Privacy Policy

1. Who we are & the rules we follow

Squova is an independent, individually operated project and is not yet incorporated as a company. The individual operator is the controller responsible for your personal data.

Because we operate a global service, this policy is written to align with major privacy frameworks, including the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA). Where the mandatory law of your country or state gives you stronger rights, those rights apply.

2. The data we collect

We try to collect as little personal data as possible. We do not use third-party analytics, advertising, or crash-tracking tools, and we do not track you across other apps or websites. The data we hold falls into these categories:

• Account data — if you register with email, your email address and an encrypted password; or, if you use “Sign in with Google”, the email address and basic profile information Google passes to us. We do not collect your phone number.
• Profile & social data — a pseudonym (not your real name), an automatically generated avatar (a style and a generation seed), your time zone, your chosen focus area and goal (including an optional custom goal you type), and your mentor status.
• Squad activity data — your daily objective descriptions, whether you completed them, your chat messages, your encouragement reactions, and your squad’s shared streak history.
• Technical data — limited information processed automatically when any website is used, such as your IP address, browser and device type, and timestamps, handled by our hosting and infrastructure providers mainly for delivery, security, and abuse prevention.
• Local preferences — small settings stored in your browser (see the Cookies & local storage section), such as your light/dark theme choice.

We do not collect precise geolocation, government identifiers, health or fitness data, payment-card details, or device push-notification tokens. Notifications are delivered inside the app only.

3. Why we use your data (and our legal bases)

We use personal data only for the purposes below. Where the GDPR applies, the legal basis for each use is noted in brackets.

• Your email — to create and secure your account, sign you in, and send essential account and password-recovery messages (performance of our contract with you).
• Pseudonym, avatar, focus area, and goal — to set up your profile and match you into a compatible squad (performance of our contract).
• Time zone — to match you with members on a similar daily rhythm and to schedule daily resets (performance of our contract).
• Daily objectives, completions, messages, reactions, and streaks — to provide the core squad-accountability features (performance of our contract).
• IP address and technical data — to host and deliver the Service, keep it secure, and prevent abuse (our legitimate interests).
• Local preferences — to remember your settings on your device (our legitimate interests, or your consent where required).
• Any future optional features or non-essential communications — on the basis of your consent, which you may withdraw at any time.

4. What your squad can see

Squova is a social, pseudonymous service. When you are in a squad, the other members of that squad can see your pseudonym, your generated avatar, your focus area and goal, your daily objective descriptions and whether you completed them, your chat messages, your reactions, and your contribution to the squad’s shared streak.

Your email address, password, and login identifiers are never shown to other users, and you appear to squadmates under your pseudonym rather than your real name. Even so, please treat anything you type into objectives or chat as visible to your squad, and avoid sharing sensitive personal information there.

5. Who we share data with

We do not sell your personal data, and we do not share it for advertising. We rely on a small number of third-party providers (“processors”) to run the Service, each processing data only to provide their service to us:

• Supabase — our core backend: it hosts the database, manages authentication (your email and password), powers real-time chat, and sends transactional account emails such as confirmation and password-reset messages.
• Vercel — hosts and serves the application and processes technical data such as IP addresses and request logs as part of delivering the site.
• Google — if you choose “Sign in with Google”, Google authenticates you and passes us your email and basic profile; your use of Google sign-in is also governed by Google’s own privacy policy.
• DiceBear — generates your avatar image from a non-identifying seed. Because avatars are loaded from DiceBear’s servers when displayed, your device’s IP address and the avatar seed are sent to DiceBear at that time.

If we later enable voluntary donations through a platform such as Buy Me a Coffee or Ko-fi, that platform — not Squova — will collect and process any payment information under its own privacy policy; we would receive only limited confirmation details and never your full payment-card data.

We may also disclose data if we are required to by law, to enforce our Terms, or to protect the rights, safety, and security of our users or the Service.

6. International data transfers

Our providers (such as Supabase, Vercel, Google, and DiceBear) operate infrastructure in countries that may differ from where you live and from where the Operator is based. Your personal data may therefore be transferred to, stored in, and processed in other countries — including the United States and countries in the European Union — whose data-protection laws may differ from your own.

Where such transfers require safeguards, we rely on the protections offered by these providers (for example, standard contractual clauses). [PLACEHOLDER — confirm the specific hosting region(s) configured in Supabase and Vercel and name them here before launch.]

7. How long we keep data & deletion

We keep your personal data for as long as your account is active. You can ask us to delete your account and personal data at any time by contacting us at support@squova.com.

Our database is configured so that, when an account is deleted, your profile and the data linked to it — including squad memberships, daily objectives, chat messages, reactions, and in-app notifications — are removed together with your account. Aggregate, squad-level streak history that is not tied to you personally and does not identify you may be retained so the rest of your squad’s record stays intact.

Self-service, in-app account deletion is not yet available; deletion is currently handled manually on request, and we aim to action verified requests within a reasonable time. Some limited data may be kept where we are legally required to retain it, or temporarily in routine backups that are overwritten on a rolling basis.

8. Your privacy rights

Depending on where you live, you may have some or all of these rights over your personal data: to access it; to correct it; to delete it; to object to or restrict certain processing; to withdraw consent; to receive a portable copy; and, under the CCPA, to know what we collect and to not be discriminated against for exercising your rights. As noted above, we do not sell personal data.

You can exercise some of these rights directly in the app (for example, editing your profile or leaving a squad). For anything else — including access, a portable copy, or deletion — contact us at support@squova.com and we will respond consistent with applicable law. If you are in the EU, UK, or a similar jurisdiction, you also have the right to lodge a complaint with your local data-protection authority.

9. Children’s privacy

The Service is intended for users aged 16 and over, consistent with our Terms & Conditions. We do not knowingly collect personal data from children under 16. Because we do not currently verify age at sign-up, we rely on your representation that you meet the minimum age. If you believe a child under 16 has provided us with personal data, please contact us and we will take reasonable steps to delete it.

10. How we protect your data

We take reasonable measures to protect your personal data. Connections to the Service are encrypted in transit using HTTPS/TLS. Authentication and passwords are handled by our backend provider (Supabase), and passwords are stored in hashed form rather than as plain text. Access to data in the database is restricted by row-level security rules, so in general you can only reach your own data and the limited squad data shared with you.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We have not undergone a formal third-party security certification at this stage.

11. Cookies & local storage

We use only a small number of strictly necessary cookies and browser-storage items. We do not use advertising or third-party tracking cookies, and we do not use tracking pixels.

• Authentication cookies — set by our backend to keep you securely signed in and to manage your session; without them, the Service cannot log you in.
• A short-lived invite cookie — used only to carry a pending squad-invite link through sign-up and onboarding.
• Local-storage preferences — such as your light/dark theme choice, whether the chat dock is open, dismissal of the app-install prompt, and a flag that stops a streak celebration from replaying. These stay on your device and are not used to track you.

12. Changes to this policy

We may update this Privacy Policy as the product evolves. When we do, we will revise the "Last updated" date above and, for material changes, give reasonable notice (for example, in the app or by email). Your continued use of the Service after a change takes effect means you accept the updated policy.

13. Contact us

For any privacy question, or to exercise your rights, contact us at support@squova.com. [PLACEHOLDER — add the operator/entity legal name and a postal contact address before launch; if you appoint an EU/UK representative or data-protection contact, name them here.]