Privacy Policy — Kintamani

1. About This Policy

Trophy Ventures Pty Ltd ("we", "us", or "our") operates the Kintamani mobile application (the "App"). This Privacy Policy explains what personal and health information we collect, why we collect it, how long we keep it, and the rights you have over it. By using the App, you agree to the practices described here.

If you have questions or concerns, contact us at privacy@trophyventures.com.au.

2. Information We Collect

We collect three categories of information:

2a. Account and Profile Data

Name and email address — provided when you sign in with Google or Apple.
Profile avatar — your Google or Apple profile photo, or an image you upload.

2b. Health and Fitness Data

The App reads health data from your device's native health platform — Apple HealthKit on iOS and Health Connect on Android. We access this data only with your explicit permission. The specific data types we read are:

Data Type	Source	Why We Collect It
Daily step count	Apple HealthKit / Health Connect	To track your progress toward your daily step goal, calculate whether your group's pet is thriving, and update your personal and group streaks.
Sleep duration	Apple HealthKit / Health Connect	To display last night's sleep hours and contribute to your family's sleep score. This is a secondary, optional metric.

We do not sell, share, or transfer your health data to advertisers or any third parties for advertising purposes. Health data is used solely to provide the App's core features as described in this policy.

2c. Device and Usage Data

Push notification token — to deliver in-app alerts (cheers, milestones, pet evolution).
Device platform (iOS or Android) — to route push notifications correctly.
Timezone — to schedule nightly group calculations at the correct local time.
In-app activity — actions such as social interactions (cheers, pokes, celebrations), sick-day usage, and group membership changes.

3. How We Use Your Information

Provide and personalise the App's features (step tracking, streaks, pet evolution, social actions).
Calculate your family group's collective progress and update the shared pet's mood and evolution stage.
Send push notifications about group milestones, social actions, and progress reminders.
Authenticate you securely via Google OAuth or Apple Sign-In.
Diagnose technical issues and improve performance.

We do not use your health data for profiling, advertising, or any purpose beyond the features listed above.

4. How We Share Your Information

We share your information only in the following limited circumstances:

Within your Kin (family group): Your display name, avatar, and daily step progress are visible to other members of your Kin. Your sleep data is shared as an anonymised group average only.
Service providers: We use Supabase (database and authentication hosting) and Expo / Firebase (push notification delivery). These providers process data on our behalf under strict data processing agreements and are not permitted to use your data for their own purposes.
Legal requirements: We may disclose information if required by law, court order, or to protect the safety of our users or the public.

We do not sell your personal information to third parties.

5. Data Retention

We retain your data for the following periods:

Data Category	Retention Period
Account and profile data (name, email, avatar)	For the lifetime of your account. Deleted within 30 days of account deletion.
Daily health logs (step counts, sleep hours)	For the lifetime of your account. Deleted within 30 days of account deletion.
Group activity (streaks, mood history, social actions)	For the lifetime of your account. Deleted within 30 days of account deletion.
Push notification tokens	Retained while you are a registered user; automatically removed when you sign out or delete your account.
Aggregated, anonymised analytics	May be retained indefinitely, as it cannot be linked back to you.

You may request deletion of your account and all associated data at any time by contacting us at privacy@trophyventures.com.au. We will process deletion requests within 30 days.

6. Health Data — Additional Disclosures

Kintamani accesses health data through Apple HealthKit (iOS) and Android Health Connect. In line with platform requirements:

HealthKit data will not be used for advertising, shared with data brokers, or used for any purpose not described in this policy, in accordance with Apple's HealthKit guidelines.
Health Connect data is accessed only for the fitness features described above and is not used for advertising or shared for advertising purposes, in accordance with Google's Health Connect permissions policy.
You can revoke the App's access to health data at any time through your device's Health or Privacy settings without deleting your account. Revoking access means the App will no longer be able to sync your steps or sleep, but your existing data on our servers remains until you delete your account.

7. Data Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), row-level security policies on our database, and JWT-based authentication. No transmission over the internet is 100% secure; we cannot guarantee absolute security, but we take all reasonable precautions.

8. Children's Privacy

Kintamani is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

9. Your Rights

Depending on where you live, you may have the following rights regarding your personal information:

Access: Request a copy of the data we hold about you.
Correction: Request corrections to inaccurate data.
Deletion: Request deletion of your account and associated data.
Portability: Request your data in a machine-readable format.
Withdrawal of consent: Revoke health data access through your device settings at any time.

To exercise any of these rights, email us at privacy@trophyventures.com.au. We will respond within 30 days.

10. International Data Transfers

Our infrastructure is hosted by Supabase, which may store data in regions outside your country. By using the App, you consent to your data being processed in those regions. We ensure all service providers maintain appropriate data protection standards.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you through the App or by email. Continued use of the App after any change constitutes acceptance of the updated policy.

12. Contact Us

Trophy Ventures Pty Ltd

Email: privacy@trophyventures.com.au