Privacy Policy

1. Information We Collect

We collect your name, email address, and password (stored as a bcrypt hash) when you register. We also collect usage data such as quest completions, XP, streak counts, and subscription status to operate the service.

2. Health Data (Steps & Active Calories)

If you enable the activity card on your dashboard, Zenhabicto requests permission to read your step count and active calories burned for the current day from Google Health Connect (Android) or Apple Health (iOS).

• Access: We only read this data; we never write to Health Connect or Apple Health.
• Use: It is used solely to display your daily steps and estimated calories burned on the in-app dashboard, to support your gym/habit tracking.
• Storage & sharing: This health data stays on your device and is not uploaded to our servers, not shared with any third party, and not used for advertising or analytics.
• Control: Granting this permission is optional — declining it just hides the activity card and does not affect any other feature. You can revoke access at any time via Android Settings → Health Connect → App permissions, the Apple Health app → Sharing → Apps, or your phone's app permission settings.

3. Location & Community Routes

When you track a session (run, walk, hike, ride or swim), Zenhabicto uses your phone's GPS to trace your route and measure distance, including while the screen is locked, until you finish. Location is only used while the tracker is open or recording.

• Your sessions: the sport, distance, duration and pace are saved to your account to award XP and show your history.
• Community route map: if “Add my route to the map” is on (the default; you can turn it off on the tracker), your GPS trace is added to the shared route map. The first and last 150 m are cut off so your start and finish, often your home, are never shown. Routes are stored by place, not by person: other users see the route line and how many people and sessions used it, never your name or profile.
• City labels: to name a new route's city, a rounded location (about 1 km precision) from the route is sent to OpenStreetMap's Nominatim service. No account details are sent.
• Map tiles: the map is loaded from OpenStreetMap, which sees your IP address and the map area being viewed.

4. How We Use Your Information

Your data is used solely to provide and improve Zenhabicto — powering your habit dashboard, leaderboards, and Premium subscription. We do not sell your personal data to third parties.

5. Payments

Payments are processed by Razorpay. We do not store your card details. 60% of every Premium rupee is forwarded to youth football academies; this split is tracked transparently in the app's Impact section.

6. Account Deletion & Data Retention

Your account data is retained for as long as your account is active. You can permanently delete your account and its data yourself, at any time, with immediate effect:

• In the app: Settings → Delete Account (requires your password to confirm).
• On the web: your Dashboard → Danger zone → Delete account.
• By email: if you can't log in, email zenhabicto@gmail.com from your account's address and we'll delete it for you.

Deleting your account immediately and permanently removes your profile, quests, posts, friend requests, device tokens, and notifications. Payment, subscription, and donation records are kept after deletion — this is required for accounting/tax purposes and to keep the public donation-transparency ledger (the Impact numbers) accurate and immutable; these records are no longer linked to your name or login credentials once your account is deleted.

Routes you shared to the community map stay on the map after you delete your account. They are stored by place with only anonymous counts, and your sessions are unlinked from them.

7. Security

Passwords are hashed with bcrypt (12 rounds). Refresh tokens are stored as SHA-256 + bcrypt hashes. Access tokens expire in 15 minutes. We use HTTPS for all data in transit.

8. Community Reports

If you report another user for violating community guidelines, the report (including your user ID and the reason) is stored and reviewed by our admin team. Reporters are not publicly identified.

9. Contact

Questions? Use our contact form, or email us at zenhabicto@gmail.com.