Privacy Policy

We collect information you provide directly, information generated by your use of the Service, and limited technical information from your device.

a. Information you provide

• Account information: email address and password (stored as a salted hash by our auth provider; we never see your plain-text password).
• Content you create: values, objectives, key results, practices, daily check-in entries, and reflections.
• Communications: messages you send to support, including any information you choose to include.

b. Information generated by your use

• Usage data: pages visited, features used, and timestamps of actions, used to operate and improve the Service.
• Device data: IP address, browser type, operating system, and time zone.

• To provide, maintain, and improve the Service.
• To authenticate you and secure your account.
• To respond to your requests, questions, or support inquiries.
• To detect, prevent, and address fraud, abuse, or technical issues.
• To comply with legal obligations.

We do not sell your personal information. We do not use your content to train third-party machine-learning models. We do not engage in automated decision-making that produces legal or similarly significant effects concerning you (GDPR Art. 22).

We share information only in these limited circumstances:

• Service providers (sub-processors): we use Supabase for authentication and database hosting. Supabase processes data on our behalf under contractual data-processing terms.
• Legal compliance: when required by law, court order, or valid legal process, or to protect rights, property, or safety.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice to you in advance.
• With your consent: for any other disclosure, we will ask first.

We retain account and content information for as long as your account is active. When you delete your account, we delete or anonymize your personal information within 30 days, except where retention is required by law (e.g. tax records, fraud prevention) or where data has been aggregated such that it can no longer identify you.

Depending on where you live, you may have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct information that is inaccurate or incomplete.
• Deletion: ask us to delete your personal information, subject to the retention exceptions above.
• Portability: request a machine-readable export of your content.
• Objection / restriction: object to or ask us to restrict certain processing.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

For users in the European Economic Area, the United Kingdom, or Switzerland, the legal bases for processing are: performance of our contract with you, our legitimate interests in operating the Service, and your consent where required.

For California residents, the California Consumer Privacy Act (CCPA) gives you the rights of access, deletion, correction, and the right to know what personal information we collect and disclose. We do not sell personal information.

To exercise any of these rights, contact us at privacy@whyokr.app. We will respond within 30 days.

We use only the cookies and local-storage entries strictly necessary to operate the Service — primarily to keep you signed in. We do not use third-party advertising or analytics cookies.

We use industry-standard safeguards including TLS in transit, encryption at rest, scoped database access, and the row-level-security model provided by our database platform. No system is perfectly secure; we cannot guarantee absolute security.

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with information, please contact us so we can delete it.

Our Service and our service providers may process information in the United States or other countries. Where required by law (for example, for transfers from the EEA, the UK, or Switzerland), we rely on Standard Contractual Clauses or other appropriate safeguards.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you within the Service or by email.

If you have questions or concerns about this Privacy Policy or our handling of your information, contact us at privacy@whyokr.app.

For users in the EEA, the UK, or Switzerland, you have the right to lodge a complaint with your local data-protection authority.

whyokr.app · PO Box 21 Hornsby NSW 1630 Australia