Privacy Policy

Information we collect

• Account details: your name, email address, username and a securely hashed password. If you sign in with Google, we receive your Google account ID, name, email address and profile photo from Google.
• Profile details you choose to add: bio, profile photo, social media links and your privacy setting (public or private).
• Stories: photos and win cards you post, their captions, who viewed them and who cheered them. Stories are deleted automatically 24 hours after you post them.
• Habit data: the habits you create (name, category, icon, weekly target, whether it is shown on your profile) and the days you check them in.
• Social data: who you follow, who follows you, follow requests, the cheers you send and receive, and your activity notifications.
• Notification token: if you allow notifications, a push token that identifies the HadBit app on your device, so we can deliver notifications to it.
• Technical data: your device's time-zone offset (so streaks use your local day), and IP addresses that our servers process to deliver the service and to prevent abuse (for example, rate limiting).

We do not use advertising or third-party analytics trackers in the app or on this website.

How we use your information

• To create and secure your account, and to sign you in.
• To store and sync your habits across your devices, including changes made while offline.
• To show your profile and progress to the people your privacy setting allows, and to power follows, the friends feed and shared links.
• To send account emails such as verification and password-reset codes.
• To send push notifications you can turn off at any time: when someone you follow completes every habit for the day, when someone cheers you on, and about follow requests and new followers. When you complete every habit for the day, your approved followers are told (without naming your habits).
• To keep the service safe, investigate abuse and comply with the law.

Who can see your information

Your username, name and profile photo are visible to other users and on your profile link. If your profile is public, anyone with your link can see the habits you mark "Show on my profile", your streaks and progress, and your social links. If it is private, only followers you approve can see them. Habits you hide from your profile are never shown to others. Your stories are visible to the same people who can see your progress, for 24 hours; you can see who viewed them and delete them at any time. Your email address is never shown to other users.

Service providers

We share information only with providers that help us run HadBit, and only as needed:

• Hosting: our servers and database run on a virtual private server provided by our hosting company.
• Email delivery: account emails are sent through Zoho Mail.
• Google: if you choose "Sign in with Google", Google authenticates you and shares the details listed above. Google's own privacy policy applies to your Google account.
• Firebase Cloud Messaging (Google): delivers push notifications to your device. It receives your device's push token and the text of each notification (for example "Priya cheered you on").

We do not sell or rent your personal information.

Security and encryption

All traffic between the app or your browser and our servers is encrypted with TLS. Personal fields (such as your name, email, bio, social links, habit names and story captions), profile photos and story images are encrypted at rest with AES-256-GCM using a key unique to your account; those keys are themselves encrypted with a master key kept separately from the database. Passwords are stored only as bcrypt hashes. This is encryption at rest, not end-to-end encryption: our servers decrypt data in order to provide the service.

Legal requests

We may disclose information when we are legally required to, for example in response to a valid court order. Access to decrypted data for this purpose is limited to an emergency procedure that only our administrator can start; each access is time-limited, tied to a single account and a stated reason, and recorded in an audit log.

Retention and deletion

We keep your information while your account exists. You can delete your account at any time in the app (Profile → Settings → Delete account) or by following the steps on our account deletion page. Deleting your account permanently removes your profile, habits, check-ins, follows, cheers, notifications, push tokens, stories and photos from our live systems straight away. Copies in server backups are removed within 30 days. Changes saved on your device but not yet synced are deleted when you sign out.

Your choices and rights

• Edit your name, username, bio, photo, social links and privacy setting at any time in the app.
• Hide any habit from your profile, remove followers and decline follow requests.
• Turn notifications off in your phone's settings for HadBit. Signing out removes your device's push token from our servers.
• Request a copy of your data, or ask any question about your privacy, by emailing support@lupinsync.tech from your account's email address.
• Delete your account as described above.

Children

HadBit is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has created an account, contact us and we will delete it.

Changes to this policy

If we make significant changes we will update the date above and, where appropriate, let you know in the app.

Contact

LupinSync (a brand of Bhoi Enterprises) · support@lupinsync.tech