Privacy Policy · ChallengeFinds

DRAFT — pending Erik's approval. Not published. This draft was prepared by an AI assistant and is not legal advice; a qualified lawyer should review it before publication.

Last updated: [[PUBLICATION_DATE]]

ChallengeFinds is a free iOS app for following 30-day bodyweight fitness challenges, published by Happy 360 Ltd. This policy explains what data the app handles, why, and what your rights are. We have tried to keep it in plain English. In this policy, "we", "us", and "our" mean Happy 360 Ltd.

The short version:

You can use the whole app without an account. Signed out, everything you log stays on your iPhone and is never sent to us.
If you create an account, we store your email address and your challenge progress (including mood ratings and notes) on our server so it can be backed up and restored on a new phone.
No ads, no third-party analytics, no tracking. The app contains no advertising or analytics SDKs and does not track you across other apps or websites.
The app is completely free. There are no purchases, subscriptions, or payment data.
You can delete your account and all server data yourself, inside the app, at any time.

1. Who is responsible for your data (data controller)

Controller: Happy 360 Ltd Registered office: The Penthouse, 83, Camilleri Buildings, Oratory Street, Naxxar, NXR 2504, Malta Company registration: C 97030, registered in Malta Email: privacy@challengefinds.com

If you have any question about this policy or your data, contact us at the email above.

2. What data we handle, and why

2.1 If you use the app without an account

All your data — active challenges, daily check-offs, exercise progress, mood ratings (1–5 scale), notes, streaks, and reminder settings — is stored only on your device, in the app's local database. It is not transmitted to us. It is removed when you delete the app.

The only network requests a signed-out app makes are anonymous reads of the public challenge catalog (challenge names, descriptions, exercise instructions, images) from our server. These requests do not identify you, though our hosting provider's infrastructure logs (see §2.3) apply.

2.2 If you create an account (optional)

An account exists for one purpose: backing up your progress to the cloud so you can restore it on another phone. If you sign in, we store on our server:

Category	Data	Where it lives
Account	Email address; internal account ID (a random UUID); sign-in method (Apple, Google, or email); account created / last sign-in timestamps	Authentication system + `profiles` table
Challenge activity	Which challenges you started/completed/abandoned and when	`active_challenges` table
Daily logs	Per-day completion, mood rating (1–5), optional free-text note	`challenge_day_logs` table
Exercise progress	Per-exercise running totals per day (reps/seconds)	`challenge_progress` table

Notes are free text; please be aware that anything you type there (including health details) is synced to your account if you are signed in.

Sign in with Apple: we receive only the email address Apple provides (which may be Apple's private relay address if you choose "Hide My Email") — we request no name or other scope. Google Sign-In: we receive your Google account email address via a standard OAuth flow. Email magic link: we use your email address to send you a one-time sign-in link.

Authentication tokens are stored in your device's Keychain, restricted to that device.

2.3 Technical data

Like almost every internet service, our hosting provider (Supabase, see §4) automatically records short-lived technical logs of API requests — IP address, timestamps, and request metadata — for security, abuse prevention, and debugging. We do not use these logs to profile you.

2.4 What we do NOT collect

No location data, contacts, photos, microphone, or camera access.
No health data from HealthKit or any other Apple health API.
No advertising identifiers (IDFA); the app never requests App Tracking Transparency permission because it does no tracking.
No third-party analytics, advertising, or crash-reporting SDKs — we verified the app binary includes none.
No payment or billing data — the app is free and contains no purchases.

2.5 Notifications

Daily reminders and the re-engagement nudge are local notifications scheduled entirely on your device. No push-notification server is involved, no device push token is created, and nothing about your reminders leaves your phone. You control them in the app's Settings and in iOS Settings.

3. Lawful bases (GDPR / UK GDPR)

Processing	Lawful basis
Creating your account, authenticating you, syncing and storing your challenge progress, mood, and notes	Contract (Art. 6(1)(b)) — this is the service you asked for when you created an account
Sending magic-link sign-in emails	Contract (Art. 6(1)(b))
Security / infrastructure logs (IP addresses, request logs)	Legitimate interests (Art. 6(1)(f)) — keeping the service secure and working
Responding to your support or rights requests	Legal obligation (Art. 6(1)(c)) and legitimate interests

We do not process special-category data on purpose. Mood ratings and workout logs are wellness data, not medical records; free-text notes are under your control. We do not analyse them for any purpose — they exist solely so you can read them back.

4. Who processes data for us (sub-processors)

Provider	Role	Location
Supabase (Supabase Inc.)	Database, authentication, and API hosting for accounts and synced progress. Our project runs in the EU (AWS eu-central-1, Frankfurt, Germany)	EU data hosting; Supabase Inc. is a US company acting under its Data Processing Addendum with EU Standard Contractual Clauses
Apple	"Sign in with Apple" identity provider (only if you choose it)	Apple processes the sign-in under its own terms
Google	"Sign in with Google" identity provider (only if you choose it)	Google processes the sign-in under its own terms
[[SMTP_PROVIDER]]	Delivery of magic-link sign-in emails. Currently Supabase's built-in mailer; a custom SMTP provider will be configured before launch — name it here once chosen	[TBD — depends on [[SMTP_PROVIDER]]]

We do not sell or share your data with anyone else. We disclose data only if required by law.

5. International transfers

Your synced data is stored in the European Union (Frankfurt, Germany). Where a provider (e.g. Supabase Inc., Apple, Google) is established outside the EU/UK, transfers rely on that provider's safeguards — EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as applicable.

6. How long we keep data (retention)

Account and progress data: kept for as long as your account exists. Deleted immediately and permanently when you delete your account (§7). We keep no backups of deleted accounts beyond our hosting provider's standard short-term infrastructure backups, which roll off automatically after [[BACKUP_RETENTION_DAYS]] days.
Local device data: under your control; removed when you delete the app.
Infrastructure logs: retained briefly per Supabase's standard log retention, then discarded.

7. Your rights and how to use them

Under the GDPR / UK GDPR you have the right to access, rectify, erase, restrict, object, and port your data, and to complain to a supervisory authority.

Delete everything: in the app, go to Settings → Delete account… This permanently deletes your account and all synced data from our servers (progress, logs, notes, everything), with no waiting period. Data stored locally on your phone remains until you delete the app.
Export your data: we can provide a complete machine-readable (JSON) copy of everything stored about your account. [PLACEHOLDER — the backend export endpoint exists; decide whether v1 exposes an in-app "Export my data" button or handles export via email request to the contact in §1. Until a button ships, this policy should say: "email us and we will send your export within 30 days."]
Everything else (access, correction, objection): email the contact in §1. We respond within one month.
Complaints: you may lodge a complaint with your local data protection authority. The supervisory authority for Happy 360 Ltd is the Office of the Information and Data Protection Commissioner (IDPC), Malta.

Because signed-out use is fully local, most rights can also be exercised directly: your data is on your device, under your control.

8. Children

ChallengeFinds is a general-audience fitness app and is not directed at children. You must be at least 16 to create an account. We do not knowingly collect data from children below that age; if you believe a child has created an account, contact us and we will delete it.

9. Security

Synced data travels over HTTPS only. Server-side access is protected by per-user row-level security — each account can read and write only its own rows. Session tokens are kept in the iOS Keychain on your device. Admin access to the backend is limited to authorised Happy 360 Ltd personnel.

10. Changes to this policy

If we change this policy in a way that matters, we will update the date above and note the change in the app or on this page before it takes effect.

Open questions for Erik

Controller identity (§1): RESOLVED 2026-08-18. Happy 360 Ltd, registered in Malta (reg. C 97030), registered office The Penthouse, 83, Camilleri Buildings, Oratory Street, Naxxar, NXR 2504, Malta. This is also the Apple Developer team (Team ID 39JQUH86A6), so it is the name shown publicly on the App Store listing. Lead supervisory authority is the Maltese IDPC (§7); governing law in the Terms is Malta.

Transfer note: controller (Malta) and the primary processor (Supabase, AWS eu-central-1, Frankfurt) are both in the EEA, so the main data store involves no third-country transfer and needs no SCCs. This does not automatically hold for every sub-processor — Apple and Google sign-in, and any future SMTP provider, must each be checked before any blanket "no international transfers" claim is made.
Privacy contact email (§1, privacy@challengefinds.com): which address? (Needs to exist before App Store submission — Apple requires a working privacy policy URL.)
Data export (§7): the backend export-data function exists and works, but there is no in-app button for it. Decide: add a Settings button in WS4 (recommended — cheap, strengthens GDPR posture), or handle exports manually via email for v1.
Email/SMTP provider (§4, [[SMTP_PROVIDER]]): once the custom SMTP provider is chosen (pending per backend/AUTH-SETUP.md), name it in the sub-processor table.
Minimum account age (§8, 16) — DECISION NEEDED. Researched 2026-08-18: Malta lowered the GDPR Art. 8 digital-consent age to 13 (Subsidiary Legislation 586.11), not the GDPR default of 16.

Recommendation: set the minimum account age to 16 anyway. The Art. 8 age varies by the user's country of residence (13 in Malta, 16 in Ireland and Germany, 15 in France). The app has no parental-consent mechanism and building one is out of scope for v1. Setting 16 means we never need one. Setting 13 would oblige us to obtain verifiable parental consent for 13–15 year-olds in every member state with a higher age. Align age-rating.md with whichever Erik picks — this is independent of the 4+ App Store content rating.
Backup retention window (§6, [[BACKUP_RETENTION_DAYS]]): confirm the Supabase plan's backup retention (typically 7 days on the free/pro tier) so the stated window is accurate.
Backend subscription/trial infrastructure: RESOLVED 2026-08-18. The trial/entitlement gate was removed from the live backend (migration free_v1_open_entitlement_gate; can_log() now always true; start-challenge v4 has no entitlement 403 path). The entitlements table and RevenueCat webhook remain in place, dormant, for v2 — the webhook is still deployed, so if RevenueCat is ever wired the table could receive rows. Verified 2026-08-18: entitlements is empty and account_trial is not enforced. This draft correctly describes a free app with no purchases.
Hosting location claim: verified as Supabase project qjucfsdsehwejueclvgj in AWS eu-central-1 (Frankfurt) per backend/README.md. If the project is ever migrated, §4–5 must be updated.