Privacy Policy

1. Who this policy covers

This policy explains how Ritlum ("Ritlum," "we," "us," or "our") handles information when you use the Ritlum iOS app, the Ritlum widget, a Ritlum desk tracker, or ritlum.com. Ritlum is the controller of personal data described in this policy. You can contact us at contact@ritlum.com.

2. Information we handle

Data stored on your device

The app may store:

• Habit names, icons, colors, goals, schedules, reminders, streaks, and completion history, including counts, durations, and timestamps.
• NFC tag identifiers and the habits you link to them.
• Paired Ritlum tracker information and preferences, such as its device identifier, name, firmware version, brightness, display configuration, and recent connection status.
• App preferences and a limited habit-progress snapshot shared with the Ritlum home-screen widget through Apple's App Group storage.

This information is stored using Apple's on-device storage technologies. Local reminders are scheduled through Apple's notification system. Ritlum does not receive the content of a notification merely because it appears on your device.

Account and cloud-sync data

You can use Ritlum without an account. If you choose Apple or Google sign-in, we receive an account identifier, your chosen sign-in provider, and any account information that provider makes available for authentication, which may include your email address and name. Authentication sessions are stored securely in your device Keychain.

While you are signed in, your habit data, completion history, NFC links, and Ritlum tracker settings are associated with your account identifier and synced through Supabase so they can appear on your other devices.

Purchases

Purchases are processed by Apple through StoreKit. We do not receive your full payment-card details. The app receives product, entitlement, and transaction-status information needed to provide and restore paid features.

Website and waitlist data

If you join the waitlist on ritlum.com, we collect the email address you submit so we can send the promised launch message. Our hosting and infrastructure providers may also process ordinary technical request data such as IP address, browser type, requested page, and timestamp for delivery, security, and reliability.

We use Google Analytics on ritlum.com to understand how visitors find and use the site. Google Analytics sets cookies and processes information such as your IP address, browser and device type, pages viewed, and how you arrived at the site. We have not enabled Google Signals or ad personalization, so this data is not used to build cross-site advertising profiles. Ritlum does not currently use the website or app for behavioral advertising or cross-site tracking.

3. Why we use information

We use information only as needed to:

• Provide habit tracking, history, statistics, reminders, widgets, NFC check-ins, and Ritlum tracker features.
• Authenticate you and sync your selected app data across devices.
• Process and restore purchases.
• Send the waitlist launch email you requested.
• Maintain security, prevent abuse, troubleshoot problems, and meet legal obligations.

We do not sell or rent personal data. We do not use it for third-party advertising, data-broker profiling, or automated decisions that produce legal or similarly significant effects.

4. Legal bases in the EEA and UK

Where data-protection law requires a legal basis, we rely on:

• Performance of a contract to provide the app, sync, account, hardware, and purchase features you request.
• Consent for optional permissions and communications, such as notifications and the launch waitlist. You may withdraw consent at any time.
• Legitimate interests in keeping Ritlum secure, reliable, and free from abuse, where those interests are not overridden by your rights.
• Legal obligations where we must retain or disclose information under applicable law.

5. Service providers and sharing

We share data only where needed to operate the relevant feature:

• Apple for Sign in with Apple, StoreKit purchases, notifications, widgets, and platform services.
• Google, for Google sign-in (if you choose it) and Google Analytics to measure website traffic on ritlum.com.
• Supabase for authentication, cloud storage, realtime sync, and waitlist storage.
• GitHub Pages to host ritlum.com, and unpkg to deliver code used by the main website.

These providers process data under their own terms and privacy notices and are expected to provide protections consistent with applicable law. We may also disclose information if required by law, to protect rights or safety, or as part of a business transfer subject to appropriate safeguards. We do not permit service providers to use app data for their own advertising.

Some providers may process data outside your country, including outside the EEA or UK. Where required, those transfers rely on an adequacy decision, standard contractual clauses, or another lawful transfer mechanism.

6. Retention and deletion

• On-device data remains until you delete it in the app or remove the app and its data from your device.
• Cloud-sync and account data is kept while your account is active and until it is deleted or no longer needed to provide the service. Signing out stops sync on that device but does not delete cloud data.
• Waitlist email addresses are kept until the launch message has been sent, you ask us to remove the address, or the waitlist is discontinued.
• Security and infrastructure logs are retained according to the service provider's normal schedule and only as long as reasonably needed for security, reliability, or legal obligations.

To request deletion of your account and associated cloud data, email contact@ritlum.com from the address connected to your account, or include enough information for us to verify the request. We will remove data from active systems without undue delay, unless retention is required by law. Residual copies may remain temporarily in backups until those backups are overwritten.

7. Your choices and controls

• Use the app without signing in to keep habit data local to your device.
• Sign out to stop cloud sync on that device. Contact us to delete the cloud account and data.
• Change notification permission in iOS Settings and reminder settings in the app.
• Unlink NFC tags or disconnect a Ritlum tracker in the app. NFC and Bluetooth access is used only when you choose related features.
• Ask us to remove your waitlist email at any time.
• Opt out of Google Analytics using Google's browser opt-out add-on, or by blocking cookies in your browser settings.

8. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, and to receive a portable copy. Where processing is based on consent, you may withdraw that consent. You may also have the right to complain to your local data-protection authority.

Email contact@ritlum.com to exercise a right. We may need to verify your identity before completing a request.

9. Security

We use reasonable technical and organizational safeguards designed to protect information, including platform security, encrypted network connections, access controls, and account-scoped cloud permissions. No system is completely secure, so we cannot guarantee absolute security.

10. Children

Ritlum is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data, contact us so we can review and delete it where appropriate. Higher minimum ages may apply in some countries for account-based features.

11. Changes to this policy

We may update this policy as Ritlum changes. We will post the revised version here and update the effective date. If a change materially affects how we use personal data, we will provide additional notice where required.