Privacy Policy (Draft)

Draft for internal review, not legal advice. Have counsel review before publishing.

Last updated: [date]

Overview

Rhythm Recovery ("we," "us") helps you track daily activities over a 90-day period. This policy explains what information we collect, how we use it, and the choices you have. We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

Information We Collect

Account information

• Email address (for sign-in and account recovery)
• Google account identifier, if you sign up with Google
• Password (stored as a salted hash, we never store or can see your plaintext password)

Profile information

• Auto-generated anonymous username (editable by you at any time)
• Your daily activity list and completion history
• Streak history and earned badges

Communication preferences

• Reminder settings (toast/email, timing)
• Subscriber list status (opted in or out of product-update emails)

Usage analytics

Aggregate, non-identifying usage data (e.g. feature usage, page views, session length) used solely to improve the product. We do not use analytics to build advertising profiles.

Sharing data

If you choose to share your dashboard via text or email, we send the snapshot you select (streak, completion %, badges) to the recipient(s) you specify. We do not store recipient contact information beyond what's needed to send that one message.

What We Don't Do

• We do not sell, rent, or trade your personal information.
• We do not share your data with third parties for their own marketing.
• We do not retain data longer than needed to operate the product or as required by law.
• We do not use your activity content (what you're tracking) for anything other than displaying it back to you.

How We Use Information

• To operate your account and the core tracking features
• To send reminders and notifications you've opted into
• To send product-update emails, only if you've opted in (unsubscribe available in every email and in account settings)
• To improve the product via aggregate, non-identifying analytics
• To respond to support requests

Data Retention & Deletion

• Your data is retained only as long as your account is active.
• You can delete your account at any time; this permanently removes your profile, activity history, and preferences within [30] days.
• Backups are purged on a rolling basis and do not persist deleted data indefinitely.

Third-Party Services

We use third-party infrastructure providers to operate the product (e.g. hosting, email delivery, SMS delivery, authentication). These providers process data only on our behalf, under contractual terms that prohibit them from using it for their own purposes.

[List specific providers here once selected, e.g. hosting, email/SMS delivery, database, analytics.]

Your Choices

• Edit or delete your account and data at any time from settings
• Change your anonymous username at any time
• Opt in/out of subscriber emails independently from transactional/reminder emails
• Control reminder channel and timing

Children's Privacy

This service is not directed to children under 13, and we do not knowingly collect information from them.

Changes to This Policy

We'll notify users of material changes via email and update the "Last updated" date above.

Contact

[Support email / contact method]