practices change and revise the date above. Material changes will also be announced in release notes.