Privacy Policy
Effective date: 17 October 2026
This policy explains what data the Spada: Habit Tracker app ("Spada", "we") collects, why, where it is stored and the choices you have. We keep it short and plain. We do not sell your data, we do not show ads, and we do not track you across other apps or websites.
Who is responsible
The data controller is the developer of Spada Angga, East Jakarta City, DKI Jakarta Province, Indonesia 13330. Contact: anggafauzan94@gmail.com.
What we collect and why
| Data | Examples | Why |
|---|---|---|
| Account data | The email address and basic profile details shared by Google or Apple when you sign in (such as your name and, for Google, a profile picture link; with Apple you can hide your email), plus an internal user ID. | To create your account, sign you in and keep your data tied to you. |
| Profile you enter | Display name, emoji avatar, country, birth date, gender. These fields can be left empty. | To personalize the app. We do not use them for advertising. |
| Content you create | Habits, check-ins and streaks, quests, mood entries, journal entries, notes, to-dos, events you add in the app, timers and timer sessions, brain game progress, diamonds and Buddy collection, app settings. | To provide the app's features and sync them across your devices. |
| Crash and error reports | Error messages, stack traces, app version, device model and operating system version. | To find and fix crashes. Reports are sent without your account ID, and request bodies and extra data are removed before sending. |
Mood and journal entries can reveal personal feelings. They are only used to show them back to you and are never analyzed for advertising or shared with anyone else.
Data that stays on your device
- Device calendar. If you connect a calendar, Spada reads its events on your phone to show them in Notes. It does not change your calendar and does not upload those events. Only the ID of the calendar you picked is saved, on your device.
- Photos. Spada only asks for permission to save share cards you create to your photo library. It does not read your photos.
- Notifications. Reminders are scheduled locally on your device. We do not use push notification tokens.
Where your data is stored and who processes it
Your data is first saved on your device. When you are signed in, a copy of your app data is synced to your account so you can restore it. We use these service providers (processors):
- Supabase — account sign-in and cloud storage of your app data. Region: a Supabase data centre (AWS). Access is restricted so only your account can read or change your data.
- Google — "Sign in with Google". Google handles your Google password; we never see it. Google's privacy policy applies to your Google account.
- Apple — "Sign in with Apple". Apple handles your Apple Account password; we never see it. When you delete your account, we ask Apple to revoke Spada's sign-in access.
- Sentry (Functional Software, Inc.) — crash and error reporting. Region: a Sentry data centre.
Spada v1.0 has no in-app purchases and no payment provider is active. If we add paid features later, we will update this policy first.
Data sent between the app and these services is encrypted in transit (HTTPS). Some providers are located in or may transfer data to the United States. Where that happens, transfers rely on the provider's Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
Legal bases (EU/EEA and UK users)
- Contract (Art. 6(1)(b) GDPR): account, profile, content and sync, to provide the service you asked for.
- Explicit consent (Art. 9(2)(a) GDPR) for mood and journal entries that may reveal health-related information. You give it by choosing to enter them, and you can withdraw it by deleting those entries or your account.
- Legitimate interest (Art. 6(1)(f) GDPR): crash reports, to keep the app stable and secure.
How long we keep data
- Account and synced app data: until you delete your account. Data on your device stays until you delete the account, uninstall the app, or clear its storage; signing out alone does not erase it.
- Crash reports: kept by Sentry for up to 90 days, then deleted automatically.
- Provider backups: deleted data may remain in Supabase's encrypted backups for a short period (up to 30 days) before it is overwritten.
Deleting your account
Open Settings → Delete account in the app. This permanently deletes your account and your synced data from our servers and clears the data on that device. If you used Sign in with Apple, Apple asks you to confirm so we can revoke the Apple sign-in. You can also ask us by email. See how to delete your account.
Your rights
Depending on where you live (including under the GDPR in the EU/EEA and UK), you have the right to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent at any time. Here is how to use them:
- Access and correct: you can see and edit your profile and everything you created directly in the app.
- Delete: delete single entries in the app, or your whole account in Settings → Delete account.
- Get a copy (access or export): the app has no export button yet. Email anggafauzan94@gmail.com from the address you sign in with, and we send you a machine-readable copy of your data (JSON).
- Anything else (restriction, objection, questions): email anggafauzan94@gmail.com.
We reply to every request within 30 days. You also have the right to complain to your local data protection authority (for example the CNIL in France, your state authority or the BfDI in Germany, or the AEPD in Spain).
Children
Spada is not directed at children. You must be at least 13 years old to use it, or the minimum age required in your country to consent to data processing (for example 16 in Germany, 15 in France, 14 in Spain), unless a parent or guardian consents for you. If you believe a child has given us data, contact us and we will delete it.
Changes
If we change this policy, we will update the effective date above and, for important changes, tell you in the app.