Privacy Policy

1.1 Information You Provide

• Email address: Used for account creation, authentication, password recovery, and service notifications.
• Password: Stored as a salted hash by our authentication provider (Supabase). We never see or store your plaintext password.
• Onboarding preferences: The prayer category you select (e.g., business, marriage, purpose, anxiety, discipline), your preferred daily notification time, and your self-selected "walk stage." These personalize your prayer journey.
• Display name on badges: An optional toggle you control that determines whether your name appears on shareable streak badge images. This is off by default.

1.2 Information Collected Automatically

• Streak and completion data: Your current and longest daily prayer streak, total days completed, grace ("ember") tokens, and the dates of completions. Computed on your device and synced to your profile so it persists across devices.
• Tier achievement timestamps: When you reach prayer streak milestones (Foundation, The Walk, The Faithful, The Watcher, The Fire, The Conqueror), the date of that achievement is recorded.
• Notification preferences: Your chosen daily reminder time, stored to schedule local reminders on your device.
• Device identifiers: Anonymous identifiers used by our analytics and subscription providers to attribute events and manage your subscription across devices. These are not linked to your identity in our analytics platform.

1.3 Information We Do NOT Collect

• We do not collect or process photos, camera images, microphone input, location data, contacts, health data, or biometric data.
• We do not use artificial intelligence (AI) features that send your personal content to third-party AI providers.
• We do not use your device for cryptocurrency mining or hidden background processing.
• We do not sell your personal information to third parties.

• To create and manage your account and authenticate you across devices.
• To personalize your prayer experience based on your selected category and walk stage.
• To track and display your daily prayer streak, milestones, and tier achievements.
• To schedule local daily reminder notifications at your chosen time.
• To process and manage your subscription through the App Store and Google Play.
• To understand how the App is used in aggregate so we can improve features, fix bugs, and prioritize development.
• To send you service-related emails (account verification, password reset). We do not send marketing emails unless you separately opt in.

We use the following third-party services. Each operates under its own privacy policy. We share only the minimum data each service needs to function.

• Supabase (Supabase, Inc.) — Authentication, database hosting, account management. Data shared: email, hashed password, profile data. supabase.com/privacy
• RevenueCat (RevenueCat, Inc.) — Subscription management and entitlement verification. Data shared: anonymous app user ID, purchase receipts, subscription status. revenuecat.com/privacy
• PostHog (PostHog, Inc.) — Product analytics (aggregate usage, crash reporting). Data shared: anonymous event data, anonymous device ID. No email, no name, no prayer content. posthog.com/privacy
• Apple App Store / Google Play Store — In-app purchase processing and subscription billing. apple.com/legal/privacy · policies.google.com/privacy

4.1 On Your Device

• Authentication tokens are stored in the iOS Keychain (iOS) or Android Keystore (Android) — the most secure storage available on each platform. We do not store tokens in less secure stores like AsyncStorage or SharedPreferences.
• Your streak data and profile preferences are cached locally so the App works offline, and synced to our server when you are online.
• You can clear all local data by signing out or deleting your account.

4.2 On Our Servers

• Your profile data is stored in a Supabase PostgreSQL database protected by Row Level Security (RLS). You can only read and write your own data — no other user can access it.
• All data in transit between your device and our servers uses TLS 1.2+ encryption. Cleartext HTTP is disabled in the App configuration.
• Access to the database is restricted to authenticated users via short-lived access tokens with rotating refresh tokens.

4.3 Data Minimization

We collect only what is needed to provide the App's features. We do not collect data for purposes unrelated to the App's function.

We do not sell, rent, or trade your personal information. We share data only:

• With the third-party service providers listed in Section 3, to the extent necessary for them to provide their services.
• When required by law, court order, or legal process, to the extent we are legally compelled to comply.
• In connection with a merger, acquisition, or sale of all or part of our business, subject to the same privacy protections.

Depending on your jurisdiction (e.g., GDPR, CCPA, and similar laws), you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Deletion: Request that we delete your account and associated data. You can do this directly in the App under Profile → Delete Account.
• Data portability: Request your data in a machine-readable format.
• Restriction: Request that we limit processing of your data.
• Withdrawal of consent: Withdraw any consent you previously gave (e.g., analytics tracking).

To exercise any of these rights, contact us at support@bareyourteeth.co. We will respond within 30 days.

You can delete your account at any time, directly within the App:

• Open the App and navigate to your Profile screen.
• Tap Delete Account and confirm.

Account deletion is permanent and irreversible. When you delete your account:

• Your authentication credentials are removed from our auth provider.
• Your profile, streak data, tier achievements, and preferences are deleted from our database.
• Your subscription is cancelled (if active), though you must also cancel through the App Store or Google Play to avoid future billing.
• Any locally cached data on your device is cleared on your next app launch.

With your permission, the App sends a daily local reminder notification at the time you choose. These notifications:

• Are scheduled locally on your device — we do not send push notifications from our servers containing your personal data.
• Contain only a generic message ("Time to command your day. Your daily word is ready.") and never include personal or prayer-specific content.
• Can be turned off at any time in the App's notification settings or in your device's system settings.

The App is not directed to children under 13 (US) or 16 (EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

The App is rated 12+ on the App Store and Teen on Google Play due to its religious and motivational content.

If you access the App from outside the United States, your data may be transferred to and processed in the United States or other countries where our service providers operate. By using the App, you consent to such transfers. We take reasonable steps to ensure your data is protected in accordance with this policy and applicable law.

We retain your data for as long as your account is active. When you delete your account, we remove your data from our production systems within 30 days. Aggregate, de-identified analytics data may be retained indefinitely, as it cannot be linked back to you.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App or on our website and updating the "Last updated" date above. Continued use of the App after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your data, contact us at:

BYT
Email: support@bareyourteeth.co