This policy covers the Discipline 24 mobile application, the backend services behind it, and this website at discipline24.com. By using any of them you agree to the practices described here.
1. What we collect
Information you provide
- Account information. If you sign in with Google, we receive your name, email address and profile photo from your Google account. If you register with an email address and password, we store the address and a one-way bcrypt hash of the password — never the password itself.
- Profile details. A display name and an optional profile photo. Photos are stored as image files in our object storage; your account record holds only a reference to the file.
- App content. The disciplines you create, their schedules and reminders, your daily completions, and any challenges you join along with your check-ins.
- Preferences. Settings such as chosen language, appearance and notification preferences.
- Comments on our articles. If you comment on the blog, we store what you wrote, which article and comment it replies to, when you posted or edited it, and the votes and reports you make on other comments. Comments are public: anyone can read them, shown with your display name and profile photo, and search engines may index them. Your email address is never shown.
- Messages you send us. If you use the contact form or subscribe to the newsletter, we store what you submitted so we can reply or send the emails you asked for.
Information collected automatically
- Device and push token. If you enable notifications, we store a push token (via Firebase Cloud Messaging) and your device timezone so reminders arrive at the right local time.
- Technical data. Standard server logs — IP address, request time, app or browser version — kept for security, diagnostics and abuse prevention.
- Advertising identifiers. Our advertising provider may access your device advertising ID and related information to serve and measure ads. See Advertising below.
2. How we use it
- Provide, maintain and sync the product across your devices.
- Authenticate you and keep your account secure.
- Track your streaks, statistics and challenge progress.
- Send the reminders and notifications you opted into.
- Display advertising that keeps the product free.
- Diagnose problems, prevent abuse and improve the product.
We do not use your disciplines or completion history to build advertising profiles, and we do not share that content with advertisers.
3. This website
Signing in on discipline24.com stores a session token in a cookie marked httpOnly, Secure and SameSite=Lax. Because it is httpOnly, scripts running in your browser cannot read it — including any script that managed to get itself injected into a page. The website talks to our API from the server side, so your token is never exposed to browser JavaScript at all.
Your colour-theme choice is stored in your browser's local storage. It never leaves your device and is not sent to us. Full details are in the cookie policy.
4. Advertising
The mobile app uses Google AdMob, and parts of this website may display Google AdSense units. These services may collect device identifiers (such as the advertising ID), approximate location derived from your IP address, and ad-interaction data in order to serve personalised or non-personalised advertising and to measure its performance. That processing is governed by Google's own policies.
You can reset or limit your advertising ID in your device settings, and manage ad personalisation through Google My Ad Center.
5. Third-party services
Each of these providers processes data under its own privacy policy:
| Provider | Purpose |
|---|---|
| Google Sign-In / Firebase Authentication | Account sign-in and identity verification |
| Firebase Cloud Messaging | Push notifications |
| Google AdMob / AdSense | Advertising |
| Google Play Services | App distribution and required device services |
| MongoDB Atlas | Database hosting |
| Amazon Web Services | Application hosting and file storage |
| Brevo | Transactional email (verification, password reset) |
6. Data sharing
We do not sell your personal information. We share data only with the providers listed above in order to operate the product, or where we are legally required to. Two things worth knowing: inside a challenge, your display name and progress may be visible to other participants in that same challenge; and a comment you post on the blog is visible to everyone, with your display name and profile photo.
7. Retention and deletion
We keep your information for as long as your account is active. You can delete it at any time, without contacting support, from the deletion page or from Profile → Account → Delete account in the app.
On your phone. The Android app keeps a copy of your disciplines, completions, challenge check-ins and settings in its private storage on the device, so it opens instantly and keeps working without a connection. Changes you make offline wait there until they sync to your account. This copy is not shared with other apps, and it is removed from the phone when you sign out, delete your account or uninstall the app.
Deleting your account permanently removes your profile, disciplines, completions, challenges, check-ins, uploaded photo and device tokens. You can alternatively wipe just your tracked data and keep the account. Some anonymised or aggregated logs may be retained for security and legal compliance.
Deleting your account also erases the text of every comment you wrote and removes your name from them, and withdraws your votes and reports. Where other people replied to one of your comments, a “deleted” placeholder remains so their replies still make sense. Wiping only your tracked data leaves your comments as they are. You can delete a single comment at any time from the comment itself; its text is erased at once. Copies that search engines have already cached are outside our control and refresh on their own schedule.
8. Security
Data is transmitted over encrypted HTTPS connections. Access to your account is protected by an authenticated session token, and passwords for email accounts are stored only as bcrypt hashes. We take reasonable measures to protect your information, but no method of transmission or storage is completely secure.
9. Children's privacy
The product is not directed to children under 13, or the minimum age required in your jurisdiction. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.
10. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. Most of these can be exercised directly in the app or on this website; for anything else, contact us.
11. International transfers
Your information may be processed and stored on servers in countries other than your own. Where required, we take steps to ensure it receives an adequate level of protection.
12. Changes to this policy
We may update this policy from time to time. Material changes are reflected by updating the “last updated” date above and, where appropriate, by an in-app notice.
13. Contact us
Questions about this policy or your data? Write to support@aidribblers.com or use the contact form.