プライバシーポリシー

1. Who is responsible for your data

Authis is made and operated by André Santana Ferro, an individual developer resident in Brazil. Under the Lei Geral de Proteção de Dados (LGPD) I am the controlador of the personal data described here, and under the GDPR I am the data controller.

Contact for anything in this policy, including exercising your rights: authis@andreferro.dev

I am one person, not a company. I answer these messages myself.

---

2. What Authis collects, and why

Authis is a habit tracker. Almost everything it stores is something you typed in yourself, because you wanted the app to remember it.

Your account

What you track

If you send feedback

The message you write, plus the app version, your operating system (ios or android) and the language the app was set to. Your email address is deliberately not copied into the feedback record.

If you subscribe

Apple or Google takes the payment. Authis never sees your card, your billing address, or even the purchase receipt. Through RevenueCat, the service that manages subscriptions, the server learns only: which subscription you hold, which store it came from, whether it is a trial, when it expires, whether it is set to renew, whether the store has reported a billing problem, and the store link where you can manage it.

There is no price, no amount, no transaction number and no payment method in any of that.

Technical information

Every request the app makes carries the app’s version number, so the server can refuse a build that is too old to work correctly.

Your IP address reaches the server the way it reaches any website. It is used only to apply rate limits — to stop one source flooding the service — and it is held in memory for that purpose alone. It is never written to the database and never written to application logs.

---

3. About sensitive information

This section matters more than the rest, so it is written plainly.

A habit tracker gets used for medication, therapy appointments, exercise, drinking, smoking, and recovery. Habit descriptions and daily notes are free text: you can type anything into them, and Authis stores exactly what you type.

What I want you to understand:

• Authis never asks you for health information. There is no health field, no health question, and no connection to Apple Health, Google Fit or any health service.
• Nothing is inferred from what you write. No profiling, no categorisation, no analysis of your notes. They are stored and shown back to you.
• But whatever you type is stored. If you write “took 300mg lithium” in a note, that sentence is in the database, and it is on your phone.

Under LGPD art. 11 and GDPR art. 9, information revealing health is a special category. Where you choose to put such information into a free-text field, you are doing so on your own initiative and the processing rests on that explicit choice. If you would rather that information were not stored, do not type it into the note. A habit named “Morning routine” tracks just as well as one named after a diagnosis.

---

4. Who else receives your data

Five companies, and nothing else. No data broker, no analytics company.

RevenueCat’s SDK inside the app also reads identifiers of its own as part of managing purchases — Apple’s vendor identifier on iOS, and on Android the Play Store “install referrer”, which tells them which listing or campaign an install came from. That is their processing, described in their own privacy policy. It is used to attribute purchases, not to track you across other apps.

I do not sell your data. I have never sold it and there is no arrangement under which it could be sold.

---

5. What Authis does not do

Each of these is verifiable in the source code, not a promise of intent:

• No analytics. No Google Analytics, Firebase Analytics, Amplitude, Mixpanel, PostHog, Segment, or anything comparable.
• No crash or error reporting service. No Sentry, no Crashlytics, no Bugsnag.
• No tracking across apps or websites, by me or by anyone I share data with. The app requests no tracking permission, because it does not track you: advertising here is non-personalized, and there is no App Tracking Transparency prompt because there is nothing to ask for.
• No cookies. Authis has no website and no web app; it is a phone app talking to an API.
• No location, and no timezone. The server stores reminder times as a plain clock reading with no zone attached, specifically so it never learns where you are.
• No push notifications, and no push token. Reminders are scheduled by your phone, on your phone. Nothing is sent from a server to trigger them, and no notification token exists.
• No marketing email. The server can send exactly two messages: confirm your address, and reset your password. There is no newsletter and no mechanism to send one.

---

6. Advertising

A free account sees one banner at the foot of the screen. A premium account sees none — that is most of what you are paying for.

The ads are non-personalized. They are chosen from the content of the app and, at most, the city-level location your IP address implies. They are not chosen from anything you do in Authis, anything you have done in other apps, or any profile of you. Nothing you track is ever sent to an advertiser: your habits, notes and history do not leave the server described in section 4.

An advertising identifier is still involved, and it is worth being precise about why. Non-personalized does not mean identifier-free. Google uses a device advertising ID to cap how often you see the same ad and to detect fraudulent clicks, even when the ad itself is not targeted at you. That is the honest description, and it is the reason this section exists rather than a sentence saying “we don’t track you” and leaving it there.

In Europe you will be asked first. Before any ad is requested, Google’s consent form appears and your answer is recorded. If you refuse, or the form cannot load, no ad is requested at all. You can reopen those choices at any time from the same form.

You can remove advertising entirely by subscribing, and that is the only thing that removes it.

---

7. International transfers

I am in Brazil. The hosting and the two service providers above are in the United States, so your data is transferred outside Brazil and, if you are in Europe, outside the EEA.

Those transfers happen because the service cannot run otherwise, and they rely on the providers’ own standard contractual terms for international transfer. Under LGPD art. 33 the transfer is necessary for the performance of the contract you entered into by creating an account.

---

8. What is stored on your phone

Authis keeps a copy of some of your data on your device so it works offline.

Stored encrypted, in the iOS Keychain or the Android Keystore: your sign-in token, and nothing else.

Stored unencrypted, in the app’s ordinary storage:

• your email address and display name
• your habits, including names and descriptions
• the last 30 days of daily entries, including your notes
• changes you made while offline, waiting to be sent
• your preferences: language, theme, whether reminders are on

This is a normal app cache, and it is not readable by other apps. It is readable by anyone who has your unlocked phone, or a backup of it. On Android it can be included in a Google device backup.

It is cleared when you sign out deliberately. It is not cleared when a session simply expires — that is intentional, so work you did offline is not lost before it can be sent. It is discarded automatically after 14 days unread, and when you sign in as a different person.

Reminders show the habit’s name on your lock screen, so it is visible to anyone who can see your screen. Name a habit accordingly if that matters to you.

---

9. How long it is kept

Everything Authis holds about you is kept for as long as your account exists, and is deleted with it. Deleting your account removes your habits, entries, notes, rest days, feedback, subscription record and sign-in links, in one cascade. Nothing of yours is retained in the database afterwards.

Two automatic exceptions, both small: used or expired sign-in links are cleared after 24 hours, and an account that is created but never confirmed is removed after 7 days.

What deleting your account does not reach, stated plainly because no policy should claim otherwise:

• RevenueCat keeps its own subscription record against your former account identifier, under their retention policy.
• Resend keeps its record of emails it delivered, under theirs.
• Server logs may contain your account’s random identifier for as long as the host retains logs. They contain no email address, no name, and nothing you tracked.

---

10. Your rights

Under LGPD art. 18, and under GDPR Chapter III if you are in Europe, you can ask me to:

• confirm whether I hold data about you, and access a copy of it
• correct anything incomplete or wrong
• delete your data
• explain who it has been shared with
• object to processing, or ask that it be restricted
• take it elsewhere in a portable form
• withdraw consent where consent is what the processing rests on

Write to authis@andreferro.dev. I will answer within 15 days, as LGPD requires, and within a month where the GDPR applies.

Two honest limitations:

Your email address cannot be changed in the app. There is no screen for it, because the address identifies the account. Write to me and I will change it for you.

You cannot delete your account while a subscription is still set to renew. The app will refuse, and this is deliberate rather than an obstruction. Apple gives no way for a developer to cancel someone’s subscription on their behalf, so deleting your account would remove every record of the subscription while the charges continued. Cancel in the App Store or Play Store first — the app links you straight there — and then delete. If you would rather I handled it, write to me.

You also have the right to complain to Brazil’s ANPD, or to your local supervisory authority in Europe.

---

11. Security

Specific measures, rather than a claim to be “industry standard”:

• Passwords are hashed with bcrypt and never stored as text. The hash is excluded from every database read except the one that checks your password.
• Sign-in links sent by email are stored only as a SHA-256 digest. The link in your inbox exists nowhere else, so a copy of the database does not let anyone use one.
• Confirmation links expire after 24 hours, password reset links after one hour, and each can be used once.
• Resetting your password signs out every other device.
• Connections use HTTPS, terminated by the host.
• Sign-in, registration and email endpoints are rate limited, and there is a cap on how many emails any one address can be sent in a day.
• Every part of the API requires a valid sign-in token by default.

No system is perfectly secure, and I will not pretend otherwise. If you find a vulnerability, please write to me before disclosing it publicly.

---

12. Children

Authis is for people aged 13 and over. Where local law sets a higher age for consenting to online services without a parent — 16 in several European countries — that higher age applies.

I do not knowingly collect data from children below that age. If you believe a child has created an account, write to me and I will delete it.

---

13. Changes to this policy

If this policy changes in a way that affects you, the new version will be published here with a new effective date, and the app will tell you about material changes before they take effect. The history of every change is visible in this repository.

---

14. Contact

André Santana Ferro — authis@andreferro.dev

For anything about this policy, your data, or your rights.