Privacy Policy

1. Introduction and Data Controller

Welcome to SIP — Smart Intake Progress. We take the protection of your personal data seriously. This Privacy Policy explains what data we collect, on which legal basis, how we use it, and the rights you have under applicable law — including the European General Data Protection Regulation (GDPR) and Ecuador's Ley Orgánica de Protección de Datos Personales (LOPDP, 2021).

The controller responsible for processing your personal data is:

For all privacy-related questions or requests please contact us at the email above. We will respond within 30 days.

2. Data We Collect

2.1 Data you provide directly

• Account credentials (email address, display name) when you sign up via Firebase Authentication.
• Profile data: age, gender (biological sex), weight, height, and activity level — used exclusively to calculate your personalized hydration goal.
• Hydration logs: beverage type, volume (ml), and timestamp of each drink entry. Stored only on your device — never uploaded to our servers.
• Custom beverages you create, and a rewards summary (streaks, unlocked achievements, total volume) — saved to your account when you are signed in so you can restore them on another device.
• Notification preferences and wake/sleep schedule.
• Feedback messages voluntarily submitted through the in-app form.

2.2 Data collected automatically

• Device type and operating system version (iOS / Android).
• App version and build number (included in crash reports and feedback).
• Approximate location (used only to fetch local weather data for Smart Climate when you explicitly enable it; we do not store GPS coordinates).
• Activity data (activity intensity and calories burned) read from Apple Health or Google Health Connect — only when you explicitly grant Health permissions in your device settings.
• Anonymous crash diagnostics (stack traces, device state) collected via Firebase Crashlytics when the App unexpectedly closes.

3. Contact Data Processing

When you contact us by email or through the in-app feedback form, we collect and store the content of your message together with the email address you provide (if any).

This data is used solely to process and respond to your inquiry. It will be deleted once the matter is fully resolved, unless we are legally required to retain it longer.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in responding to communications directed at us; Art. 6(1)(b) GDPR for requests relating to a contract.

4. Contract Processing & Third-Party Services

We share personal data with third-party processors strictly to deliver the App's core functionality. Each processor has contractual obligations to protect your data. Legal basis: Art. 6(1)(b) GDPR (performance of contract).

• 🔥
  Firebase — Google LLC

  Art. 6(1)(b) GDPR

  Firebase Authentication: Manages account creation and login. Stores your email and a unique user ID.
  Cloud Firestore: Only when you are signed in, stores your settings (profile, goal, preferences), your custom beverages and a rewards summary (streaks, achievements, total volume) so they can be restored on another device. Your hydration logs, daily goal history and activity data are not uploaded — they stay on your device.
  Firebase Crashlytics: Collects anonymous crash reports to help us fix bugs. Data: device model, OS version, app version, stack trace, UUID. No personally identifiable information is linked to crash reports. You can disable crash reporting in App Settings.

  firebase.google.com/support/privacy ↗
• 💳
  RevenueCat, Inc.

  Art. 6(1)(b) GDPR

  Handles SIP Pro subscription management, purchase validation, and entitlement status. RevenueCat receives anonymized purchase receipts from Apple or Google — it does not access your hydration data, health data, or profile. An Order Processing Agreement is in place.
  Provider: RevenueCat Inc., 300 Euclid Avenue, San Francisco, CA 94118, USA.

  revenuecat.com/privacy ↗
• 📦
  ObjectBox — On-Device Database

  On-device only

  ObjectBox stores your hydration logs, daily goal history, activity data and settings locally on your device. Hydration logs and activity data never leave your device. Only your settings, custom beverages and rewards summary are copied to Firestore, and only while you are signed in. ObjectBox GmbH does not have access to your data.

  objectbox.io/privacy-policy ↗
• ❤️
  Apple HealthKit (iOS)

  Art. 6(1)(a) GDPR — explicit consent

  SIP reads activity intensity and calories burned from Apple Health to refine your goal. Access requires your explicit iOS system permission and can be revoked at any time via iOS Settings → Health → Apps → SIP. HealthKit data is read-only and never written back.

  apple.com/legal/privacy ↗
• 🤖
  Google Health Connect (Android)

  Art. 6(1)(a) GDPR — explicit consent

  On Android, SIP reads activity data from Health Connect. Access requires explicit system permission and can be revoked at any time via Android Settings → Apps → Health Connect → Permissions → SIP.

  support.google.com (Health Connect) ↗

5. Health Data Transparency

Health-related information — including body metrics, hydration logs, activity data, and workout history — is used solely to calculate your personalized daily hydration goal and display your personal progress. It is never uploaded to advertising platforms, data brokers, or analytics services, and it is not used to train machine-learning models.

Health data read from Apple Health or Google Health Connect, and your hydration history, are processed and stored only on your device. They are never uploaded to our servers.

Backup files (SIP Pro): when you export a backup, SIP creates a file on your device and you choose where to save or send it (for example, your own cloud drive). We never receive this file. You are responsible for where you store it and for deleting copies you no longer need.

6. Security and International Data Transfers

We implement appropriate technical and organizational measures to protect your data:

• On-device: Data stored by ObjectBox is protected by your device's built-in encryption (iOS Secure Enclave / Android TEE).
• In transit: All data transmitted to Firebase is encrypted via TLS 1.3.
• At rest (cloud): Firebase Firestore uses AES-256 encryption at rest.

Firebase (Google LLC) and RevenueCat are based in the USA. Data transfers to these providers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of protection for EU users pursuant to Art. 46 GDPR.

7. Data Retention

• Local data (ObjectBox): Persists on your device until you uninstall the App or use Settings → Delete Account. Signing out does not delete it.
• Cloud data (Firestore): Permanently and immediately deleted when you use the in-app account deletion flow, which requires re-authentication as a security measure.
• Firebase Auth records: Deleted immediately on account deletion.
• Crash reports (Crashlytics): Retained for 90 days per Google's policy, then automatically purged.
• Contact / feedback emails: Deleted once the inquiry is resolved unless legal retention obligations apply.

8. Your Rights as a Data Subject

Under the GDPR (and Ecuador's LOPDP) you have the following rights regarding your personal data. To exercise any of them, contact us at elvisloja@gmail.com. We will respond within 30 days.

• 1
  Right of Access (Art. 15 GDPR)You may request a copy of all personal data we hold about you.
• 2
  Right to Rectification (Art. 16 GDPR)You may request correction of inaccurate or incomplete data.
• 3
  Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)You may request deletion of your data. Exercisable directly in the App via Settings → Delete Account.
• 4
  Right to Restriction of Processing (Art. 18 GDPR)You may request that we restrict processing while a dispute about accuracy or lawfulness is resolved.
• 5
  Notification Obligation (Art. 19 GDPR)We will notify all recipients of your data about any rectification, erasure, or restriction, unless this proves impossible or involves disproportionate effort.
• 6
  Right to Data Portability (Art. 20 GDPR)You may export your full history as a backup file (JSON) or in CSV format via Settings → Export backup / Export for Excel (CSV).
• 7
  Right to Withdraw Consent (Art. 7(3) GDPR)Where processing is based on consent (e.g. Health permissions, Crashlytics), you may withdraw it at any time without affecting prior lawful processing.
• 8
  Right to Lodge a Complaint (Art. 77 GDPR)You have the right to file a complaint with the supervisory authority in your EU member state, or with Ecuador's data protection authority (DINARDAP), without prejudice to any other remedy.

9. Right to Object

You have the right to object at any time to the processing of your personal data.

Where we process data based on a balancing of interests (Art. 6(1)(f) GDPR — e.g. responding to unsolicited contact), you may object by contacting us. We will then cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.

Objection to direct marketing: If we ever use your data for direct marketing purposes, you may object at any time and we will immediately stop using your data for that purpose. No justification is required for this type of objection.

10. Children's Privacy

SIP is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy as the App evolves or as required by law. We will notify you of material changes by updating the "Last updated" date at the top and, for significant changes, by posting a prominent notice within the App. Continued use of SIP after changes are posted constitutes your acceptance of the updated policy.

12. Contact

For any questions, requests, or concerns about this Privacy Policy: