Privacy Policy

1. Who we are

Konsist (“we,” “us,” “our”) operates the web application at konsist.xyz. This policy explains how we collect, use, store, and protect your personal data when you use our service.

For any privacy-related questions, contact us at support@konsist.xyz.

2. Data we collect

We collect only what is necessary to provide the service:

We do not collect location data, device fingerprints, or browsing history. We do not use analytics or tracking pixels. We do not sell or share your data with advertisers.

3. How we use your data

• Provide and maintain the Konsist service
• Send transactional emails (password resets, invitations, reminders)
• Process payments through our payment provider
• Enable buddy and room accountability features
• Generate your progress analytics and statistics

We never use your data for advertising, profiling, or automated decision-making.

4. Third-party services

We use the following services to operate Konsist:

• Supabase (database and authentication) — hosted in the EU/US. Your data is stored securely with row-level security.
• LemonSqueezy (payment processing) — handles payment card data. We never see or store your card number.
• Resend (email delivery) — sends transactional emails on our behalf.
• Vercel (hosting) — serves the application.

Each provider processes data under their own privacy policy and data processing agreements.

5. Cookies and local storage

Konsist uses only essential cookies required for the service to function:

• Authentication cookies — Supabase session tokens that keep you signed in. These are strictly necessary and cannot be disabled.
• Theme preference — stored in localStorage to remember your light/dark mode choice.

We do not use advertising cookies, analytics cookies, or any third-party tracking cookies. See our Cookie Policy for details.

6. Data sharing

Your habit data is private by default. It is only visible to:

• You
• People you explicitly invite as accountability buddies (they see only the habits you share)
• Members of rooms you voluntarily join

We never sell, rent, or share your personal data with third parties for their own purposes.

7. Your rights

Under GDPR and applicable data protection laws, you have the right to:

• Access your personal data
• Export your data (available in your profile settings)
• Correct inaccurate data
• Delete your account and all associated data
• Opt out of non-essential emails (unsubscribe link in every email)
• Withdraw consent at any time

To exercise any of these rights, email support@konsist.xyz. We will respond within 30 days.

8. Data retention

We retain your data for as long as your account is active. If you delete your account, all personal data, habit entries, goals, messages, and buddy relationships are permanently deleted within 30 days. Backups are purged within 90 days.

9. Security

We protect your data with:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest (Supabase managed encryption)
• Row-level security policies on all database tables
• Secure authentication with bcrypt password hashing
• Service role key separation (admin operations never exposed to the client)

10. Children

Konsist is not intended for users under the age of 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you via email or a notice within the app. Your continued use of Konsist after changes constitutes acceptance.

12. Contact

For questions, concerns, or data requests, email support@konsist.xyz.