Protocol66 Privacy Policy

Who we are

Protocol66 is made by Pocket Apps Studio Pte Ltd, 160 Robinson Road, #14-04, SBF Center, Singapore 068914 ("we"). We are responsible for the processing described here. Contact: support@pocketapps.studio.

Your account

Protocol66 uses Sign in with Apple. Apple gives us a unique identifier for your account and, if you allow it, your name and email address (which may be an Apple private relay address). Sign-in is handled by Google Firebase Authentication.

Data stored on your device

Your challenge (chosen habits, daily check-ins, rest days, streaks and settings) is stored on your device.

Data synced to our servers

To power friends, leaderboards and cohorts, the following is stored in Google Firebase Cloud Firestore:

• the display name and emoji avatar you choose
• your friend code and your list of friends
• challenge progress: current day, current and best streak, whether today is complete, your start date and start week, and totals of challenges started and completed

Your display name, avatar and progress are visible to your friends and, in the cohort leaderboard, to other users who started in the same week.

Analytics

We use PostHog to understand how features are used, for example whether a share button is tapped, an invite link is opened or a milestone is reached. These events are not linked to your name, email or account. PostHog records an anonymous device identifier, device model, operating system and app version, and may use your IP address to estimate your approximate location.

Purchases

In-app purchases are processed by Apple. We use RevenueCat to manage them; RevenueCat receives an anonymous app user identifier, your purchase history and device information. We never see your payment details.

Notifications

Daily reminders are scheduled on your device. You can turn them off in the app or in iOS Settings.

Processors and transfers

• Google Firebase (authentication and database): privacy
• PostHog (analytics, US region): privacy
• RevenueCat (purchases): privacy
• Apple (sign-in and payments): privacy

These providers may process data outside your country, including in the United States. Where EU law applies, transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.

Legal bases (EU/EEA users)

Account, sync and purchases: performance of our contract with you (Art. 6(1)(b) GDPR). Analytics and security: our legitimate interest in improving the app (Art. 6(1)(f) GDPR).

Retention and deletion

You can delete your account at any time in the app (Profile, Delete Account). This removes your profile, progress and friendships from our servers. Data on your device is removed when you delete the app. Analytics events are kept for up to one year.

Your rights

You can ask for access to, correction, deletion or a copy of your data, and object to or restrict its processing. You can also complain to a data protection authority. Email support@pocketapps.studio.

Children

Protocol66 is not intended for children under 13, and we do not knowingly collect their data.

Changes

We update this policy when the app changes, and change the date at the top.