Privacy Policy
This policy explains how Steffin Xavier L S, trading as Winter Arc, London, UK (the “controller”), uses your personal data, in line with the UK GDPR and the Data Protection Act 2018. Contact: support@winterarc.life.
What we collect
- Account data: your name, email address and a securely hashed password, or your Google sign-in identity if you use it.
- Tracker data: the habits, goals, tasks, journal entries, mood, sleep and weight you choose to enter. Some of this, such as weight and mood, can relate to your health. We use it to show it back to you and never share it. To support you, we can see counts worked out from it (how many habits you track, days you logged, your average score) but not what you wrote.
- Purchase data: your plan, its status and Paddle's reference IDs. Paddle collects your payment details and billing address as Merchant of Record; we never see your card number.
- Usage data: a few named moments, such as which onboarding step you reached, when the paywall was shown, when you started checkout or sealed a day, and when you last opened the app. These never include your habit names, notes or anything you type into the tracker. Before you have an account they are linked only to a random ID that lives in the open page and is never stored on your device.
- Support and feedback: messages you send us, and the reason you choose to give if you cancel.
- Technical data: basic server logs (IP address, browser type) kept for security.
Why we use it, and our lawful basis
- To run your account, sync your data and provide what you paid for: performance of a contract.
- Your health-related entries: your explicit consent, given when you choose to log them. You can delete any entry at any time.
- To keep the Service secure and prevent abuse, to answer support messages, and to understand where people get stuck so we can improve the Service: legitimate interests.
- To keep transaction records: legal obligation (tax and accounting).
We don't sell your data, show ads, or use tracking or analytics cookies. Only we can read usage data, support messages and cancellation reasons.
Cookies and storage
We only use storage that is strictly necessary for the app to work: keeping you signed in and a copy of your data on your device so it works offline. These need no consent banner. Paddle sets its own cookies when you open checkout. See Paddle's privacy policy.
Who processes it for us
- Supabase: database and sign-in. Data is hosted in London, UK (eu-west-2).
- Paddle: payments and tax, as an independent controller for payment data.
- Vercel: website hosting.
Where a provider processes data outside the UK, it is protected by UK-approved safeguards such as the International Data Transfer Addendum.
How long we keep it
We keep your data while your account exists. When you delete your account, your profile and tracker data are erased straight away. Records of payments are kept for 6 years, as HMRC requires.
Your rights
You can access, correct, export or delete your data, object to or restrict how we use it, and withdraw consent at any time. You can export from Me → Export backup, edit in the app, and delete from Me → Account → Delete account. For anything else, email support@winterarc.life; we reply within one month. You can also complain to the Information Commissioner's Office.
Children
The Service is for people aged 18 and over.
Changes
We'll post updates here and tell you about material changes.