Privacy Policy

1. What this policy covers

The Jaap Daily mobile app on iOS and Android, the Apple Watch companion, the iOS and Android home-screen widgets, and this website, jaapdaily.com.

2. Anonymous mode — what we do not collect

Anonymous mode is the default when you install the app. In this mode: no name, no email, no phone number, no location, no contacts. No account is required. The app contains no advertising SDK. The iOS app does not present an App Tracking Transparency prompt in anonymous mode because it performs no tracking as defined by Apple.

Firebase Analytics is on by default (Settings → Privacy → "Help improve JaapDaily" — you can turn it off there at any time, in anonymous mode or signed in). It reports an anonymous App Instance ID, not linked to your name, email, or phone number even if you later sign in, and a small set of bucketed properties: your app language, the naam or deity you've selected, a coarse country derived from your device's locale setting, and a lifetime-engagement tier (a bucket like "1–100 japs," never your exact count). No advertising identifier is collected, and none of this is used for advertising.

3. Optional sign-in — what an account collects

Sign-in is optional and exists solely to enable cloud sync across your devices. You can use every feature of the app without one. If you choose to sign in, the data collected depends on your method:

• Phone number. Your phone number. Used for authentication only — we do not use it for calls, SMS marketing, or any other purpose.
• Email and password. Your email address. Used for authentication and, if needed, account recovery.
• Google Sign-In. Your Google account email and display name, as provided by Google.
• Sign in with Apple. Your Apple ID email address. Apple lets you hide your real email behind a relay address — if you choose that option, we receive only the relay address. We do not receive your Apple ID password.

None of the above is used for advertising, analytics, profiling, or any purpose other than authentication and syncing your practice data to your account.

4. Religious-practice data is treated as special-category data

The naam, mantra, deity, and mala size you choose reveal religious belief. Under GDPR Article 9 and equivalent laws elsewhere, this is "special category" data deserving heightened protection. In anonymous mode this data never leaves your device. If you sign in and enable cloud sync, your practice data (sessions, streaks, naams, settings) is stored in Firebase under your account — encrypted in transit and at rest. We do not read it, sell it, or use it for any purpose other than returning it to your devices when you sign in.

5. What lives on your device

Session history, streaks, custom naams, settings, in-app purchase status, Apple Watch session data (synced device-to-device over Apple's WatchConnectivity framework), and home-screen widget snapshot data (read from a private App Group on iOS / private SharedPreferences on Android). In anonymous mode all of this stays on device only. If you are signed in, this data is also backed up to Firebase as described in Section 7.

6. What the app transmits

For anonymous users, three things and nothing else. For signed-in users, those three plus authentication and sync data.

• In-app purchases. Apple's StoreKit and Google's Play Billing handle donations. The transaction goes between your device and the platform, not through us. To support "Restore Purchases," Apple and Google link the purchase to your Apple ID or Google account; we receive only an anonymous purchase token, not your account identity.
• Notifications — streak reminders and milestone celebrations. Scheduled and delivered locally on your device using the operating system's local-notification facilities. No server involved, no device token leaves your device for these.
• Notifications — Donation Reminders. An occasional message (Settings → Notifications → "Donation Reminders," on by default, toggle off anytime) like a Diwali or New Year note about supporting the app. Unlike streak/milestone notifications, these are delivered via Firebase Cloud Messaging: your device registers a push token with Firebase and is subscribed to topics built from the same bucketed attributes described in Section 2 — app language, selected naam/deity, coarse country from device locale, and lifetime-engagement tier. Turning the toggle off unsubscribes your device from these topics.
• Mantra Library updates (planned). When this ships, the app will fetch updated mantra text from our content endpoint over HTTPS without sending any identifier. The request is equivalent to a static asset fetch.
• Authentication (signed-in users only). Your sign-in credential (phone number, email, or third-party token) is sent to Firebase Authentication over HTTPS to verify your identity. Firebase issues a session token stored securely on your device.
• Cloud sync (signed-in users only). Your practice data is encrypted and synced to Firebase under your authenticated account. It is not readable by us.

7. Cloud sync

Cloud sync is available now for signed-in users. It is opt-in — you activate it by creating an account. It syncs your sessions, streaks, naams, and settings across all devices where you sign in with the same account. Signing out on a device stops sync on that device; the local copy remains. Deleting your account permanently removes all synced data from our servers — see the Delete Data page for step-by-step instructions. Synced data is processed and stored on Google Cloud infrastructure located in the United States.

8. This website — what we collect

With your consent (via the cookie banner), this site uses Google Analytics 4 to understand which pages people read and Meta (Facebook) Pixel to measure ad-campaign effectiveness. Both set cookies in your browser. Both are off by default — they only activate after you click Accept on the banner. If you click Reject, or do nothing, neither runs.

A note about Meta Pixel: by design, Meta Pixel sends data back to Meta, which may use it to retarget ads to you on Facebook and Instagram. We use it only to measure ad-campaign effectiveness, but we cannot control Meta's secondary use. If this is uncomfortable for you, click Reject and Meta will see nothing.

9. Why the website and the app use analytics differently

The website's job is to help people find an app that helps them — Google Analytics 4 and Meta Pixel (both consent-gated, see Section 8) tell us which channel sent you, which page convinced you, which one bored you. Inside the app, the goal is different: a quiet, trustworthy tool, not a marketing funnel. That's why in-app analytics (Section 2) is deliberately minimal — an anonymous instance ID and a handful of bucketed properties, on by default but always one tap away from off, never used for advertising, and never enriched with anything that could identify you personally. We hold the line at collecting the least we need to keep the app working well, not the most we could.

10. What GA4 and Meta Pixel see if you accept

Pages you visit on jaapdaily.com, your approximate region (city-level), device type, and referrer. They do not see what you do inside the app.

11. Withdrawing consent

Click the "Cookies" link in our footer to reopen the banner and change your choice.

12. Children

Jaap Daily is not directed at children. We do not knowingly collect personal data from anyone under 18. Anonymous mode (no sign-in, data stays on-device only) is always available without age restriction and is the recommended way for a family to let a younger member use the app. If we learn that a signed-in account belongs to someone under 18, we will delete the account and associated data. A parent or guardian who believes their child has created a signed-in account, or used our website's contact form to share information, may email support@jaapdaily.com for verified deletion.

13. Third-party services we use

Apple App Store and Google Play (distribution and in-app purchases), Firebase Authentication and Firestore (optional sign-in and cloud sync, operated by Google LLC), Google Sign-In (optional sign-in method), Sign in with Apple (optional sign-in method), iCloud and Google Drive (device-level backups when enabled by the user, outside our control), Cloudflare (website hosting and CDN), Google Analytics 4 (website analytics, consent-gated), Meta Pixel (ad measurement, consent-gated), and Resend (delivery of email you send through the contact form — messages retained for 12 months unless you ask for earlier deletion).

14. Your rights

Regardless of where you live:

• Anonymous users can uninstall the app to remove all data from your device. Any anonymous account identifier is not linked to your identity and is not retrievable without the device.
• Signed-in users can delete their account and all synced data from Settings → Account → Delete Account, then uninstall. Full instructions: jaapdaily.com/delete-data.
• You can withdraw cookie consent at any time via the footer link.
• You can email support@jaapdaily.com to request deletion of any contact-form correspondence or account data.

If you are in the EU, EEA, or UK, the General Data Protection Regulation (and UK GDPR) give you the right to:

• access the personal data we hold about you,
• have it corrected if inaccurate (rectification),
• have it erased (the "right to be forgotten"),
• restrict how we process it,
• receive a portable copy (data portability),
• object to processing,
• withdraw any consent you previously gave, and
• lodge a complaint with your national supervisory authority (for example, the ICO in the UK, or your country's data-protection authority in the EU/EEA) if you believe we have not handled your data properly.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know, the right to delete, the right to correct, and the right to non-discrimination for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.

If you are in India, the Digital Personal Data Protection Act, 2023 (DPDP) gives you the right to:

• access a summary of your personal data and the processing activities carried out,
• correction and updating of your personal data,
• erasure of personal data that is no longer necessary for the purpose it was collected,
• grievance redressal — see the Grievance Officer details in Section 17,
• nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, and
• withdraw consent at any time, as easily as it was given.

To exercise any right, email support@jaapdaily.com. We will respond within 30 days.

15. Security and data breaches

On-device app data is protected by your operating system's standard encryption (iOS Data Protection / Android File-Based Encryption). Account and sync data stored in Firebase is encrypted in transit (TLS) and at rest using Google's standard encryption. Website analytics data sits with Google and Meta under their standard security regimes. Email you send via the contact form sits with Resend (in transit) and Gmail (at rest). If a security incident affects data we hold — account data or contact-form correspondence — we will notify affected users within 72 hours, consistent with GDPR Article 33.

16. Changes to this policy

Material changes will be announced on this page and noted in the changelog below. The date at the top of this page reflects the most recent revision. For changes that materially expand data collection, we will notify signed-in users in-app before the change takes effect.

17. Contact

Privacy questions, deletion requests, and rights requests: support@jaapdaily.com.

Grievance Officer (India, DPDP Act 2023): Dishika Singh, dpdp@jaapdaily.com. Complaints are acknowledged within 7 days and resolved within 30 days.

18. Online counter on this website

The /counter page on this website lets you tap to count without installing the app. Your count, mala progress, streak, and naam choice are saved in your browser's local storage on your device. We do not send any of this data to any server, and the counter does not fire any analytics event when you tap, complete a mala, or change your naam. Clearing your browser data, switching browsers, or using private/incognito mode will reset the counter — for persistent history, multi-device streaks, and full insights, use the mobile app.

If you choose "Add to Home Screen," the page is installed as a Progressive Web App on your device and uses a small service worker to cache the counter so it works offline. The service worker stores only the page itself and its visual assets — no count, streak, or naam data passes through it.