Privacy Notice

1. Who we are

QuietGood is an independent mobile application for daily gratitude journaling ("we," "us," or "our"). We are the data controller responsible for your personal data.

We believe your private reflections deserve the highest level of care and transparency. This notice explains exactly what we collect, why we collect it, and how we protect it.

Contact: cheuk.coding@gmail.com

2. What data we collect

We collect only the minimum data required to provide the QuietGood service:

3. What we do not collect

QuietGood contains no third-party analytics SDKs, no ad networks, and no data brokers. Your gratitude entries are never read, processed, or used for any purpose other than displaying them back to you.

4. How we use your data

• Authentication: Firebase Authentication verifies your identity so your entries are accessible only to you.
• Cloud sync: Your entries and preferences are stored in Cloud Firestore so they persist across devices. All data is transmitted over TLS encryption.
• Notifications: If you enable daily reminders or morning reflections, we schedule local notifications on your device. No notification content is stored on our servers.
• Widget: If you use the home screen widget, entry data is stored locally on-device to populate the widget display.

5. Third-party services

QuietGood uses the following third-party services, each with their own privacy policies:

• Firebase Authentication — for secure sign-in via email, Apple, and Google. Privacy docs
• Cloud Firestore — for storing your entries and preferences securely in the cloud. Privacy docs
• Apple Push Notification Service — for delivering notifications on iOS. Privacy docs

We do not share your data with any other third parties.

6. Data retention

Your data is retained for as long as your account exists. When you delete your account through the app, all associated data — including entries, preferences, and authentication credentials — is permanently removed within 30 days.

7. Data security

We take the security of your data seriously:

• In transit: All data transmitted between the app and our servers is encrypted using TLS (Transport Layer Security).
• At rest: Data stored in Cloud Firestore is encrypted using AES-256 encryption.
• Authentication: We use Firebase's secure authentication system with industry-standard protocols. Passwords are never stored in plain text.
• On device: Sensitive credentials are stored using the device's secure keychain (Expo SecureStore).

8. Legal basis for processing

Under the General Data Protection Regulation (GDPR) and similar laws, we process your personal data on the following legal bases:

• Contractual necessity (Art. 6(1)(b) GDPR): Processing your authentication credentials and gratitude entries is necessary to provide you with the QuietGood service.
• Consent (Art. 6(1)(a) GDPR): Where you have given consent, such as enabling push notifications or uploading a profile image. You may withdraw consent at any time through the app settings.
• Legitimate interest (Art. 6(1)(f) GDPR): We may process limited data to maintain the security and integrity of the service. Our legitimate interest does not override your rights and freedoms.

9. International data transfers

QuietGood uses Google Firebase services, which may process and store data in data centres located in the United States and other countries outside the European Economic Area (EEA).

Where your data is transferred outside the EEA, it is protected by Google's data processing terms, which include Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of data protection.

For more information on how Google handles international transfers, see Google's Data Processing Addendum.

10. Your rights

You have the following rights regarding your personal data:

To exercise any of these rights, contact us at the email below. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority in your country of residence if you believe your data has been processed in violation of applicable data protection laws. A list of EU data protection authorities can be found at edpb.europa.eu.

11. Children's privacy

QuietGood is not intended for children under 13 (or under 16 in certain jurisdictions). We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. California privacy rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Right to know: You have the right to request what personal information we have collected, used, or disclosed about you.
• Right to delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your rights, contact us at cheuk.coding@gmail.com. We will verify your identity and respond within 45 days.

13. Changes to this policy

We may update this privacy notice from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For significant changes, we may also notify you through the app. The latest version will always be available at this URL.