Privacy Policy

ByteFrost AB ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App"). Please read this Privacy Policy carefully.

ByteFrost AB is the data controller responsible for your personal data. If you have any questions about this Privacy Policy, please contact us using the details in Section 14.

1. Information We Collect

1.1 Anonymous Usage

You can use the App without creating an account. When you do, the App automatically creates an anonymous account for you:

• You are identified only by a randomly generated account ID. We do not ask for your name or email address
• Your habits, goals, progress, to-dos, and profile (the display name and avatar you choose, if any) are stored on your device and synced to our servers so they are backed up and so friend features work
• If you connect with friends in the App, your friend connections are stored on our servers
• We record how far you get through the App's introduction, to help us improve it
• Advertising measurement data is collected as described in Section 1.5

1.2 Information You Provide When You Sign In

If you choose to create an account, we collect:

• Email Address: Used for account authentication and account recovery
• Habit and Goal Data: Information about your habits, goals, progress, and tracking activities that you create within the App

1.3 Health Data (Optional)

If you choose to enable health data synchronization, we may collect:

• Steps count
• Calories burned
• Other health metrics you choose to sync

Important: Health data synchronization is entirely optional and requires your explicit consent. You can enable or disable this feature at any time in the App settings. Health data is accessed through Apple Health (iOS) or Google Health Connect (Android) and is subject to their respective privacy policies.

1.4 Payment Information

When you purchase a subscription:

• Payment processing is handled entirely by Apple App Store or Google Play Store
• We do not collect, store, or have access to your payment card information
• We receive only basic transaction information (such as whether a purchase was successful) from RevenueCat, our subscription management service

1.5 Advertising Measurement (Attribution)

We use AppsFlyer to measure which of our ads lead people to install the App, start a free trial or subscribe. This helps us stop spending money on ads that don't work. For this purpose, the following information is collected:

• Device information: Device model, operating system version, app version, language and country setting, and IP address
• Device identifiers: An app-specific device identifier and, only if you allow tracking, your device's advertising identifier (IDFA on iOS)
• App events: When the App is installed and opened, and when you start a free trial, subscribe, renew or cancel (including the product and price, received via RevenueCat)

On iOS, the App asks for your permission through Apple's App Tracking Transparency prompt. If you do not allow tracking, we do not access your advertising identifier and your purchase events are not sent to AppsFlyer through RevenueCat. Anonymous, aggregated measurement through Apple's SKAdNetwork, which does not identify you, still takes place.

On Android, your device's advertising ID is used unless you have deleted it in your device settings.

If you are in the EEA, UK or Switzerland, AppsFlyer is told whether you have consented (on iOS, by allowing tracking). Without your consent, AppsFlyer is instructed not to use your data for ad personalization or share it for advertising, and your purchase events are not sent to AppsFlyer through RevenueCat.

1.6 Information We Do NOT Collect

We do not collect:

• Your name or physical address
• Phone number
• Precise location data
• Browsing history or cookies

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain the App: Store your habits, goals, and progress across your devices
• Authenticate your account: Verify your identity when you sign in
• Sync your data: Enable access to your data across multiple devices
• Process payments: Manage your subscription through our payment processor
• Improve the App: Understand how the App is used to fix bugs and improve features
• Measure our advertising: Understand which ads lead to installs, trials and subscriptions (see Section 1.5)
• Communicate with you: Respond to your inquiries and provide customer support
• Comply with legal obligations: Meet legal and regulatory requirements

3. How We Store Your Information

3.1 Data Storage

Your data is stored securely using:

• Supabase: Our database and authentication provider. Supabase provides enterprise-grade security and is compliant with industry standards including SOC 2 Type II and GDPR
• Encryption in transit: All data transmitted between your device and our servers is encrypted using industry-standard TLS protocols

3.2 Data Security

We implement appropriate technical and organizational security measures to protect your information, including:

• Secure data transmission using encryption
• Regular security updates and monitoring
• Access controls and authentication requirements
• Secure server infrastructure

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

4. Third-Party Services

We use the following third-party services to operate the App:

4.1 Supabase

• Purpose: Database hosting and user authentication
• Data shared: Account ID, email address (if you sign in), habit and goal data, to-dos, profile name and avatar, friend connections, and introduction progress
• Privacy Policy: https://supabase.com/privacy

4.2 RevenueCat

• Purpose: Subscription management and payment processing
• Data shared: User identifier, subscription status, purchase history
• Privacy Policy: https://www.revenuecat.com/privacy

4.3 Apple App Store / Google Play Store

• Purpose: App distribution and payment processing
• Data shared: Purchase information (handled directly by Apple/Google, not by us)
• Privacy Policies:
  • Apple: https://www.apple.com/legal/privacy/
  • Google: https://policies.google.com/privacy

4.4 AppsFlyer

• Purpose: Advertising measurement (attribution), as described in Section 1.5
• Data shared: Device information, device identifiers (the advertising identifier only if you allow tracking), IP address, and app install, trial and subscription events
• Further sharing: AppsFlyer shares attribution results with the advertising platforms we run ads on (such as Meta, Google, TikTok, Snap and Apple), so they can report and optimize our ad campaigns
• Privacy Policy: https://www.appsflyer.com/legal/privacy-policy/

4.5 Apple Health / Google Health Connect (Optional)

• Purpose: Synchronize health and fitness data (only if you opt in)
• Data shared: Steps, calories burned, and other metrics you choose to sync
• Privacy Policies:
  • Apple Health: https://www.apple.com/legal/privacy/data/en/health-app/
  • Google Health Connect: https://support.google.com/googleplay/answer/9888358

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties.

We may share your information only in the following circumstances:

• Service Providers: With third-party service providers (Supabase, RevenueCat, AppsFlyer) who help us operate the App, as described in Section 4
• Advertising Platforms: Attribution results (for example, that an install or subscription came from a specific ad campaign) are shared with the advertising platforms we use, as described in Section 4.4
• Legal Requirements: If required by law, court order, or governmental regulation
• Protection of Rights: To protect our rights, property, or safety, or that of our users or the public
• Other Users of the App: Your display name and avatar can be seen by other users of the App, for example when they look you up to send a friend request. Friends you have accepted can also see your daily progress totals (such as trophies, streaks and marbles), but not your individual habits or goals
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity

6. Your Data Rights

6.1 Access and Export Your Data

You have the right to access and export all of your data stored in the App. If you are signed in, you can export your data at any time through the App settings. If you use the App anonymously, contact us at contact@byte-frost.com for a copy of your data.

6.2 Delete Your Account and Data

You have the right to delete your account and all associated data at any time. When you delete your account:

• All your personal information is permanently deleted from our servers
• Your habits, goals, and tracking data are permanently deleted
• This action cannot be undone
• If you are signed in, you can delete your account through the App settings. If you use the App anonymously, copy your User ID from the App settings and email it to contact@byte-frost.com, and we will delete your data within 30 days (see Account Deletion)

6.3 Modify Your Information

You can modify your habit and goal data at any time through the App.

6.4 Opt Out of Health Data Sync

You can enable or disable health data synchronization at any time through the App settings.

6.5 Opt Out of Tracking

You can allow or deny tracking when the App asks, and change your choice at any time in iOS Settings → Privacy & Security → Tracking. On Android, you can reset or delete your advertising ID in your device settings.

6.6 Additional Rights (EEA/UK Residents)

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se

To exercise these rights, please contact us at contact@byte-frost.com.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide you with the App.

• Anonymous users: We retain your data until you ask us to delete it by contacting contact@byte-frost.com
• Signed-in users: We retain your data until you delete your account
• After account deletion: All personal data stored on our servers is permanently deleted within 30 days
• Advertising measurement data: Data collected by AppsFlyer (see Section 1.5) is not linked to your App account and is not removed when you delete your account. AppsFlyer retains it according to its own retention policy. To request its deletion, contact us and we will forward your request to AppsFlyer
• Subscription records: RevenueCat, Apple and Google keep records of your purchases as required for accounting and legal purposes
• Legal obligations: We may retain certain information if required by law or for legitimate business purposes (such as fraud prevention)

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

Our service providers (Supabase, RevenueCat, AppsFlyer) may process data in various locations worldwide. When we transfer your data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

9. Children's Privacy

The App is intended for users aged 13 and older (or 16 and older in the European Economic Area). We do not knowingly collect personal information from children under these age limits.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at contact@byte-frost.com, and we will delete such information from our systems.

10. California Privacy Rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt-out of the sale of personal information (Note: We do not sell personal information)
• Right to non-discrimination for exercising your CCPA rights

To exercise these rights, please contact us at contact@byte-frost.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by:

• Posting the updated Privacy Policy in the App
• Updating the "Last Updated" date at the top of this Privacy Policy
• Sending you a notification through the App or via email (if applicable)

Please review the updated Privacy Policy when we notify you. Where a change requires your consent, we will ask for it in the App.

12. Tracking and Do Not Track Signals

If you allow tracking through Apple's App Tracking Transparency prompt, your advertising identifier is used to link your install and subscription to the ad that brought you to the App, as described in Section 1.5. We do not track you across other companies' apps or websites for any other purpose, and we do not sell your data. The App does not respond to web browser "Do Not Track" signals; use the tracking settings described in Section 6.5 instead.

13. Your Consent

We ask for your consent in the App before we use your data for the following purposes:

• Health data synchronization: Only if you turn it on
• Tracking for advertising measurement: Only if you allow it in Apple's App Tracking Transparency prompt (see Section 1.5)

You can withdraw your consent at any time, as described in Sections 6.4 and 6.5. Withdrawing consent does not affect processing that took place before you withdrew it. For all other processing, the legal basis is described in Section 15.

15. Legal Basis for Processing (EEA/UK Residents)

If you are located in the EEA or UK, our legal basis for collecting and using your personal information depends on the specific information and context:

• Consent: When you provide explicit consent (e.g., health data synchronization, or allowing tracking for advertising measurement)
• Contract: When processing is necessary to provide the App services you've requested
• Legitimate Interests: When we have a legitimate business interest (e.g., improving the App, fraud prevention) that doesn't override your rights
• Legal Obligation: When we must comply with legal requirements

Summary: We collect minimal data (email and habit tracking data when you sign in, health data only if you opt in). We measure which ads bring people to the App, using your advertising identifier only if you allow tracking. We do not sell your data. You can export and delete your data at any time. We use industry-standard security measures to protect your information.