Privacy Policy

1. Introduction

Welcome to HydraFill ("we," "us," "our," or "Company"). We are committed to protecting your privacy and ensuring you have a positive experience on our mobile application and website.

This Privacy Policy explains our information practices, including what data we collect, how we use it, and your rights regarding your information. By using HydraFill, you agree to the collection and use of information in accordance with this policy.

If you do not agree with our policies and practices, please do not use HydraFill.

2. Information We Collect

2.1 Account & Authentication Data

When you create a HydraFill account, we collect:

• Email address — for account creation, login, and password recovery
• Password — securely hashed and stored (never in plaintext)
• Full name — optional, for personalization
• Body type preference — male/female for body visualization
• Daily hydration goal — based on your inputs during onboarding
• Account creation date — automatically recorded

Third-party auth: If you sign in via Google or Apple, we receive your email and name from them. We do NOT access your contacts, location, or other Google/Apple account data.

2.2 Hydration & Health Data

You voluntarily provide us with:

• Drink logs — time, type (water, coffee, tea, juice, etc.), volume, and custom notes
• Custom drinks — name, category, volume, calories (optional), personal notes
• Streak data — daily goal completion history and achievement milestones
• Analytics insights — weekly/monthly hydration trends and patterns

This data is non-medical and for wellness tracking only. HydraFill is not a medical device and should not replace professional medical advice.

2.3 Payment & Subscription Data

HydraFill uses RevenueCat to manage subscriptions. When you purchase a subscription:

• RevenueCat receives: Your app purchase information, subscription status, and renewal dates
• Apple/Google receive: Your payment method (we never see your credit card details)
• We receive: Your subscription tier (free/premium), expiration date, and entitlements

Payment processing is handled entirely by Apple App Store or Google Play Store. We never store, process, or see your credit card numbers.

2.4 Photos & Media

If you upload a profile avatar:

• Photos are stored in Supabase Storage (encrypted at rest)
• You can delete your photo anytime from Profile settings
• We never share photos with third parties

2.5 Push Notifications

If you enable reminders, we collect:

• Notification preferences — times you want to be reminded
• Device tokens — to send notifications to your device

You can disable notifications anytime in app settings or your device settings.

2.6 Device & Usage Data

We may automatically collect:

• Device type & OS version — iOS/Android and app version
• App usage patterns — features you use and session duration
• Crash reports — if the app crashes, we receive anonymous error logs
• IP address — for security and fraud detection

2.7 Location Data

HydraFill does NOT request or collect your location. We do not know where you are unless you explicitly tell us (e.g., in profile notes).

3. How We Use Your Information

Data We Do NOT Use

• We do NOT sell your data to advertisers or data brokers
• We do NOT use your hydration data for targeted advertising
• We do NOT combine your data with other users to identify you
• We do NOT use your data for automated decision-making or profiling

4. Third-Party Services & Data Sharing

4.1 Supabase (Backend Infrastructure)

What they store: User accounts, drink logs, photos, custom settings

Where: Supabase's cloud servers (hosted on AWS)

Why: We use Supabase to store and retrieve your app data reliably

Their privacy: Supabase Privacy Policy

4.2 RevenueCat (Subscription Management)

What they receive: Your subscription purchase data, entitlements, renewal dates

Why: We use RevenueCat to manage premium subscriptions fairly across iOS and Android

Their privacy: RevenueCat Privacy Policy

4.3 Google Sign-In & Apple Sign-In

What they share: Email address and full name only

What we don't access: Your contacts, location, calendar, photos, or other Google/Apple account data

Their privacy: Google Privacy Policy | Apple Privacy Policy

4.4 Apple App Store & Google Play Store

Payment processing, subscription management, and crash reporting are handled directly by Apple and Google. We never receive your payment details.

4.5 Email Service (Resend)

What they receive: Your email address (for password resets and account confirmations)

Their privacy: Resend Privacy Policy

4.6 Legal Compliance & Law Enforcement

We may disclose your information if required by law, such as:

• A valid court order or subpoena
• Requests from law enforcement agencies
• Protection of our legal rights or safety
• Prevention of fraud or illegal activity

We will notify you of such requests unless legally prohibited.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All data sent to/from HydraFill uses HTTPS/TLS 1.2+
• Encryption at rest: Supabase encrypts your data at rest on their servers
• Password security: Passwords are hashed with a strong one-way algorithm, never stored in plaintext
• Access controls: Only authorized HydraFill team members can access user data
• Regular reviews: We monitor our backend's security and compliance status regularly

6. Data Retention & Deletion

How Long We Keep Your Data

How to Delete Your Account & Data

You can request deletion of your account anytime:

1. Go to Profile → Settings → Delete Account (where available), or
2. Email us at support@hydrafill.fit from your registered email address
3. We delete all your data from our systems within 30 days

7. Your Privacy Rights

If you're in the European Union, United Kingdom, California, or another region with privacy laws, you have rights regarding your data:

7.1 Right to Access

You have the right to request a copy of all data we hold about you. Contact us at support@hydrafill.fit and we'll provide your data within 30 days.

7.2 Right to Correction

You can update your account information (name, email, goal, body type) directly in the app under Profile settings.

7.3 Right to Deletion ("Right to be Forgotten")

You can request deletion of your account and all associated data. We'll delete everything within 30 days, except where legally required to retain it (e.g., billing records).

7.4 Right to Data Portability

You can request your data in a portable format (JSON/CSV). Contact support@hydrafill.fit.

7.5 Right to Object

You can opt out of analytics or push notifications in app settings.

7.6 Right to Restrict Processing

You can request that we limit how we use your data. Contact support@hydrafill.fit.

7.7 Right to Withdraw Consent

If we're processing data based on your consent (like analytics), you can withdraw that consent anytime in settings.

How to Exercise Your Rights: Email us at support@hydrafill.fit with your request and we'll respond within 30 days (up to 45 days for GDPR where permitted).

8. Children's Privacy

HydraFill is not intended for children under 13. We do not knowingly collect data from anyone under 13.

If we discover that someone under 13 has created an account, we'll delete it immediately. If you believe a child under 13 has registered, please contact us at support@hydrafill.fit.

For users ages 13-18, parental consent is recommended for account creation and data collection.

9. International Data Transfers

Your data may be transferred to and processed in countries other than where you live, including the United States.

If you're in the EU/UK: Our processors provide adequacy mechanisms (such as Standard Contractual Clauses) for data transfers to the US.

By using HydraFill, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection rules.

10. Cookies & Tracking Technologies

In the app: HydraFill does not use cookies or advertising trackers inside the mobile app.

On our website: Our website may use minimal cookies for basic analytics. You can disable cookies in your browser settings.

Third-party trackers: We do not allow third-party advertising networks or data brokers to track you.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Updating the "Last Updated" date at the top of this page
• Sending an email notification to your registered email address (for significant changes)
• Posting a notice in the app

Your continued use of HydraFill after changes means you accept the updated policy.

13. Acknowledgment

By using HydraFill, you acknowledge that you have read this Privacy Policy and agree to its terms.