Privacy Policy

Information we collect

• Account information. When you sign in with Apple or Google, we receive the name, email address and profile photo the provider shares with us, plus a unique account identifier. If you use Apple's Hide My Email, we only see the relay address. We never see or store your password.
• Content you create. Whatever you enter into an App (for example journal entries, financial records, habits, photos, notes) is stored so the App can work and sync between your devices. It is yours, and we do not read it except to operate the App or when you ask us for help.
• Purchase information. When you subscribe, Apple or Google process the payment. We receive, through RevenueCat, an anonymous app user identifier, the product bought, prices, dates, renewal status and a store receipt token. We never see or store card or bank details.
• Usage data. Product analytics (PostHog): screens viewed, features used, events like "goal created", the App and its version, device model, operating system version, language, time zone, coarse region derived from your IP address, and a random installation identifier. Events are tagged with the App name so we can see which App they came from.
• Diagnostics. Crash and error reports (Sentry): stack traces, the state of the App at the time of the error, device and OS details. These never include the content you entered unless it appears in an error message by accident, in which case we scrub it.
• Push tokens. If you enable notifications, we store the device push token (via Expo) so we can deliver them. Disable notifications in your device settings at any time.
• Device permissions. Some Apps ask for access to the camera, photo library, calendar, location, motion or health data (Apple Health, Health Connect) to power a specific feature. That data is used only for that feature, stays on your device unless the feature requires syncing, and is never used for advertising or sold.
• Communications. Emails you send us, support requests, and the email address you leave on a waitlist on frafael.co.
• Website data. frafael.co uses a cookie to remember your language and privacy-friendly, cookieless analytics (Vercel Analytics) that count page views without identifying you. No advertising cookies, no cross-site tracking.

How we use your information

We use personal data to:

• Provide the Apps: create and secure your account, store and sync your content, unlock what you have paid for, deliver notifications you enabled.
• Improve the Apps: understand which features are used, find and fix crashes, test changes.
• Communicate with you: transactional messages about your account or purchase, replies to your requests, and, only if you opted in, occasional product updates you can unsubscribe from in one tap.
• Keep the Services safe: prevent abuse, fraud and unauthorised access, and enforce our Terms.
• Meet legal obligations: tax and accounting records, responding to lawful requests.
• We do not sell personal data, we do not run advertising or share data with ad networks, and we do not use your content to train AI models.

Legal bases (LGPD and GDPR)

Where the Brazilian LGPD or the European and UK GDPR apply, we rely on: performance of a contract (providing the App you use and the subscription you bought); our legitimate interests (product analytics, crash reporting, security, and defending our rights), balanced against your interests; your consent (optional notifications, marketing emails, access to device permissions such as health data, which you can withdraw at any time); and compliance with legal obligations (tax, accounting, store requirements).

Who we share it with

Only with the service providers that make an App work, each processing data on our instructions under a data processing agreement, and never for their own marketing:

• Supabase: database, authentication and file storage.
• Apple and Google: sign-in, app distribution, payments and subscriptions, under their own privacy policies.
• RevenueCat: subscription entitlements and receipts.
• PostHog: product analytics.
• Sentry: crash and error reporting.
• Expo (EAS): app builds, over-the-air updates and push notification delivery.
• Resend: transactional and, if you opted in, product update emails.
• Vercel: hosting for frafael.co and admin tooling, and cookieless website analytics.
• We may also disclose data if required by law, a court order or a public authority, to protect the rights and safety of users or the public, or in connection with a merger, acquisition or sale of an App, in which case this policy continues to apply until you are told otherwise.

International transfers

We are based in Brazil and our providers process data mainly in the United States and the European Union. When personal data leaves Brazil, the EU or the UK, we rely on safeguards recognised by the LGPD (Article 33) and the GDPR, such as standard contractual clauses in our providers' data processing agreements, and on providers with recognised security certifications.

Retention

We keep personal data only as long as needed for the purposes above:

• Account and content: while your account is active. When you delete your account, your data is deleted within 30 days, and removed from encrypted backups within a further 30 days.
• Purchase records: as long as required by tax and accounting law, then deleted.
• Analytics: raw events are kept for up to 12 months, then aggregated or deleted. Crash reports are kept for 90 days.
• Waitlist and marketing emails: until you unsubscribe or ask us to delete them.
• Support emails: up to 2 years after the conversation ends.

Your rights

Wherever you live, you can access, correct, export or delete your personal data, object to or restrict certain processing, and withdraw consent at any time. Under the LGPD you may also request confirmation of processing, anonymisation of unnecessary data, information about the third parties we share with, and details about the consequences of denying consent. Under the GDPR and UK GDPR you also have the right to data portability and to lodge a complaint with your supervisory authority; in Brazil, with the ANPD. California residents have the right to know, delete and correct, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising rights. Global Privacy Control signals are honoured where they apply.

• Delete your account and all associated data from inside the App: Settings, then Delete account. It cannot be undone: your content leaves the live systems straight away, and the backups within the periods above.
• For anything else, email hello@frafael.co. We may ask you to verify your identity. We respond within 15 days for LGPD requests and within 30 days otherwise, and we never charge for a reasonable request.

Security

Data travels encrypted (TLS) and is stored encrypted at rest by our providers. Each App's data lives in its own schema with row-level security, so one App cannot read another's data and no user can read another user's data. Access to production systems is limited to the developer and protected by multi-factor authentication. No system is perfectly secure; if we learn of a breach that affects you, we will notify you and the relevant authority as the law requires. Report security concerns to hello@frafael.co.

Children

The Apps are not directed at children under 13 (or under 16 where local law sets that age) and are not listed in the Kids category. We do not knowingly collect personal data from children. If you believe a child has provided us data, email us and we will delete it.

Health and other sensitive data

An App that reads data from Apple Health or Health Connect, or that lets you log mood, sleep, symptoms or similar, handles sensitive personal data. We process it only with your explicit consent, only to provide the feature you asked for, and we never use it for advertising, marketing, credit, insurance or employment purposes, never sell it, and never share it with third parties other than the processors listed above that store it on our behalf. You can revoke access in your device settings at any time, and deleting your account deletes this data with everything else.

Notifications and marketing

Push notifications are off until you turn them on in the App and your device, and can be turned off the same way. Transactional emails (for example a receipt confirmation or an account security notice) are part of the service. Product update emails are sent only to people who opted in, come from updates.frafael.co, and every one has an unsubscribe link that works immediately.

Cookies and the website

frafael.co stores one functional cookie that remembers your language. Site traffic is measured with Vercel Analytics, which does not use cookies and does not identify visitors. We do not use advertising or social media tracking pixels. If a waitlist form is present, the email you enter is stored with Resend so we can email you when a new app launches and, now and then, share what we are building.

Changes to this policy

We update this policy when the Apps or the law change. The date at the top always shows the latest version. For material changes, we notify you inside the affected App or by email where we have your address before they take effect.

Contact and data protection officer

Filipi Rafael is the controller and the person in charge of data protection (encarregado, LGPD Article 41). São Paulo, Brazil. hello@frafael.co. We answer in Portuguese, English or Spanish.