Privacy Policy — 23 Challenge

1. Introduction

Welcome to 23 Challenge ("we", "our", or "us"). We are committed to protecting your personal privacy and providing a safe, transparent habit tracking experience. This Privacy Policy explains how we collect, store, use, share, and protect your information when you use our mobile application (available on Android and iOS), our web application, and associated services (collectively, the "Service").

By installing, registering with, or using the 23 Challenge application, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with any part of this policy, please do not use our Service.

2. Information We Collect

We only collect data necessary to provide you with seamless habit tracking, streak accountability, reminders, and customized challenge milestones.

A. Account and Profile Data

Email Address: Required to create and authenticate your account, secure your profile, send verification links, and facilitate password resets.
Authentication Credentials: Securely salted and hashed via our database provider (Supabase Auth). We never have access to plain-text passwords.
Display Name and Bio: Optional user-provided profile information.
Profile Avatar: Optional profile picture uploaded by you.

B. Habit, Challenge & Streak Data

Enrollment Records: The programs and challenges you choose to join (e.g. 23-day curriculum, push-up challenges, sobriety milestones).
Check-In Logs: Daily completion records, completion timestamps, numeric metrics (e.g. reps, minutes, steps), and streak calculation history.
Hearts and Lives: In-app resilience score keeping and missed-checkin tracking.

C. Habit Verification Proof (User-Submitted)

Proof Photos (Optional): If a challenge or organization requires verification proof, you may take or select a photo. We request access to your Camera or Photo Library solely for this purpose. You can deny or revoke this permission at any time.
Text Reflections: Optional written reflections or notes submitted during check-ins.
Focus Timer Duration: Local elapsed focus minutes recorded during timed habit sessions.

D. Device and Technical Data

Local Timezone: Used strictly to calculate local calendar day transitions and trigger notifications at the exact hour you configure.
Push Notification Tokens: Used to deliver daily check-in reminders and challenge notifications. You can disable notifications at any time in the app Profile or system settings.
Operating System & App Version: Standard diagnostic data for troubleshooting and stability.

3. Data Collection Summary Table

Data Category	Specific Items	Primary Purpose	Retention
Account Info	Email, display name, bio	User authentication and profile	Until account deletion
Habit Records	Check-ins, streaks, completions	Core challenge progression	Until account deletion
Verification Media	Optional photos, text notes	Habit verification proof	Until account deletion
Device & Timezone	Timezone, push tokens	Accurate local scheduling	Until account deletion

4. How We Use Your Information

We process your personal information for the following legitimate purposes:

App Functionality: Maintaining your challenge streaks, habits, cycle calculations, and curriculum day unlocks.
Personalized Reminders: Delivering local push notifications based on your chosen reminder time.
Social & Team Accountability: If you join an organization or coach team via an invite code, your challenge progress (e.g. check-in status, team leaderboard position) is visible to members within that specific organization.
Subscription & Account Management: Granting Pro or Coach access and verifying entitlement status.
Security & Abuse Prevention: Enforcing Row Level Security, preventing brute-force login attempts, and safeguarding database integrity.

5. Third-Party Service Providers

We do not sell your personal data. We disclose information only to service providers essential to app operations, under strict confidentiality and security agreements:

Supabase Inc. — Cloud database, user authentication, and secure data storage. Data is hosted in secure data centers in the European Union (eu-west-1) with end-to-end encryption in transit.
RevenueCat Inc. — In-app purchase and subscription receipt validation. RevenueCat processes anonymous app user identifiers to verify Pro entitlements with Google Play Billing and Apple App Store. We do not store credit card details.
Expo & Google Play Services / Firebase — Push notification dispatch and mobile runtime tooling.

6. Data Security Practices

We implement rigorous technical and organizational security measures to protect your information:

Encryption in Transit: All communications between the mobile app, web application, and backend servers use TLS/HTTPS encryption.
Row Level Security (RLS): Database-level policies enforce that only the authenticated account owner can view or modify their private habit logs, profiles, and proof submissions.
No Plaintext Passwords: Passwords are protected using secure cryptographic hashing algorithms.

7. Cookies and Local Storage (Web Application)

When you access our web application (23challenge.com) or web portal, we use browser cookies and local storage (localStorage / sessionStorage) exclusively to provide core functionality, maintain secure authentication, and remember your interface settings.

A. Storage Technologies We Use

Identifier / Key	Provider	Purpose & Category	Legal Basis & Expiry
`sb-*-auth-token`	Supabase Auth	Strictly Necessary: Stores cryptographically signed JWT session tokens for user authentication and CSRF prevention.	Art. 6(1)(b) GDPR · Session duration / Up to 1 year
`i18nextLng`	23 Challenge	Functional: Remembers your chosen UI language preference across page refreshes.	Art. 6(1)(f) GDPR · Persistent (until browser storage cleared)
`theme_preference`	23 Challenge	Functional: Preserves your light / dark appearance mode preference.	Art. 6(1)(f) GDPR · Persistent (until browser storage cleared)
`cookie_consent_status`	23 Challenge	Strictly Necessary: Remembers that you acknowledged the cookie and storage notice.	Art. 6(1)(c) GDPR · Persistent (until browser storage cleared)
Local Habit Caches	23 Challenge	Strictly Necessary: Caches active challenge day states and offline draft check-ins.	Art. 6(1)(b) GDPR · Cleared on sign-out / reset

B. Compliance with EU ePrivacy Directive & GDPR

Under Article 5(3) of the European Union ePrivacy Directive (Directive 2002/58/EC as amended by 2009/136/EC) and GDPR guidelines, technologies that are strictly necessary to provide an information society service explicitly requested by the user do not require prior opt-in consent.

          No Advertising or Cross-Site Tracking: We do not deploy third-party advertising cookies, marketing pixels
          (such as Meta Pixel or Google Ads tags), or cross-site tracking fingerprints. Your habit and streak activity is never monetized or shared with ad brokers.
        

C. Managing and Disabling Cookies

You can restrict or block browser cookies and clear local storage at any time via your browser settings:

Google Chrome: Settings → Privacy and security → Third-party cookies / Site data
Apple Safari: Settings → Safari → Advanced → Privacy / Website Data
Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data

Note: Disabling essential local storage or authentication cookies will prevent you from signing in and tracking habits on the web version.

8. Data Retention and Account Deletion

We retain your personal information for as long as your account exists. You have the absolute right to delete your account and all associated data at any time:

How to Delete Your Account and Data:

Directly in the App: Go to the Profile tab → scroll to the bottom → tap Delete Account → confirm. Your account and all associated habit records, check-ins, proof submissions, and profile data will be permanently wiped immediately.
Online Web Deletion Portal: If you uninstalled the app or do not have your mobile device, visit our public data deletion portal at https://23challenge.com/delete-account. Requests submitted through the portal are processed within 30 days in compliance with Google Play Data Safety policies.

9. Your Rights (GDPR & CCPA Compliance)

Depending on your jurisdiction, you hold specific legal rights concerning your personal data:

Right of Access: You may request a copy of the personal information we hold about you.
Right to Rectification: You can edit and update your profile information directly inside the app.
Right to Erasure ("Right to be Forgotten"): You can permanently wipe your account and data at any time.
Right to Restrict or Object to Processing: You can withdraw consent for camera, photo, health data, or notification permissions through your operating system settings.

To exercise any of these rights, contact us at privacy@23challenge.com.

10. Children's Privacy

23 Challenge is not directed to individuals under the age of 13 (or under 16 in certain jurisdictions within the European Union). We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal information without parental consent, please contact us immediately at privacy@23challenge.com, and we will promptly delete the data.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. When changes are made, we will revise the "Last Updated" date at the top of this document. In the event of material modifications, we will provide noticeable in-app alerts or email notifications where appropriate.

12. Contact Us

If you have any questions, suggestions, or concerns regarding this Privacy Policy or our data handling practices, please contact us: