PRIVACY POLICY

Sharper Daily ("we," "the app") respects your privacy. This policy explains what information we collect, how we use it, and the choices you have.

What we collect

• Account info: your email address and either a hashed password OR a sign-in token from your chosen authentication provider (Google if you use "Continue with Google," Apple if you use "Continue with Apple" — Apple may provide a private-relay email that hides your real address). Stored by our authentication provider, Supabase. If you use Continue with Google, Google also shares your name and profile-picture link; our authentication provider (Supabase) stores them with your account record. The app does not display or use them.
• Your activity in the app: which quotes you liked, which you saved (and when you saved them), any private notes (reflections) you write on quotes, including a draft while you are still typing, your reading streak and streak freezes, your daily reading goal, your mood check-ins (the mood you pick when you tap "How are you feeling?"), your category filter, your daily screen-time limit and the accumulated screen time itself, your progress through guided Paths and practices, and your audio preferences (voice gender per language, playback speed, and auto-read on/off). All of this is stored locally on your device, scoped to your account.
• Settings: your chosen language, theme (dark/light), accent color, heart color, card style, text size, story-writing speed, your daily-reminder time and how many reminders per day, and your chosen background sound. Stored locally on your device, scoped to your account.
• Subscription status: if you subscribe to Sharper+, whether your subscription is active. See "Google Play Billing and RevenueCat" below.
• Technical data: when the app or this website contacts our providers, they keep standard technical logs (IP address, time, app and system version). Our sign-in provider (Supabase) keeps a security log of account events such as sign-ins, which can include your email address and IP address. The app also sends anonymous usage and error events to Aptabase (for an error, only its type name), together with your device language, operating system and version, the app version, how many days ago you installed the app and the week you installed it. Aptabase uses your IP address only briefly, on its servers, to work out your approximate country and region; it does not store the IP address.
• Emails you send us: if you write to our support address, we receive your email address and what you write. An email started from Settings → Contact Support is pre-filled with one line of technical details (app version and build, Android version, phone model and app language) so that we can find the problem; you see that line and can delete it before you send the email. Support emails arrive in a Google (Gmail) mailbox.
• Apart from that, we do not collect your phone number, contact list, precise location, or any other personal information. If we ever add a new category of data collection, we will update this policy first.

How we use it

• Your account info lets you sign in across devices.
• Your likes drive the personalization algorithm (categories you like appear more often).
• Mood check-ins tailor which quotes appear next and let you see your own mood history; this stays on your device. The same page has a link to findahelpline.com, an independent website that lists free helplines by country. Tapping it opens your browser; we do not record that you tapped it.
• Notifications are local-only and off until you switch them on. The daily reminder has its own switch. A second switch covers three more notes: one on an evening when you have not read yet, one after three days away, and one when a badge is close. All of them are scheduled entirely on your device. We use no push servers and collect no push tokens — these notifications never leave your phone.
• Sharing: when you share a quote, the image (with a QR code and link to that quote) is created on your device and handed to your system share sheet. We don't receive or store what you share or who you share it with.
• We do not sell or rent your data. We share specific data with the third parties listed below only as necessary to provide the service (for example, your email address with Supabase for authentication, or your password's first 5 hash characters with HaveIBeenPwned to check for breach exposure). We never share your personal data for marketing or advertising.
• We do not run advertising. We use one privacy-respecting analytics service (Aptabase) to understand how the app is used; it records only anonymous, aggregated usage events (such as "opened the app" or "completed onboarding") tied to a random session identifier that is not stored and is replaced after an hour without use — never your name, email, or the quotes you read — and never tracks you across other apps.

Legal bases

If you are in the EU/EEA or the UK, we use your data on these legal bases:

• To provide the app (contract): your account, sign-in, the sign-up and reset codes, account deletion, and Sharper+ if you subscribe.
• Legitimate interests: anonymous usage and error statistics to improve the app, security logs, and the password breach check that protects your account. You can object to these by emailing us.

Cookies and tracking technologies

Sharper Daily is a native mobile app. It sets no cookies of its own and uses no browser local storage, web beacons, device fingerprinting, or any other web-based tracking technologies. The only cookies it can receive are short-lived security cookies (about 30 minutes) that Cloudflare, the network in front of our sign-in provider Supabase and of the HaveIBeenPwned breach check, sets to filter out bots; they are not used to track you. We do not track you across other apps, websites, or services, and we use no advertising or attribution SDKs. We use one privacy-respecting analytics service (Aptabase), which records only anonymous, aggregated usage events tied to a random session identifier that is not stored and is replaced after an hour without use — no personal data, no cookies, and no cross-app tracking.

Third parties

• Supabase (supabase.com): handles sign-up, sign-in, password reset, account deletion, and stores your email + hashed password. Privacy policy
• Resend (resend.com): delivers our transactional emails — verification codes for sign-up and password reset. Receives your email address only when we send these emails. We do not use Resend for marketing or newsletters. Privacy
• Cloudflare (cloudflare.com): hosts this website and the DNS for our email domain (sharperdaily.app). When the app starts, and now and then when you come back to it, it also reads one small file from this website to learn whether your version of the app is still supported; that request carries no account or device identifier. Receives standard web-server and DNS lookup metadata only. Privacy
• Google Cloud Text-to-Speech: when you tap the speaker icon to hear a quote read aloud, the quote text is sent to Google's TTS service to generate audio (audio is then cached so the same quote is not re-synthesized). The text sent is only the quote itself (a short excerpt credited to its author), never anything about you — no personal information is sent. Privacy
• HaveIBeenPwned (haveibeenpwned.com): when you create or change a password, your password is SHA-1 hashed locally on your device and only the first 5 characters of the hash are sent to check whether the password has appeared in known data breaches. Your full password and full hash never leave the device. Privacy
• Google: only contacted if you tap "Continue with Google" during sign-in. Google's privacy policy
• Apple: only contacted if you tap "Continue with Apple" during sign-in. Apple's privacy policy
• Google Play Billing and RevenueCat (revenuecat.com): when subscriptions are available, the app checks with RevenueCat each time it starts, and when you sign in or out, whether you have Sharper+. RevenueCat receives your account's random identifier (not your name or email; a random guest identifier if you use the app without an account) and basic device information such as platform and app version. If you subscribe, the purchase itself is handled by Google Play (or the App Store), which processes your payment details (we never see your card); RevenueCat also receives the purchase receipt so it can restore Sharper+ on a new phone and give us subscription statistics. Privacy
• Aptabase (aptabase.com): anonymous usage statistics as described above, hosted in the EU. Privacy

Your rights

• You can log out at any time from Settings → Account → Log Out.
• You can reset your likes from Settings → Wander → Reset Likes.
• You can delete individual saved quotes from Your Book.
• To permanently delete your account and all associated data, go to Settings → Delete Account at the bottom of the Settings page. Your account record is removed immediately; what is removed and what is kept (backups, security logs, store purchase records) is listed at sharperdaily.app/delete-account.
• Under GDPR (EU/EEA), the UK GDPR, CCPA (California), and similar laws, you have rights of access, rectification, erasure, restriction, objection, and portability. You can export your data from Settings → Download my data, and bring such a report back with Settings → Import my data (the text you paste is read on your device only). For requests we can't fulfill through in-app controls, email sharperdailyapp@gmail.com.
• If you are in the EU/EEA and believe we have not handled your data properly, you have the right to lodge a complaint with your national data protection authority. The full list is at edpb.europa.eu. In the UK, you can complain to the Information Commissioner's Office (ico.org.uk).

For California residents

The California Consumer Privacy Act (CCPA) gives California residents specific rights regarding their personal information:

• Right to know: the categories of personal information we collect are described in the "What we collect" section above.
• Right to delete: you can delete your account and associated data in-app at Settings → Delete Account, or email sharperdailyapp@gmail.com.
• Right to opt out of the sale or sharing of personal information: we do not sell personal information as that term is defined under the CCPA, and we have not done so in the past 12 months. We also do not share personal information for cross-context behavioral advertising. There is therefore nothing to opt out of.
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA rights.

International data transfers

Some of the third parties we use may process your data outside your country of residence:

• Supabase stores your account data in Frankfurt, Germany (within the EEA); its server functions may run in other regions.
• Resend's email-sending infrastructure for our domain is hosted in Ireland (within the EEA).
• Cloudflare, Google (sign-in and Text-to-Speech), Apple, RevenueCat and HaveIBeenPwned may process requests in regions outside the EEA.

Where data leaves the EEA or the UK, transfers are protected by the Standard Contractual Clauses (SCCs) approved by the European Commission (with the UK Addendum for UK data), or equivalent safeguards as required by GDPR Article 46 and the UK GDPR.

Data security

We take reasonable technical measures to protect your data:

• All communication between the app and our servers uses HTTPS encryption.
• Passwords are hashed using bcrypt (an industry-standard, computationally expensive algorithm) by Supabase. Your plain-text password is never stored or seen by us.
• When you create or change a password, it's checked against the HaveIBeenPwned breach database using k-anonymity: only the first 5 characters of your password's SHA-1 hash leave your device. The full password and full hash never leave your device.
• Your sign-in session is stored encrypted on your device, with the encryption key held in the device's secure hardware keystore.
• Each user's local data is scoped to their account so multiple users on the same device cannot see each other's saved quotes, likes, or preferences.
• You can permanently delete your account and associated data at any time from Settings → Delete Account.

No system is perfectly secure. If we ever discover a data breach that affects your personal information, we will notify you and the relevant regulators within the timeframes required by applicable law (within 72 hours under GDPR).

Data retention

• While your account is active, we retain your data for as long as needed to provide the service.
• If you delete your account (Settings → Delete Account), your account record is removed immediately; what is removed and what is kept (backups, security logs, store purchase records) is listed at sharperdaily.app/delete-account.
• If Android backup is on, your phone's own backup in your Google account may hold a copy of the app's on-device data (saved quotes, notes, settings) until Android next backs up the app; you can delete that backup in your Google account's backup settings.
• We reserve the right to delete accounts that have been inactive (no sign-in) for an extended period (typically 3 years), together with associated data. Where practical, we will email you at the account address at least 30 days before deletion.

Children

Sharper Daily is intended for users 13 years and older. We do not knowingly collect personal data from children under 13.

If you are under the minimum age for digital consent in your country (13 to 16 in the European Union / European Economic Area, depending on the country), a parent or legal guardian must agree to your use of the app. Our Terms of Service state the same rule.

If you believe a child below the applicable minimum age has provided us with personal data, please contact us at sharperdailyapp@gmail.com and we will delete the account and associated data promptly.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our service, or applicable law.

• For material changes (new categories of data collected, new third parties, or changes affecting your rights), we will make reasonable efforts to let you know.
• Minor edits (typo fixes or clarifications that do not change meaning) may be made without notice.
• In all cases we update the "Last updated" date at the top. We encourage you to review this policy periodically.

Contact

Questions or requests: sharperdailyapp@gmail.com

Nobody from Sharper Daily will ever ask you for your password or for a sign-in code.