Privacy Policy for THI – Today’s Happy Incident

THI (“the App”, “we”, “us”) is designed to help you build a happier daily routine by reflecting on small positive moments. Your privacy is important to us. This Privacy Policy explains how we handle your data.

Last updated: 26-11-2025

Company: Today’s Happy Incident

Contact: hello@todayshappyincident.com

Domain: todayshappyincident.com

1. Overview

This Privacy Policy explains how THI (“the App”) collects, uses, and protects your information.

We comply with:

• GDPR (EU privacy law)
• Apple App Store Guidelines
• Google Play Policies

We keep your data safe and never sell it.

2. What We Collect

A. Information you provide

✔ Email address (for account/login)

✔ Journal entries (THIs)

✔ Optional photos

✔ Avatar choices

✔ Password or OAuth token (securely managed)

B. Information collected automatically

✔ Device type

✔ App version

✔ Usage events (e.g., completed THI, flow streak)

✔ Subscription status (via RevenueCat)

C. Information from third parties

• Apple Sign-In / Google Sign-In (identifier only)
• RevenueCat purchase information
• Supabase database logs

We do not collect:

❌ health data

❌ contacts

❌ advertising identifiers

❌ GPS or precise location

❌ biometric information

❌ financial data (payment is handled by Apple/Google)

3. Why We Collect Data

We use data to:

• Provide the App’s core functionality
• Sync your THIs across devices
• Maintain your streak (“flow”)
• Save your settings and preferences
• Deliver premium features
• Improve the App
• Ensure security

We never use your data for ads.

Subscription information is processed solely to provide access to premium features and is never shared with advertisers.

4. Legal Basis (GDPR)

We process data based on:

• Contractual necessity (to provide the service)
• Legitimate interest (improving the App)
• Consent (for optional features like photos)

5. How We Store Your Data

Your data is stored securely in:

• Supabase (EU region)
• RevenueCat (purchase info only)

Data is encrypted in transit and at rest where possible.

We take reasonable steps to protect your data from unauthorized access.

Some service providers (such as RevenueCat) may process data outside the EU. When this happens, we ensure adequate protection measures such as Standard Contractual Clauses (SCCs).

We use industry-standard security practices, including encryption, access controls, and regular audits.

6. Sharing of Data

We share data only with:

✔ Service providers

• Supabase (data storage)
• RevenueCat (subscription management)

✔ Authentication providers

• Apple
• Google

✔ Legal authorities

Only if required by law.

We never sell data to advertisers.

7. Your Rights (GDPR)

You have the right to:

• Access your data
• Correct your data
• Delete your account and data
• Export your data
• Withdraw consent

To exercise these rights email: hello@todayshappyincident.com

We respond within 30 days.

When you request deletion, we verify ownership via your account email before removing data.

8. Data Retention

We retain your data as long as your account exists.

Upon deletion request → all journal entries and personal data are erased within 30 days.

9. Children

The App is not intended for users under 16.

We do not knowingly collect data from minors.

10. Changes to this Policy

We may update this policy occasionally.

Changes will be posted in the App and on the website.

11. Contact

For privacy questions:

📧 hello@todayshappyincident.com