This Privacy Policy explains how Karthik Appannagari ("we," "us," or "I") collects, uses, and shares information when you use the Momentum mobile application (the "App") and the checkindaily.app website (the "Site"), together the "Services."

By using the Services, you agree to the practices described here. If you do not agree, please do not use the Services.

Contact: redmango.karthik@gmail.com

1. Who is responsible for your data

Momentum is operated by Karthik Appannagari, an individual developer based in New Jersey, United States. For the purposes of data protection laws such as the EU/UK GDPR, I am the "data controller" for the personal information described in this policy. Where I use third-party services to process data on my behalf (described in Section 6), those providers act as "processors" or "subprocessors."

2. Information we collect

a. Information you provide

• Account information. When you create an account, we collect your email address and a password. Passwords are handled by our authentication provider (Supabase) and are stored in hashed form; we never see or store your password in plain text.
• Profile information. A display name (which may default to the first part of your email), and optionally a timezone and appearance preference.
• Onboarding responses. During onboarding you may tell us your primary goal, the areas you want to improve (which can include fitness, sleep, mental health, hydration, nutrition, screen time, and productivity), your typical wake and sleep times, how much free time you have, your activity level, and your biggest challenge. This information is used to personalize your experience.
• Habit and check-in data. The habits you create (name, emoji, schedule, reminder time, color, and check-in window settings), your daily check-ins, optional notes you attach to a check-in, your streaks, XP, levels, and any commitments you start.
• Waitlist information. If you join the waitlist on checkindaily.app, we collect the email address you submit.

b. Information collected automatically

• Technical and device information. When you use the Site, our hosting provider may automatically process standard technical data such as your IP address, browser type, and access times for security and operational purposes. We also use a privacy-friendly, cookieless analytics tool (Vercel Web Analytics) on the Site to measure aggregate traffic such as page views and referrers; it does not use cookies, does not track you across other websites, and does not collect personally identifiable information. The App relies on your device and our backend to function and does not include third-party analytics or advertising SDKs.
• Push notification token (future). If and when we enable remote push notifications, we will collect a device push token to deliver them. Reminder notifications in the current version are generated locally on your device.

c. Information we do not collect

Beyond the cookieless Site analytics described above, we do not use third-party advertising, crash-reporting, or cross-site tracking SDKs, and we do not sell your personal information. We do not access Apple Health / HealthKit data unless and until a future version offers that feature and you explicitly grant permission.

3. How we use your information

We use the information described above to:

• Create and maintain your account and authenticate you;
• Provide core functionality: tracking habits, check-ins, streaks, XP, levels, and commitments;
• Personalize your experience, including generating recommendations and insights (see Section 4);
• Send you local reminders and, in the future, remote notifications you have enabled;
• Operate social features such as friend requests and shared public habits (see Section 5);
• Maintain the security and integrity of the Services and prevent abuse;
• Respond to your requests and provide support;
• Comply with legal obligations.

Our legal bases for processing (where the GDPR applies) are: performance of our contract with you (to provide the Services), your consent (for example, optional features and notifications), and our legitimate interests (such as keeping the Services secure).

4. AI-powered features and processing

Momentum offers, or will offer, features that use a third-party large language model provided by Groq to generate personalized content:

• Personalized onboarding plan. Your onboarding responses (such as your goal, focus areas, wake/sleep times, activity level, and stated challenge) may be sent to Groq through our backend to generate a personalized plan.
• Habit insights. Once a habit has enough check-in history, limited habit data (such as the habit name and your check-in and streak statistics) may be sent to Groq to generate insight cards about your progress.

When this data is sent to Groq, it is processed to produce the feature output and is subject to Groq's own data-handling terms. We send only the data needed to generate the feature and do not send your password or full account record. AI-generated insights are informational only and are not professional, medical, psychological, or other expert advice.

5. Social features and information visible to others

Momentum includes social features. You should be aware that:

• Other users can search for accounts to send friend requests. Your display name may be visible to other users through friend search and friend-request screens so they can find and recognize you. Your email address is not shown to other users.
• Habits you explicitly mark as public can be viewed by your accepted friends, including the habit details and your progress on them. Habits are private by default unless you choose to make them public.

If you would like us to limit this visibility for your account, contact us at the email above.

6. Service providers and subprocessors

We share information with the following third parties only as needed to operate the Services:

These providers are authorized to use your information only to perform services for us. We encourage you to review each provider's own privacy policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights, safety, or property of our users or others.

7. Data retention

We retain your personal information for as long as your account is active or as needed to provide the Services. If you delete your account, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain certain information to comply with legal obligations, resolve disputes, or enforce our agreements. Backups may persist for a limited additional period before being overwritten.

8. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and associated personal data;
• Export / portability of your data;
• Object to or restrict certain processing;
• Withdraw consent where processing is based on consent.

California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law, and we will not discriminate against you for exercising your rights.

To exercise any of these rights, email redmango.karthik@gmail.com. We will verify your request and respond within the timeframe required by applicable law. You may also delete most of your data directly within the App where account-deletion controls are provided.

9. Children's privacy

The Services are intended for users 16 years of age and older. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us with personal information, contact us and we will delete it.

10. Security

We use industry-standard measures to protect your information, including encryption in transit, hashed password storage handled by our authentication provider, and access controls on our database. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

11. International data transfers

We are based in the United States, and our service providers may process data in the United States and other countries. If you access the Services from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country. Where required, we rely on appropriate safeguards for such transfers.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you within the Services. Your continued use of the Services after an update constitutes acceptance of the revised policy.

13. Contact

If you have any questions about this Privacy Policy or your personal information, contact:

Karthik Appannagari
Email: redmango.karthik@gmail.com