Privacy Policy

1. Who we are

IDarU (“we”) is the app for private challenges between friends, for iOS and Android, with a website at idaru.app. The data controller is ⚠️ controller identification not yet published — missing, required by Article 13 GDPR, reachable at privacy@idaru.app.

This policy explains what we collect, why and on what legal basis, who can see it, who helps us process it, how long we keep it and what your rights are. It covers the app and the website.

2. Data we collect

Account: email, password (stored only as a secure hash by our authentication provider) or the identifier from Sign in with Apple or Google; username, display name and profile photo (the last two optional); and the date on which you accepted the Terms and confirmed the minimum age.

Profile extras (optional): a short bio, a motto, a profile colour, the trophies you choose to pin and whether your public profile is on (it is off by default). Sections 4 and 5 explain who sees them.

Challenges and progress: challenges you create or join, goals, check-ins, streaks, trophies, and your place on each challenge’s leaderboard and crew map (a grid of days done and missed for each member — not a geographic map: we never collect your location).

Proof photos: taken with the in-app camera, with the date, the goal and the challenge they belong to. Photos are re-encoded on your device before upload, which removes metadata such as GPS location.

Proof votes: when a member marks a proof as “Verified” or “Nice try”, we store who voted, how, when, and the optional reason (up to 140 characters) written with a “Nice try”.

Chat: text messages, the GIFs you choose, photo messages (from the camera or your gallery, re-encoded on your device, which strips metadata), voice notes (up to 60 seconds, recorded only while you hold the record button, plus a small waveform used to draw them), reactions to messages, and the author and time of each item. The chat also shows automatic event cards (someone joined, checked in, reached a streak, posted a proof, the final ranking), generated from activity in the challenge.

Typing indicator: while you type, members who have the chat open see “typing…”. The signal travels over a real-time connection, carries only your user ID and is not stored.

Nudges and notifications: when you nudge a friend, we queue a notification with your name and the challenge, and keep a counter to limit nudges. We also queue notifications for reminders, chat messages, proof votes and lost streaks.

Message allowance and credits: how many messages you sent in each challenge on each day and any extra credits earned by watching a rewarded ad. For rewarded ads, Google sends us a confirmation with a transaction ID, the ad unit and the reward, so we can check the reward is genuine.

Moderation: reports you file or that concern your content (type, reason, optional detail, date, outcome) and the accounts you have blocked.

Preferences: language, time zone (to know when your day ends), notification settings, reminder time and the light or dark theme (the theme is stored only on your device).

Device: push notification token (Expo) and platform (iOS/Android).

Usage events: a short, closed list of in-app events linked to your user ID, with the time and a few coarse details (for example which template was used, or whether a result was perfect): onboarding_done, challenge_created, template_used, invite_shared, feed_post_copied (a Feed challenge copied), result_shared, trophy_shared, share_card_shared (a share image was shared) and profile_shared (a profile link was shared). They never contain message text, names, photos, audio, contacts or who you shared with, and they are not used for advertising.

Advertising: Google AdMob shows ads in the app, limited to content suitable for ages 13 and over (Google’s “T” — teen — rating). On iOS, we ask through Apple’s App Tracking Transparency (ATT) prompt before the advertising identifier (IDFA) can be used; if you don’t allow it, the identifier is not available to us or to Google, and ads are non-personalised. On both platforms, personalised ads also need your consent in the consent form; without it, ads are non-personalised, which under Google’s own terms still use limited data (such as the IP address) for fraud prevention and frequency capping.

Diagnostics: error reports (Sentry) with the app version, device model, operating system, the technical trace of the error and your user ID — never the content of your messages, photos or voice notes, and no screenshots.

GIF search: when you open the GIF picker, your device talks directly to GIPHY (see section 7).

Website waitlist: email, the language of the sign-up, the date and, if you ask to reserve one, the username — kept as a pending request with a one-time confirmation token until you confirm it from the email we send you.

Technical logs: our hosting and backend providers keep short-lived technical logs (IP address, browser, time, address requested) to deliver and protect the service. On the waitlist, your IP address is used only to limit abuse (see section 9).

Information about your health or habits: some challenges can reveal something about your health or habits (for example a smoke-free month or a dry month). This is information you choose to write and share with the members you invite; we use it only to run the challenge, and you can delete it at any time. Don’t write health details you wouldn’t want the members of the challenge to see.

What we do NOT collect: your contacts, your location, data from health apps or sensors, or background audio — the microphone is used only while you hold the record button. We do not sell your data and do not track you across other companies’ apps or websites without your consent.

3. Why we use your data and on what legal basis

Providing the service — performance of the contract (Article 6(1)(b) GDPR): account, challenges, check-ins, proofs and votes, chat (text, GIFs, photos, voice notes, reactions, event cards, typing indicator), leaderboard and crew map, trophies and streaks, the daily message allowance and rewarded credits, the optional public Feed, the optional public profile and username search, share images generated on your device, the in-app data download and account deletion.

Notifications — consent (Article 6(1)(a)), given through your phone’s permission prompt and the switches in Settings → Notifications: reminders, chat messages, proof votes, nudges from friends and lost-streak alerts. Each kind can be switched off, and removing the permission on your phone stops them all.

Personalised advertising — consent (Article 6(1)(a)), through the consent form (Google UMP) and, on iOS, Apple’s App Tracking Transparency prompt, which must be accepted before the advertising identifier is used. Non-personalised ads (limited to content rated 13+) and the verification of rewarded ads — legitimate interest (Article 6(1)(f)) in funding a free service and preventing reward fraud.

Security, abuse prevention and moderation — legitimate interest (Article 6(1)(f)) and, where applicable, legal obligation (Article 6(1)(c)) under the Digital Services Act: limits on every write (including IP-based limits on the waitlist), handling reports, blocks, the language filter, suspensions and keeping evidence where the law requires it.

Stability and improvement — legitimate interest (Article 6(1)(f)): error reports and the closed list of usage events (section 2), to find bugs and understand which features are used. Our interest is in knowing what works so we can improve a free app; the events carry no content and no contact details, are only read as daily totals and are never used for advertising or shared with third parties, so the impact on your privacy is minimal. You can object at any time (section 11).

Waitlist — consent (Article 6(1)(a)): telling you when the app opens and, if you asked, reserving your username. Every email lets you unsubscribe.

Legal obligations and claims — legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)): answering lawful requests from authorities and establishing, exercising or defending legal claims.

4. Who sees what you create

Challenges are private: only members approved by the creator see the challenge, its goals, members’ progress, the leaderboard and crew map, the chat and the proofs. This rule is enforced in the database (row-level security): no approval, no access.

Proof photos: kept in private storage and shown only to approved members of the same challenge, through signed links that expire after one hour, and only while the challenge is active. They are never public, never go to the Feed and are never used for advertising.

Votes and “Nice try” reasons: the members of the challenge see who verified or called out a proof, and the reason given. Write reasons you would be comfortable with everyone in the challenge — including the person concerned — reading.

Chat photos and voice notes: kept in private storage and shown only to approved members of the challenge, through signed links that expire after one hour. If you block someone, you stop seeing their messages, photos and voice notes.

Nudges: only the friend you nudge receives the notification.

Notification previews: notifications about chat messages may show the first 120 characters of a message on the recipient’s lock screen, depending on their phone’s settings.

Profile: your username, display name, photo and trophies are visible to the members of your challenges, to people who open an invite of yours and, if you post, to Feed users. The profile photo is served from a public link so it can appear wherever your name does: anyone with that link can open it, so choose a photo you are happy to show to strangers. Anyone who searches for your username in the app sees only your username, display name and photo. Your bio, motto, profile colour and pinned trophies appear wherever your profile appears in the app and, only if you turn on the public profile, on the web (section 5).

Our team only accesses specific content when it has been reported, to investigate abuse or a security incident, or when the law requires it.

5. Public Feed and public profile (optional)

Nothing goes to the Feed on its own: only what you choose to share, post by post, when a challenge ends or reaches a milestone.

A post shows the challenge’s name, emoji, goals and duration, the result (days done, best streak, completion), the milestone, your comment and your public profile (username, name, photo and trophies). It is visible to all signed-in users of the app, except people you have blocked or who have blocked you, and others can like it, repost it or use the challenge as a template.

Never on the Feed: photos of any kind (the database rejects them), chat messages, voice notes, votes, your other challenges or who the members of your challenges are.

You can delete a post at any time; it stops being visible on the Feed.

Public profile: off by default. If you turn it on in your profile settings, anyone — including people without an account — can open your page at idaru.app/en/u/username and see your display name, username, photo, bio, motto, profile colour, pinned trophies and totals such as your best streak, trophies earned and challenges finished. It never shows your chats, proof photos, votes, the members of your challenges or your email.

You can turn the public profile off at any time in the same place; the page then stops being available (copies someone has already made, such as screenshots, are outside our control). Profile links you share only work while your profile is public.

Share images: result, trophy and profile cards are generated on your device from data already in the app. We don’t receive or store the image: you decide whether to share it and through which app (messaging, social networks), and that app’s own terms and privacy policy then apply. We never post anything on your behalf; we only record that a share happened (a usage event), never the image or the recipient.

6. Proof votes: no automated decisions

Whether a proof counts is decided by people — the other members of the challenge. A proof is rejected (“Nice try”) only when at least half of the other members call it out and the call-outs outnumber the verifications; voting is open for 48 hours after the photo. A rejected proof stops counting for that day, which can affect your streak.

No algorithm, artificial intelligence or image analysis judges your photos, and IDarU does not take decisions based solely on automated processing that produce legal or similarly significant effects on you (Article 22 GDPR). Our only automated step is a word filter that blocks offensive language in names, messages and reasons.

If you think a vote or a reason was abusive, report it (see the Terms of Service, section 8).

7. Service providers and where your data is processed

Supabase (database, authentication, storage of proof photos, chat photos, voice notes and profile photos, scheduled clean-up jobs): European Union — Frankfurt, Germany.

Vercel (website hosting and the waitlist API): global network; requests can be handled outside the EU.

Cloudflare Turnstile (anti-bot check on the waitlist form, no cookies; receives your IP and technical browser data only for that check): global network, United States.

Resend (sending emails: waitlist confirmation and welcome, and internal moderation alerts with minimal data): United States.

Expo — 650 Industries (push notification delivery, which then goes through Apple Push Notification service and Google Firebase Cloud Messaging): United States.

Sentry (error reports): project hosted in Sentry’s EU region (Frankfurt, Germany), under Sentry’s data processing agreement.

Google (AdMob ads and the consent form, and Sign in with Google if you use it): United States/Ireland. For ad personalisation, Google acts as an independent controller under its own policies.

Apple (Sign in with Apple if you use it, and push notification delivery on iOS): United States/Ireland.

GIPHY, Inc. (USA) provides GIF search and the GIFs themselves. Every search and every GIF shown is a request from your device to GIPHY’s servers, which receive the search term, your IP address, your device’s user agent and the app language. We do not send GIPHY your account, your email or the content of your messages. GIPHY processes this data as an independent controller under its own privacy policy. Because the request comes from your device and not from our servers, we are not the ones exporting this data: the legal basis for this transfer to the USA rests with GIPHY, under its own policy. You can avoid it entirely by not opening the GIF picker — nothing is sent to GIPHY until you do.

We do not sell your data or share it with anyone outside this list, except where the law requires it (for example, a valid order from a court or an authority).

8. International transfers

Our main database and files stay in the European Union. Some of the providers above are based in, or may access data from, the United States or other countries outside the European Economic Area.

When that happens, we rely on the safeguards provided by the GDPR: the provider’s certification under the EU-U.S. Data Privacy Framework, where it holds one, and/or the European Commission’s Standard Contractual Clauses included in the provider’s data processing agreement, together with additional measures such as encryption in transit.

You can ask us at privacy@idaru.app for information about the safeguards that apply to a specific provider.

9. How long we keep each thing

Account and profile: while your account exists.

Challenges, progress, leaderboard and trophies: while your account exists; challenges you created are deleted with your account, for all members.

Proof photos: deleted automatically about one day after the challenge ends, or earlier if the challenge or your account is deleted. Votes and reasons are deleted with the challenge or with the account of whoever wrote them.

Chat (messages, GIFs, reactions, photos, voice notes and event cards): while the challenge exists. They are deleted when the challenge is deleted or when the author deletes their account; the files are removed by a daily clean-up job. Photos or voice notes uploaded but never sent are deleted within about one day.

Typing indicator: not stored.

Notification queue (including nudges): deleted once sent, and after 7 days at most.

Abuse-prevention counters (including the waitlist counters keyed by IP address): deleted automatically after 7 days. The IP address is not linked to your email and is not used for anything else.

Rewarded-ad confirmations: 30 days. Message credits, usage events, profile extras (bio, motto, colour, pinned trophies), push tokens and preferences: while your account exists, and deleted with it (a push token is replaced when it changes). The public profile page only exists while you keep it switched on.

Reports: up to 12 months after they are resolved, so we can recognise repeat offenders. Blocks: until you undo them.

Diagnostics: up to 90 days.

Waitlist: until the app launches and the list is used, or until you ask to be removed. A username reservation not confirmed within 48 hours expires and stops holding the name.

Backups and logs: our providers keep backups and technical logs for a limited period; deleted data disappears from them as they rotate.

10. Deleting your account

You can delete your account in the app (Profile → Account → Delete account). Deletion is immediate and irreversible: it removes your profile, the challenges you created (for all their members), your progress, trophies, proof photos, votes, chat messages, photos, voice notes and reactions, your Feed posts and everything else linked to your account.

You can also ask for deletion by email to privacy@idaru.app.

11. Your rights and how to exercise them

You have the right of access, rectification, erasure, restriction of processing, objection and data portability (Articles 15–21 GDPR), and the right to withdraw consent at any time.

Much of this you can do in the app: edit your profile, change notifications and the ad choice, turn your public profile on or off, and delete your account. You can download a copy of your data yourself at any time in Profile → Download my data: a single JSON file (a structured, machine-readable format) with your profile, challenges, progress, messages, proofs, votes, posts, reports and blocks. If you prefer, or for any other request, write to privacy@idaru.app from the email address of your account. We may ask you to confirm your identity. We reply within one month (extendable by two further months for complex requests, in which case we tell you why). It is free, unless a request is manifestly unfounded or excessive.

You can object at any time to processing based on legitimate interest (for example usage events or diagnostics); we stop unless we have compelling legitimate grounds or need the data for legal claims.

Withdrawing consent is as easy as giving it: notifications in Settings → Notifications; personalised ads in Settings → Legal → Privacy & ads, which reopens the consent form; the waitlist through the unsubscribe link in any email. Withdrawing does not affect processing carried out before.

12. Minimum age

IDarU is for people aged 13 and over. When you create an account, you confirm that you meet this age.

In some EU countries, people below a certain age (between 13 and 16, depending on national law) need the permission of a parent or guardian for online services based on consent. In Portugal, that age is 13. If your country sets a higher age and you are below it, you need the permission of a parent or guardian, who should read this policy with you.

We do not knowingly collect data from children under 13. If you believe a child under 13 has an account, write to privacy@idaru.app and we will delete it.

13. Security

Everything travels encrypted (TLS). Access to data is decided in the database by row-level security; proofs, chat photos and voice notes live in private storage behind short-lived signed links; passwords are stored as hashes by the authentication provider; the session keys on your phone live in the device’s secure storage (Keychain/Keystore); photos are re-encoded to strip metadata; every write is rate-limited; and server keys follow the principle of least privilege. We review the security of the app and the website regularly.

No system is perfectly secure: keep your password to yourself, and tell us at privacy@idaru.app if you notice anything suspicious.

14. Data breaches

If a personal data breach is likely to result in a risk to your rights, we notify the supervisory authority (CNPD) within 72 hours of becoming aware of it. If the risk is high, we also tell you directly and without undue delay what happened, which data was affected, what we did and what you can do to protect yourself.

15. Cookies, local storage and the website

The website does not use tracking, advertising or analytics cookies. It may set one functional cookie (NEXT_LOCALE) to remember the language you chose. If you switch between light and dark theme, the choice is saved in your browser’s local storage (idaru-theme): it stays on your device, is never sent to us, is strictly functional and does not require consent. You can delete it in your browser settings.

The app stores on your phone only what it needs to work: your session (encrypted, with the keys in secure storage), a cache of data you have already loaded (cleared when you sign out), your theme, a pending invite (for up to 7 days), proof photos taken offline that are waiting to upload (removed from the queue once sent) and your ad consent choices (kept by Google’s consent SDK; on iOS, your tracking choice is kept by the system).

16. Complaints

If you are unhappy with how we handle your data, please write to privacy@idaru.app first — we want to fix it. You also have the right to lodge a complaint with a supervisory authority: in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or the authority of the EU country where you live, work or where the alleged infringement took place.

17. Changes to this policy

When we change something relevant, we update the date at the top and tell you in the app before the change takes effect. The version in force is always the one on this page, and we can send you earlier versions on request.