Privacy Policy

1. Introduction & Data Controller

Welcome to Affirmation List. We are committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, and safeguard your information in compliance with global regulations including POPIA (South Africa), GDPR (Europe), and CCPA (California).

Affirmation List is an app created and operated by SQUAREBOOST (PTY) LTD, a company registered in South Africa. When you use the Affirmation List app, you are using a product built and maintained by SquareBoost (Pty) Ltd, and this privacy policy governs how we handle your data in connection with that app.

Who We Are (Data Controller):
The data controller responsible for your information is:
SQUAREBOOST (PTY) LTD
63 Westfield Rd, Modderfontein Lethabong
Edenvale, 1609
South Africa

2. Information We Collect

We adhere to a strict principle of data minimization. We do not collect your name, email address, phone number, or precise location.

A. Personal Content (Local Only)

Your affirmations, lists, and journal entries are stored locally on your device. We (SquareBoost) have no access to this content. It never leaves your phone unless you explicitly choose to back it up to your own personal iCloud or Google Drive account. These backups are managed by the respective OS provider (Apple or Google), and SquareBoost does not receive or store these backup files.

B. Purchase History

If you subscribe to our premium features, we process anonymous purchase identifiers (such as a transaction receipt) to validate your subscription and restore your purchases across devices. This data allows us to unlock the features you have paid for.

C. Usage & Demographic Data

We use a third-party service, PostHog, to understand how the app is used and to improve functionality. Providing this data is optional; you may bypass these questions during onboarding by selecting the "Skip" option.

D. Crash Data

When the app crashes or encounters an unexpected error, we automatically collect a crash report via PostHog. This report includes technical details such as the error type, stack trace, device model, and OS version at the time of the crash. This data is used solely to identify and fix bugs, improving the stability of the app for all users. Crash reports are not linked to your identity and contain no personal content from your device (such as affirmations or journal entries).

E. Performance Data

We collect anonymous performance metrics via PostHog to monitor the health and responsiveness of the app. This includes data such as app load times, screen rendering durations, and error rates. This information helps us detect slowdowns, optimize the user experience, and ensure the app functions reliably across different devices and OS versions. Performance data is not linked to your identity and is used exclusively for App Functionality and Analytics purposes.

3. Data Sharing & Third Parties

We do not sell your data. We do not use your data for advertising, retargeting, or tracking you across other apps and websites.

We share anonymous usage and purchase data with the following service providers solely for the purpose of app functionality and analytics:

• RevenueCat: (Subscription Management) - Used to process receipts and manage your subscription status. View Privacy Policy.
• PostHog Inc: (Analytics, Crash & Performance Provider) - Used for anonymous app usage data, crash reports, and performance metrics. View Privacy Policy.

4. Data Retention

Local Data: Retained on your device for as long as you have the app installed. Deleting the app deletes this data instantly.

Analytics Data: We retain anonymized usage data in PostHog for a maximum of 12 months, after which it is automatically deleted.

Subscription Data: Anonymous purchase identifiers processed via RevenueCat are retained for the duration of your active subscription or as long as necessary to provide purchase restoration services.

Crash & Performance Data: Anonymous crash reports and performance metrics collected via PostHog are retained for a maximum of 12 months, in line with our analytics data policy, after which they are automatically deleted.

5. Your Rights

Depending on your location, you may have the following rights regarding your data:

• Right to Know: You have the right to know whether we collect, use, or share your personal data — and with whom. We share anonymous usage and purchase data only with PostHog (analytics) and RevenueCat (subscriptions), as described in Section 3. We do not sell your data or share it for advertising purposes.
• Right to Access: You may request access to the personal data we hold about you.
• Right to Correct: You may request correction of inaccurate data.
• Right to Delete: You may request deletion of your data.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal data. We do not sell your data, and we do not share it for cross-context behavioural advertising. We do not engage in targeted advertising or profiling that produces legal or similarly significant effects.
  
  How to Opt Out of Analytics Data Collection: The only personal questions we ask are optional demographic questions during app onboarding (such as age range). To opt out of providing this information, select the "Skip" option when prompted. Beyond onboarding, we collect only anonymous, non-identifiable usage, crash, and performance data that cannot be linked to you as an individual. To stop all data collection entirely, you may delete the app from your device at any time. If you wish to confirm our data practices or exercise any opt-out right, you may also contact us using the details in Section 9.
• Right to Object: You may object to certain types of processing, such as direct marketing.

To exercise any of these rights, please contact us using the details in Section 9.

6. Region-Specific Information

South Africa (POPIA)

In compliance with the Protection of Personal Information Act (POPIA):

• Purpose of Processing: We process usage data based on Legitimate Interest to improve our software.
• Information Officer: The Founder/Owner of SquareBoost (Pty) Ltd.
• Right to Object / Opt-Out: You have the right to object to the processing of your personal data. To opt out of optional demographic data collection, select the "Skip" option during app onboarding. To stop all anonymous data collection, delete the app from your device. To submit a formal objection, contact us at the details in Section 9.
• Complaint: You have the right to lodge a complaint with the Information Regulator (South Africa) at enquiries@inforegulator.org.za.

California (CCPA/CPRA) & USA

Do Not Sell or Share My Personal Information: We do not sell your personal information. We do not "share" your personal information for cross-context behavioral advertising.

Residents of California, Virginia, Colorado, Connecticut, and Utah have the right to request access, correction, and deletion of their data. As noted above, because we do not link data to your identity, deleting the app is the primary method to exercise these rights.

Virginia (VCDPA)

In compliance with the Virginia Consumer Data Protection Act (VCDPA), Virginia residents have the following rights:

• Right to Access: Confirm whether we process your personal data and access it.
• Right to Correct: Request correction of inaccurate personal data.
• Right to Delete: Request deletion of personal data you have provided to us.
• Right to Data Portability: Obtain a copy of your data in a portable format.
• Right to Opt-Out: Opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. We do not engage in any of these activities. To opt out of our optional demographic data collection, use the "Skip" option during app onboarding. To stop all anonymous data collection entirely, delete the app from your device. You may also contact us at the details in Section 9 to confirm our practices or submit a formal opt-out request.

To exercise your VCDPA rights, contact us at the details in Section 9. We will respond to verified requests within 45 days.

European Union (GDPR) & UK

We act as a Data Controller. If you are in the EU/UK, you have the right to lodge a complaint with your local Data Protection Authority (DPA) if you believe we have violated your rights.

Brazil (LGPD)

In compliance with the Lei Geral de Proteção de Dados (LGPD), you have the right to confirmation of the existence of processing, access to data, and correction of incomplete data.

7. International Transfers

Our company is based in South Africa. Usage data may be processed by our analytics provider (PostHog) and subscription provider (RevenueCat) on servers located in the United States or European Union. We ensure these providers adhere to strict data protection standards (such as Standard Contractual Clauses) to protect your information.

8. Changes to This Policy

We may update this policy periodically. The "Last updated" date at the top of this page will reflect the effective date of the most recent changes.

9. Contact Us

If you have questions about this policy or wish to exercise your rights, please contact our Data Protection Officer (DPO):