Privacy Policy

1. Controller

The data controller is Give up s.r.o., company ID 14445689, Sochařská 312/12, Bubeneč, 170 00 Praha 7, Czech Republic. Privacy contact: podpora@challapp.cz.

2. What we store

Only what the app needs to work:

• Account identifier. Without sign-in it is a random anonymous ID. After Sign in with Apple, Apple adds a stable identifier and optionally your name and e-mail (Apple lets you hide the e-mail via relay; we do not need it and never send it anywhere).
• Your group name, chosen by you. Visible only to members of your groups.
• Your challenges: title, length, bar, start date, your “why” sentence.
• Daily check-ins: date, done/not done, optional note.
• Groups: membership, invite code, reactions to others' check-ins.
• Settings: language, time zone, reminder time.
• Subscription status from the App Store: plan type and expiry date. Never payment details; only Apple has those.
• Technical: creation timestamps. We do not store location, contacts, photos or content of other apps.

3. Why and on what basis

• Providing the service (contract): challenges, check-ins, groups, sync across devices, subscription.
• Security and operations (legitimate interest): abuse prevention, bug fixing, obligations under the EU Cyber Resilience Act.
• Reminders (your system consent): local notifications are scheduled by your phone; nothing is sent to our server.
• Legal obligations: we keep Apple's accounting documents as required by law.

4. Where data lives and who processes it

Data is stored in a Supabase database in a data centre in Frankfurt (EU). Supabase Inc. is our processor under a data processing agreement. A copy is also on your phone so the app works offline.

Apple processes sign-in (Sign in with Apple) and payments under its own policies.

We use no ad networks, tracking SDKs or third-party analytics. We do not sell data and do not share it with anyone else unless the law requires it.

5. Who sees your data

You. Members of your groups see your group name, your daily check-ins and notes for the challenge that belongs to the group. Nothing else (other challenges, settings, e-mail). We look at data only for support or bug fixing, at your request.

6. How long

As long as you have an account. After deletion we erase data within 30 days, backups within 90 days. In groups an anonymous “Left” trace remains with no link to you. Anonymous accounts inactive for more than 24 months are deleted.

7. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection. In the app you can do it yourself:

• Export: Settings → Export data (a CSV with everything we have about you).
• Deletion: Settings → Delete account.
• Anything else: podpora@challapp.cz, we reply within 30 days. You may lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz) or your local authority.

8. Children

The app is not intended for children under 15. If we learn a younger child uses it without parental consent, we delete the account.

9. The challapp.cz website

This website uses no cookies and no analytics. Hosting is provided by Vercel Inc., which processes technical logs (IP address, request time) for as long as needed for operation and security.

If you join the waitlist we store your e-mail, language and sign-up time (Supabase database, Frankfurt). We use it for one message about the app's release, nothing else. After sending it we delete the list; you can ask for earlier deletion at podpora@challapp.cz.

10. Changes

When we change this policy we announce it in the app. The current version is always at challapp.cz/en/privacy.