Privacy policy

Last updated: 23 October 2026

1. Who we are

CheckMate is a habit app for iOS and Android, run by CIOCHINARU IONUȚ-DANIEL PERSOANĂ FIZICĂ AUTORIZATĂ, registered in Romania (CUI 54408077, EUID ROONRC.F2026017755005). We decide how your data is used, so under the EU General Data Protection Regulation (GDPR) we are the data controller.

This policy covers the CheckMate app and the website checkmate-daily.com. For questions or requests, write to hello@checkmate-daily.com.

2. The short version

  • Your journal stays on your phone unless you turn on cloud backup, and other people never see it.
  • We don't sell your data, and we don't use it to train AI models.
  • We use analytics and crash reports to keep the app working and to improve it.
  • On Android, Google gets data to measure our ads, except in the European Economic Area, the UK and Switzerland, where it’s off unless you turn it on. You can change it in Settings at any time. On iPhone, nothing goes to Google for ads.
  • You can delete your account, and the data in it, from Settings.

3. What we collect

Your account

  • Your email address and password (our login provider stores only a secure hash of the password). If you sign in with Google, we get your email address, name and Google account ID. If you sign in with Apple, we get your email address, or an Apple relay address if you hide yours, and your name if you share it.
  • Your display name, username, avatar (one of the app’s pixel characters), avatar frame and bio.

What you do in the app

  • Your quests, their schedules and tags, and your check-ins.
  • XP, levels, attributes, class, titles, badges and Embers.
  • Raids and focus rooms you join, your friends and friend requests, and quests you post on the Notice Board.
  • Your settings, including notification choices, time zone, language and whether you use iOS or Android.

Your journal

  • By default your journal (mood, notes, sleep, activities, weather and photos) is stored only on your phone. We can’t see it.
  • If you turn on cloud backup, we store your entries and photos on our servers so you can restore them. Photos go into private storage that only your account can read.

Notifications

If you allow notifications, we store your device’s push token and an installation ID so we can send them, and a log of the notifications we sent.

Purchases

If you subscribe or buy lifetime access, Apple or Google takes the payment. We never see your card. Through RevenueCat we get the purchase status, the product, the dates and the store’s transaction IDs.

Usage and crash data

  • Analytics events about how the app is used, for example that a quest was created or a screen was opened, linked to your account ID. They never contain your journal text. If you installed CheckMate from an ad or a link on Google Play, we also record that campaign.
  • Crash and error reports with your device model, operating system and app version, plus performance data. For some sessions, and when an error happens, a short screen recording in which all text and images are hidden.
  • If you send a bug report: your name, email address, what you write and that session’s recording.

Ad measurement (Android only)

On Android, Google gets app events (such as installing, signing up or subscribing) and your device’s advertising ID, so we can see which of our ads bring people to CheckMate. We don’t let Google use this data to personalize the ads you see.

  • In the European Economic Area, the UK and Switzerland, it’s off. The app sends nothing to Google for ads unless you turn it on in Settings, under Profile & Privacy, or say yes when the app asks.
  • Everywhere else it’s on, and you can turn it off at any time in Settings, under Profile & Privacy.
  • On iPhone, the app sends nothing to Google for ads.

These choices came with CheckMate 2.0. Versions before 2.0 send these app events to Google from every device, with no setting to turn them off. Update the app to get the setting.

The website

The website sets no cookies, runs no analytics and loads nothing from other companies’ servers, fonts and icons included. Your browser remembers your theme, font and text size choices on your own device. To show prices in your currency, our host, Cloudflare, tells the page which country your connection comes from. We don’t store that.

4. Why we use it, and on what legal basis

  • To run the app for you: your account, syncing, progress, raids, friends, the Notice Board, the notifications you turned on, and purchases. Basis: our contract with you (GDPR Art. 6(1)(b)).
  • To find bugs and see which features help people, using analytics and crash reports. Basis: our legitimate interest in keeping the app working and making it better (Art. 6(1)(f)). You can object at any time by writing to us.
  • To measure our ads with Google (Android). Basis: in the European Economic Area, the UK and Switzerland, your consent (Art. 6(1)(a)); elsewhere, our legitimate interest in knowing which ads work. Either way you can turn it off in Settings at any time.
  • To email you: sign-up codes and password resets are part of running your account. Now and then we may also send news about CheckMate, based on our legitimate interest. Reply “stop” to any of those and we won’t send more.
  • To keep records the law requires, for example for tax. Basis: legal obligation (Art. 6(1)(c)).

5. What other players can see

  • Your display name, username, avatar and frame.
  • Your bio, level, days shown up, totals and badges: everyone if your profile is public, otherwise only your friends. A private profile also can’t get new friend requests.
  • Your friends can see the names of your quests and when you checked in, except for quests you mark as secret. If your profile is private, friends don’t see your quests or check-ins at all.
  • In open and official raids, any signed-in player can see the names, avatars and scores of the people taking part.
  • Quests you post on the Notice Board show your name and avatar.

Other players never see your journal, email address, attributes, trophies, friends list, time zone or online status.

6. Who else handles your data

These companies process data for us, only for the jobs listed and under data processing agreements:

  • Supabase: database, login and file storage. Our project is hosted in the EU (Ireland).
  • PostHog: product analytics, hosted in the EU.
  • Sentry: crash reports and screen recordings, hosted in the EU (Germany).
  • RevenueCat (USA): purchases and subscriptions. It gets your account ID, email address and display name.
  • Expo (USA): passes push notifications to Apple and Google, and delivers app updates.
  • Resend (USA): sends our emails.
  • Cloudflare: hosts the website.
  • Google (Firebase Analytics and Google Ads): ad measurement on Android, as described above.

Apple and Google also run the app stores, take payments, deliver push notifications and, if you use them, handle sign-in. For those they follow their own privacy policies.

Some of these companies process data in the USA. For those transfers we rely on the EU-U.S. Data Privacy Framework where the company is certified under it, and otherwise on the European Commission’s standard contractual clauses.

We also hand over data when the law requires it.

7. How long we keep it

  • Your account and app data: until you delete your account.
  • Your cloud journal backup: until you delete the cloud backup in Settings or delete your account.
  • Analytics events: up to 2 years.
  • Crash reports and recordings: up to 90 days.
  • Ad measurement data at Google: up to 14 months.
  • Purchase records: as long as the law requires.

8. Deleting your account

Settings › Delete account removes your account, your app data and your cloud journal and photos from our database right away, and erases the journal on your phone. A few things stay:

  • Raids you created stay for the other players, without your name.
  • Moderation reports and our internal logs keep an account ID that no longer leads to any name or email address.
  • Records that PostHog, Sentry, RevenueCat and Google already hold are removed on the schedule above. If you want them gone sooner, write to us and we’ll ask those companies to delete them.

9. Your rights

Under the GDPR you can:

  • see the data we hold about you and get a copy;
  • correct it;
  • have it deleted;
  • limit how we use it, or object to it;
  • take it to another service;
  • withdraw your consent at any time, without affecting what we did before.

You can do much of this in the app: edit your profile, export your journal, change ad measurement in Settings, or delete your account. For anything else, write to hello@checkmate-daily.com. We answer within one month.

You can also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or to the authority where you live.

10. Security

Data travels encrypted between the app and our servers. Our database lets each account read only its own private data, journal photos sit in private storage, and you can lock your journal with a PIN.

11. Children

CheckMate isn’t meant for children under 13, and we don’t knowingly collect their data. If you think a child under 13 has an account, write to us and we’ll delete it. If you’re under 16 and live in the EU, ask a parent before you allow ad measurement.

12. Changes to this policy

If we change this policy in a way that matters, we’ll tell you in the app or by email before the change applies. The date at the top shows the current version.

13. Contact

Questions about your data: hello@checkmate-daily.com.