Privacy Policy

Sugar Free 30 (the “Service”) is operated by [LEGAL ENTITY NAME], ID/IČO: [COMPANY ID / IČO], registered at [REGISTERED ADDRESS], Czech Republic (the “Controller”, “we”, “us”). For any privacy-related questions, contact carbochq@seznam.cz.

• Account data: email address, username, password (hashed by our auth provider), and authentication metadata (e.g. Google sign-in identifier).
• Profile & challenge data: challenge start date, timezone, streak, daily check-ins (including mood ratings and any notes you write), badges, and preferences.
• Communications: your email-notification preferences and any messages you send us.
• Usage data: basic technical information such as browser type, device type, language, and pages visited, used to keep the Service secure and improve it.
• Payment data: we do not store your card or payment details. Payments are handled by Lemon Squeezy (see processors below). We receive only your subscription status and a customer identifier.

• To create and operate your account and provide the Service.
• To track your challenge progress, streaks, and achievements.
• To send transactional emails (welcome, password reset, daily reminders, billing).
• To send marketing/newsletter emails — only if you opt in.
• To process payments and manage subscriptions.
• To detect, prevent, and address fraud, abuse, or technical issues.
• To comply with legal obligations.

• Performance of a contract (Art. 6(1)(b) GDPR) — providing the account, the challenge, and your subscription.
• Consent (Art. 6(1)(a) GDPR) — for marketing emails and any optional cookies. You can withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f) GDPR) — keeping the Service secure, preventing abuse, and improving functionality.
• Legal obligation (Art. 6(1)(c) GDPR) — accounting and tax record-keeping in cooperation with our payment processor.

We share personal data only with carefully selected processors who help us operate the Service:

• Supabase — database, authentication, and hosting of user data.
• Lemon Squeezy — payment processing and subscription billing (Merchant of Record).
• Resend — sending transactional emails (welcome, password reset, reminders).
• Mailerlite — sending marketing/newsletter emails (only if you opt in).
• Lovable — application hosting and infrastructure.

Each processor is bound by appropriate data-processing terms and processes data only on our documented instructions.

We use strictly necessary cookies and browser local storage to keep you signed in, remember your preferences (e.g. timezone), and provide core functionality. We do not use third-party advertising cookies.

We keep your account and challenge data for as long as your account is active. If you delete your account or request erasure, we will delete your personal data within a reasonable period, except where we are legally required to retain certain records (e.g. invoices for tax purposes).

Some of our processors are located outside the European Economic Area. Where data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses to ensure your data remains protected.

You have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a portable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — at any time, where processing is based on consent.
• Lodge a complaint with the Czech supervisory authority, Úřad pro ochranu osobních údajů (ÚOOÚ) — www.uoou.cz.

To exercise any of these rights, email carbochq@seznam.cz. We will respond within the timeframes required by GDPR.

The Service is not intended for children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, for material changes, notify you in the app or by email.

Questions or requests? Email carbochq@seznam.cz.