Privacy notice

Who is responsible for your data

Henk Oelofse, trading as 90 Days in South Africa, is the data controller for 90 Days. For anything in this notice, write to hoelofse11@gmail.com.

What we collect

• Account data: your email address, your password in encrypted form, or your Google account identifier if you sign in that way.
• Profile data: the display name you choose, whether you want to stay anonymous, and whether you signed up to help others.
• Recovery data you enter: your daily marks, streak, completed exercises, check-in answers, the reasons and consequences you write down, and your private record entries. Some of this describes a sensitive personal habit, so it is treated as sensitive data; you decide what to write and you can leave any field empty.
• Community content: posts you make in the rooms, one-to-one chat messages, and reports you send about other members.
• Payment data: your subscription status, period dates, and the customer and subscription identifiers given to us by PayPal. We never see or store your card number.
• Technical data: basic logs and error reports needed to keep the app running.

Why we use it

To give you an account, run the 90-day program and your streak, show your posts to the members you post to, keep the rooms safe through moderation, take payment for Plus, and fix problems. Where the data is sensitive, we rely on your clear, informed consent, which you give by choosing to write it. You can withdraw it by deleting the entries or asking us to delete your account.

• Contract: account access, saved progress, support and Plus delivery.
• Consent: sensitive recovery notes you choose to enter and optional faith settings.
• Legitimate interests: security, fraud prevention, moderation, service reliability and improvement.
• Legal obligation: tax, accounting, lawful requests and consumer-protection records.

We do not use sensitive recovery information for advertising, profiling, or automated decisions with legal or similarly significant effects.

Who we share it with

• PayPal: our payment provider. PayPal receives your email address and purchase details in order to take payment, send receipts and handle refunds.
• Supabase: the hosted database and login service that stores your account and content.
• Lovable: hosting for the app itself, and the AI service that screens new community posts for graphic or unsafe content before they appear.
• Google: only if you choose to sign in with Google.
• Other members: only what you deliberately post or send in a chat, under the display name you chose.
• Professional advisers and authorities: lawyers, accountants, regulators or law enforcement where reasonably necessary or legally required.

We do not sell your data, and we do not use it for advertising. Some of these providers are outside South Africa, so your data may be processed abroad under standard contractual protections.

International transfers

Some service providers process information outside South Africa. Where information is transferred internationally, we use providers with contractual safeguards and require protection consistent with applicable data-protection law. You may ask us for more information about the safeguards relevant to your data.

How long we keep it

Your account data and content are kept while your account is open. If you ask us to delete your account, we remove your profile, posts, chats and recovery data within 30 days, subject to encrypted backup rotation and records we must retain for legal claims, fraud prevention or compliance. Routine service logs are normally retained for up to 90 days. Support correspondence is normally retained for up to two years after resolution. Payment and transaction records are kept by PayPal for as long as tax and financial law require. Aggregated information that can no longer identify you may be retained.

Your choices

You can see and edit what you have written inside the app, download it from the Plus screen, delete individual posts, and ask us to correct or delete everything. Write to hoelofse11@gmail.com and we reply within 30 days. You may also complain to your local data protection authority.

Depending on the law that applies to you, these rights may include access, correction, deletion, restriction, portability, objection, and withdrawal of consent. Withdrawing consent does not make earlier lawful processing invalid. We may ask for information to verify your identity before acting on a request. South African users may complain to the Information Regulator; users elsewhere may contact their local supervisory authority.

Keeping it safe

Data is sent over encrypted connections and stored with access controls so that each account can only reach its own check-ins. Passwords are stored hashed, never in plain text. Community posts are screened before they appear, and one human moderator reviews reports. No system is perfect, but we take appropriate technical and organisational measures to protect what you write, and we will tell you if a breach affects you.

Storage on your device

The app keeps your streak and settings on your own device so it works offline, and uses a login token to keep you signed in. We do not use advertising or tracking cookies. The wider terms explain the rest of the service.

Essential local storage and authentication cookies remember your session, preferences and offline progress. They are necessary for the app to work. We do not use marketing cookies. You can clear stored data through your browser or device settings, although doing so may sign you out or remove progress not yet synchronised.

Children

90 Days is for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided information, contact hoelofse11@gmail.comso we can investigate and remove it.

Changes and contact

We may update this notice when the service or law changes. The latest version and date remain available here, and we will provide a prominent notice for material changes. Privacy questions and rights requests should be sent to hoelofse11@gmail.com.