Privacy Policy

At WINTER ARC we take privacy seriously. This policy explains what data we collect, how we use it, and the choices you have. We designed WINTER ARC to minimize data collection: most of your discipline data lives either in your browser (local mode) or in our cloud only when you explicitly sign in with Google.

1 — Data We Collect

• Account data (when you sign in): Google OAuth profile — name, email address, and profile picture URL. We do not receive your Google password.
• Protocol data: Your habits/cards, tasks, check-ins, stat polygon values, streak counters, and custom stats/labels — stored locally or in the cloud depending on auth state.
• Technical data: Standard server logs (IP address, user-agent, request timestamps) for security and debugging; session cookies for authentication; and minimal error logs.
• We do NOT collect: Payment data (no payments in current build), precise location, or sensitive categories unless you voluntarily type them into task descriptions.

2 — How We Use Data

• Provide and maintain the Service — render your dashboard, sync data when you are signed in, compute streaks and Stat Polygon levels.
• Authenticate you via Google OAuth and keep you signed in via a secure session cookie.
• Improve and secure the Service — detect abuse, debug, and measure aggregate (anonymized) usage.
• Communicate service-related notices (e.g., changes to these terms). We do not send marketing emails unless you opt in.

3 — Legal Bases (EEA/UK)

Where GDPR applies, we process data under: (a) contract necessity — to provide the Service you requested, (b) legitimate interests — to secure and improve the Service, and (c) consent — where you gave it (e.g., optional analytics). You may withdraw consent at any time without affecting prior processing.

4 — Sharing & Disclosure

• We do not sell your personal data.
• We share data only with service providers needed to run the Service: hosting (e.g., Render/Fly.io), database, and OAuth provider (Google). These providers are bound by confidentiality and data-processing agreements.
• We may disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and security of WINTER ARC and its users.
• Third-party embeds (Google Fonts, Chart.js CDN) may receive your IP and user-agent under their own privacy policies when your browser loads them.

5 — Cookies & Local Storage

• Session cookie: A secure, HttpOnly cookie keeps you signed in for up to 30 days (via Starlette SessionMiddleware).
• LocalStorage keys: winterarc-tasks-v2, winterarc-checks-v2, winterarc-stats-v2, winterarc-streak, etc. — used for local-mode persistence.
• No advertising cookies or cross-site trackers are set by us.

6 — Data Retention

Cloud data is retained while your account is active. You can delete it at any time via Reset or by deleting your account (contact us). Local data persists until you clear it or press Reset. Server logs are retained for ~30-90 days for security, then rotated/deleted.

7 — Security

We use industry-standard measures: HTTPS in transit, bcrypt for any password-derived secrets (if applicable), session secrets via environment variables in production, and database access controls. No system is 100% secure — use a strong, unique Google account and keep your device secure.

8 — Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, object, or port your data, and to lodge a complaint with a supervisory authority. To exercise rights, email webmayhemx@gmail.com. We will respond within 30 days.

• Export: Your data is stored as JSON — request an export and we will provide it.
• Deletion: Sign in → Reset, or email us to delete your cloud account entirely.
• Local control: Clear localStorage keys or use your browser's site-data controls.

9 — Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect data from children. If you believe a child has provided data, contact us and we will delete it promptly.

10 — International Transfers

Your data may be processed in the country where our servers/hosting reside (e.g., US/EU), which may have different data-protection laws than your region. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) for transfers.

11 — Changes to This Policy

We may update this policy from time to time. We will post the revised version with a new effective date and, for material changes, provide notice via the Service or email. Continued use after the effective date constitutes acceptance.

12 — Contact

For privacy questions or requests: webmayhemx@gmail.com. Branding sublink canonical URL: /privacy.

Generic template for branding/hosting — not legal advice. Tailor to your entity, hosting region, and actual data flows (analytics, payments, etc.) before production use.