Privacy Policy

1. What we collect

• Account: your name, email, a scrambled (hashed) password, or the id Google or GitHub gives us if you sign in with them.
• Profile and settings: handle, avatar color, timezone, reminder times, privacy and email choices.
• What you track: goals, milestones, logs, timer sessions, journal notes, streaks, XP and badges.
• Social: friends and requests, challenges you join, cheers, people you block and reports you send.
• Pro: your plan, renewal dates and the customer and subscription ids Dodo Payments gives us. We never see or store your card details.
• Messages to us: if you use the contact form, your name, email, message and IP address, and our replies, so we can answer you and stop spam.
• Technical: IP address and browser type for your sign-in sessions, security checks and rate limits; the push address your browser creates if you turn on push reminders; whether our emails were delivered.

If you use “Find friends from Google or GitHub”, we read your contacts once, with your permission, to show who is already on Streaklo. We don't keep the list.

2. How we use it

• to run Streaklo: save your progress, work out streaks, show stats;
• to let friends see what you allow, and to run challenges;
• to send account emails, and reminders and recaps you can turn off;
• to take Pro payments and give you Pro;
• to keep accounts safe and stop spam, abuse and cheating: for example, we look for logging no person could do and for many new accounts from one network (using the IP address of your sign-in);
• to understand which features help, using counts tied to an account id, never your name or email.

If you are in the EU, UK or a similar place, our legal reasons are: running the service you signed up for (contract); keeping it secure and improving it (legitimate interests); things you switch on, like contacts and push reminders (consent); and keeping tax records (legal obligation).

3. What other people see

Nothing on Streaklo is public unless you turn on a public profile. Friends see what you allow in Settings, Privacy: your activity, streak, goals and leaderboard spot. Notes stay private to you.

With a public profile, anyone with the link can see your handle, avatar color, when you joined, your level, XP, badges, global leaderboard rank and (if friends can see it) your streak. Your name shows only if you choose. Goals, logs, notes, friends and email are never public. Public pages ask search engines not to list them. Turning it off takes you off the leaderboard right away.

If you make a template public, anyone can see its title, description, lessons or steps, your @handle and how many people used it. Never your progress or notes.

4. Who helps us

We use these services to run Streaklo. Each gets only what it needs and may only use it for us. We don't sell or rent your data to anyone.

Dodo Payments handles payment details under its own privacy policy. We may also share data if the law requires it, or with a buyer if Streaklo is ever sold, who would have to keep this policy's promises.

Some of these services are outside your country. Where the law asks for it, we rely on safeguards such as the European Commission's standard contractual clauses.

5. Cookies

We use a sign-in cookie to keep you signed in, and a short-lived cookie that remembers you agreed before reading contacts. Turnstile may set a cookie during sign-up to check you're a person. The practice timer keeps its state in your browser's storage. These are essential, so they are always on.

If you choose "Accept all" in the cookie banner, we also use Vercel Web Analytics to count page visits. It sets no cookies, does not follow you across sites, and sees only the page address (without anything after a ?), your browser, device type and country. A cookie remembers your choice for a year. No advertising or tracking cookies. Cookie settings

6. How long we keep it

• Everything stays while you have an account. When you delete it, we wait 14 days in case you change your mind, then erase it for good; see Delete your account.
• Copies in our database provider's backups expire on their own schedule, within 30 days.
• If an email to you bounced or was marked as spam, we keep that address on a do-not-send list so we never mail it again.
• Dodo Payments keeps invoices and payment records for as long as tax law requires.

7. Your choices and rights

• See and take your data: Settings, Connections, Download everything (JSON and CSV).
• Fix it: change your profile and settings any time.
• Delete it: Settings, General, Delete account.
• Fewer emails: Settings, Notifications, or the unsubscribe link in any email.
• Say no or take back consent: write to us; turning something off never affects what happened before.

Depending on where you live, you may also have the right to limit or object to how we use your data, and to complain to your data protection authority. We answer requests within 30 days.

8. Children

Streaklo is for people 13 and older. If you believe a younger child has an account, tell us and we'll delete it.

9. Security

Connections are encrypted, passwords are hashed, sign-ins are rate limited and every sensitive admin action is logged. No system is perfect; if something goes wrong that affects you, we'll tell you quickly.

10. Changes and contact

If we change this policy in a way that matters, we'll tell you by email or in the app first. For anything about your data, write to hello@streaklo.com.