Privacy Policy

SelfMastery is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS].

Questions about this policy or your data: [PRIVACY CONTACT EMAIL].

Information you give us. Your email address, so we can identify your account, sign you in and send password resets. The name you choose to be called. Your password — stored only as a bcrypt hash, so we never see or store the password itself.

What you write. Your goal and why it matters, your Day 30 success definition, the time you have available, the obstacles you identify, your daily reflections and notes, weekly review answers, and any priorities you add.

What the app records as you use it. Which actions you complete and when, which days used a Minimum Day, which days you finished, and the adjustments made to your plan along with the reasons for them.

Stored only on your device. Your theme choice and reminder settings never reach us. Your session token is held in the iOS Keychain.

We do not collect location, contacts, photos, camera or microphone data, health or fitness measurements, financial account details, advertising identifiers, or any cross-app or cross-site activity.

Two are worth stating plainly, because the goals we support might suggest otherwise. A fitness goal produces text like “Walk for 20 minutes” — there is no measurement and no HealthKit. A money goal produces prompts like “Record what you spent today” — we never see amounts, accounts or institutions.

We do not ask for App Tracking Transparency permission, because we do not track.

Your reflections, goals and reasons are the most personal thing SelfMastery holds, and we treat them accordingly:

• They are shown back only to you.
• They are never sold, shared or published.
• They are not used to train machine-learning models.
• Their contents are not written to our application logs.
• They are permanently deleted when you delete your account.

We do not sell your data and we do not share it for advertising. We use these processors to run the service:

We may also disclose data where legally required, or to protect the rights and safety of our users.

• All traffic uses HTTPS.
• Passwords are hashed with bcrypt and never stored in plain text.
• Session tokens are stored hashed on our servers and in the Keychain on your device, so a database leak does not hand over live sessions.
• Signing out revokes that device's token. Changing your password revokes every session.
• Every request is checked against the account that owns the data.

No system is perfectly secure, and we do not claim otherwise.

Your data is kept while your account exists. When you delete your account it is deleted immediately and permanently. Backups containing your data are overwritten on their normal rotation of [BACKUP RETENTION PERIOD].

You can delete your account at any time from inside the app: Profile → Delete account.

You will be shown exactly what is removed and asked to confirm with your password. Deletion removes your account and all associated data — challenges, daily actions, completion history, reflections, weekly reviews and sessions.

It is permanent, immediate, and cannot be undone. There is no deactivation alternative, and you do not need to contact us to do it.

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, and to data portability, as well as the right to complain to a supervisory authority ([RELEVANT DATA PROTECTION AUTHORITY]).

To exercise any of these, email [PRIVACY CONTACT EMAIL]. Deletion is available immediately in the app without contacting us.

SelfMastery is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact [PRIVACY CONTACT EMAIL] and we will delete it.

If this policy changes materially we will update the date above and notify you in the app or by email before the change takes effect.