Privacy Policy.
Last updated: May 26, 2026
1. Who we are
streak. is a daily discipline tracking application developed and operated by Julius Petrik, a sole trader (živnostník) registered in the Slovak Republic, IČO: 09412859 ("we", "us", or "our"). We are the data controller for all personal data processed through the streak. mobile application and the streak.app website.
For any privacy-related enquiries, contact us at hello@streak.app.
2. Data we collect
We collect only what is necessary to provide the service. The categories of data we process are:
Account data
- Email address
- Password hash (stored by Supabase — we never see your plaintext password)
- Display name (optional)
- OAuth tokens when you use Sign in with Apple or Sign in with Google (we store only the opaque user identifier, not your Apple/Google password)
Activity data
- Challenges you create: name, emoji, type, frequency, duration
- Check-in records: which challenge, on which date, via timer or manual tap
- Focus session records: start time, planned duration, actual duration, completion status
- Optional notes attached to check-ins (max 280 characters)
- Public challenge participation: which public challenges you join, current streak within that challenge
Device and usage data
- Device model and operating system version
- App version
- Push notification token (for sending reminders)
- Session frequency and feature-usage events (anonymised, used to improve the product)
- Crash and error reports (anonymised stack traces, no personal data included)
Payment data
All payment processing is handled by Stripe. We never store or have access to your card number, CVV, or full payment details. We receive only a Stripe customer ID and subscription status.
3. Why we collect it
| Purpose | Lawful basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Delivering the streak tracking and focus timer features | Performance of a contract (Art. 6(1)(b)) |
| Processing your subscription payment via Stripe | Performance of a contract (Art. 6(1)(b)) |
| Sending push notifications (reminders, streak milestones) | Consent (Art. 6(1)(a)) — opt-in only |
| Generating AI-powered weekly insights and nudges (Pro tier only) | Performance of a contract (Art. 6(1)(b)) |
| Analysing anonymous usage to improve the product | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations (e.g. accounting, fraud prevention) | Legal obligation (Art. 6(1)(c)) |
4. Third-party services
We share data with the following processors to operate the service. Each is bound by a data processing agreement.
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Database, authentication, edge functions | All user and activity data | EU (AWS eu-central-1) |
| Stripe | Payment processing | Email, subscription tier | US (Standard Contractual Clauses apply) |
| Anthropic | AI-generated insights (Pro only) | Anonymised check-in statistics (no names, no emails) | US (Standard Contractual Clauses apply) |
| Apple | Sign in with Apple, push notifications (APNs) | Apple user ID, push token | US/EU (Apple DPA applies) |
| Sign in with Google | Google user ID, email | US/EU (Google DPA applies) |
We do not sell your personal data to any third party. We do not use your data for advertising purposes.
5. Your GDPR rights
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — request deletion of your account and all associated data. You can initiate this from Settings → Delete Account inside the app. We apply a 30-day grace period before permanent deletion.
- Right to data portability — export all your data as a JSON file from Settings → Export Data. The export includes all challenges, check-ins, and focus sessions.
- Right to restriction — ask us to suspend processing of your data in certain circumstances.
- Right to object — object to processing based on legitimate interest (e.g. anonymous analytics). We will stop unless we have compelling legitimate grounds.
- Right to withdraw consent — where processing is based on consent (push notifications, cookies), you can withdraw at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email hello@streak.app. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
6. Data retention
We retain your data for as long as your account is active. When you delete your account:
- Your account is soft-deleted immediately — it becomes invisible and inactive. You can reactivate within 30 days by contacting us.
- After 30 days, all data is permanently and irreversibly deleted — account, challenges, check-ins, focus sessions, notes, and any associated files.
- Stripe retains payment records for their own legal obligations (typically 7 years); we have no control over this.
- Anonymised, aggregated analytics (with no link to your identity) may be retained indefinitely.
7. Cookies
The streak.app website uses a single analytics cookie to understand aggregate visitor behaviour (pages visited, session duration, referral source). No personal profile is built; the data is anonymised.
We obtain your consent via the cookie banner shown on your first visit. You can withdraw consent at any time by clicking "Decline" in the banner or clearing your browser cookies. Declining does not affect your ability to use the website.
The streak. mobile app itself does not use cookies.
8. Push notifications
The app sends push notifications for daily reminders, streak milestones, and (optionally) public challenge updates. We request OS-level notification permission only after you create your first challenge or on your second app launch — never on first open.
You can disable push notifications at any time from your device's Settings app or from within streak. → Settings → Notifications. Disabling notifications does not affect any other app functionality.
9. Children
streak. is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with their data, please contact us at hello@streak.app and we will delete the data promptly.
Users in the EEA must be at least 16 years old, or have verifiable parental consent, to create an account.
10. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notice at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Continued use of streak. after the effective date of a revised policy constitutes acceptance of the new terms.
11. Contact
For any questions, requests, or concerns regarding this Privacy Policy or your personal data:
- Email: hello@streak.app
- Company: Julius Petrik, živnostník, IČO: 09412859, Slovak Republic
We aim to respond to all privacy requests within 30 days.