Privacy Policy

The short version

• HEY MAN LLC runs Sweepifi and is responsible for your data (the data controller).
• We collect the minimum: an email if you sign up, a first name if you add one, your habits, check-ins, notes, and moods.
• We use it to run Sweepifi, send the reminders you asked for, and handle billing. That is it.
• No ads. No selling data. No public profiles. Analytics are cookieless and anonymized, and you can turn them off.
• Circle members see only the name, icon, today's status, and streak of the habits you choose to share. Never notes or mood.
• You can export everything or delete your account yourself, at any time, from Settings.
• Questions or requests: privacy@sweepifi.com.

Who we are

Sweepifi is operated by HEY MAN LLC, Wyoming, United States. In this policy "we" and "us" mean HEY MAN LLC, the controller of the personal data described here. Reach us at privacy@sweepifi.com.

What we collect

Things you give us:

• Account details: an email address (if you sign up), a first name and avatar (optional), your timezone, and your settings. Guest accounts have none of these until you save your progress.
• Your records: habits and routines, check-ins, daily notes (up to 280 characters), the mood chip you pick, streak freezes, and vacation dates.
• Circles: Circle names, memberships, reactions, nudges, and any reports you file.
• Support messages you send us.

Things collected while you use the app:

• Device push endpoints, if you turn on reminders. We store the subscription your browser hands us, not your device identity.
• Billing status from Stripe: plan, period dates, whether a payment succeeded, and Stripe's customer and subscription ids. We never see or store your card number.
• Server logs with your IP address, user agent, and the time of the request, used for security and rate limiting.
• Product analytics events (page views and actions like "check-in" or "paywall viewed") tied to a hashed id, with no email, name, or content.
• The date and version of the terms you accepted.

Why we use it

• To run the service: show your habits, compute streaks, sync across devices, and keep Circles working.
• To send what you asked for: habit reminders, daily summaries, weekly recaps, and billing emails. Every product email has one-click unsubscribe. Billing emails are always sent.
• To handle payments, refunds, and disputes through Stripe.
• To keep the service safe: rate limiting, abuse prevention, and reviewing Circle reports.
• To understand what works, in aggregate, so we can improve the product.
• To send occasional product news, only if you opt in.

Legal bases

If you are in the EU, EEA, UK, or another place with similar rules, these are the bases we rely on:

• Contract: running the service you signed up for, including sync, the reminders you set, and billing.
• Legitimate interests: security, abuse prevention, service logs, cookieless and anonymized analytics, and responding to payment disputes. We balance these against your rights, and you can object (see below).
• Consent: product and marketing emails, and the browser's push permission. You can withdraw consent at any time.
• Legal obligation: tax and accounting records tied to payments.

Who processes it for us

We do not sell or rent your data. A small number of companies process it on our behalf, under data-processing agreements, and only for the purposes above:

• Supabase: database, authentication, and file storage (avatars), hosted in the United States.
• Cloudflare: hosting, content delivery, and sending our email.
• Stripe: payments, receipts, tax calculation, and refunds.
• PostHog: cookieless product analytics. No advertising use, no session recording.
• Sentry, when enabled: error reports from the app, with no name, email, cookies, or request details.

We may also share data when the law requires it, to protect someone from harm, or if Sweepifi is ever acquired. In that last case we would tell you first.

What we never do

• No advertising networks, ad pixels, or cross-site tracking.
• No selling, renting, or trading your data.
• No public profiles or public discovery. Nobody can find you on Sweepifi without your invite link.
• No reading your notes or moods for any purpose other than showing them back to you, or helping when you ask us to.
• No AI features. Nothing you type is used to train anything.

Your sign-in

Sign-in (your email address, or your Google or Apple login) runs on a login service that Sweepifi shares with a few other apps run by us or our partners. If you use the same email in one of those apps, it is the same login, and each app keeps its own data separately: Sweepifi cannot see your data in another app, and the other apps cannot see your Sweepifi data. When you delete your Sweepifi account, all of your Sweepifi data is removed. If another of those apps still uses the same login, the login itself (your email address and sign-in method) stays until you delete it there too.

Circles: what others can see

Sharing is per habit, and off by default. When you share a habit with a Circle, its members (up to 8 people) see the habit's name, icon, today's status, and streak. They also see milestone events like "12-day streak", your reactions, and the nudges you send. They never see your notes, your mood, your other habits, or your email. Leaving a Circle stops sharing immediately. Partner mode works the same way with exactly two people.

Cookies and local storage

We use only essential cookies: the ones that keep you signed in. There are no tracking or advertising cookies. Your theme, your offline check-in queue, and a few small conveniences are kept in your browser's local storage and stay on your device. Analytics run without cookies, and you can switch them off in You → Settings. The full list is on the cookie notice.

How long we keep it

• Your account and records: for as long as you have an account. Export or delete them yourself at any time.
• Guest accounts: as long as the session lives on that device. We may remove guest accounts that have been inactive for a long time.
• Server logs: up to 30 days.
• Payment records: Stripe keeps invoices and customer records for as long as tax and accounting law requires, including after you delete your account.
• Dispute evidence: if a payment is disputed, we keep what is needed to respond (sign-up time, IP address, login dates, check-in counts, terms acceptance) for as long as the dispute process requires, with your user id removed once your account is deleted.
• Reports: reports filed in Circles are kept in anonymized form after deletion so patterns of abuse stay visible.
• Analytics: events are tied only to a hashed id, cannot be linked back to you, and are not deleted with the account.

Your rights and controls

Wherever you live, you can:

• Access and export: You → Settings → Export my data gives you a ZIP of CSV and JSON files with everything, on every plan.
• Correct: change your name, email, avatar, and timezone in Settings.
• Delete: You → Settings → Delete my account. Immediate and permanent for your Sweepifi data (see Your sign-in above for the shared login).
• Object or restrict: email privacy@sweepifi.com and we will stop or limit a use based on legitimate interests.
• Port: the export is in open formats (CSV and JSON) you can take anywhere.
• Withdraw consent: use the unsubscribe link in any product email, the push permission in your browser or device settings, or the analytics toggle in Settings.

If you are in the EU, EEA, or UK, you also have the right to complain to your local data protection authority. We would rather hear from you first: privacy@sweepifi.com. We reply within 1 business day.

Children

Sweepifi is for people aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe a younger person has an account, email privacy@sweepifi.com and we will remove it.

International transfers

Your account and records are stored in the United States. Cloudflare serves the site and sends email from its network worldwide, and analytics may be processed in the European Union. Where data leaves the EU, EEA, or UK, we rely on an adequacy decision or on Standard Contractual Clauses (with the UK Addendum where UK law applies) with the processor, plus the safeguards each processor publishes.

Security

Data is encrypted in transit and at rest. Every table is protected so that you can only read and write your own rows, and Circle data is visible only to members, through a view that exposes the shared fields and nothing else. Service keys never reach the browser. If we ever have a breach that affects you, we will tell you without undue delay.

Changes

We will update this policy when the product changes. For changes that matter, we email you and show a notice in the app before they take effect. The version date is at the top of this page.

Contact

privacy@sweepifi.com for privacy requests. support@sweepifi.com for everything else. We reply within 1 business day.

HEY MAN LLC, Wyoming, United States.