Privacy Policy

This Privacy Policy explains how Discipline Maniac (“we”, “us”, “our”) collects, uses, and protects information when you use our habit-tracking app at this site. We are based in India and process data in line with the Digital Personal Data Protection Act, 2023 (DPDP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Account information. When you sign in with Google we store the name and email your provider returns, plus an opaque identifier for your account. You can set a public username, and (optionally) a leaderboard alias. A display name and preference settings (theme, email-digest opt-in, timezone) are stored too.

Guest identity. You can use the app without an account. We create a random guest identifier stored in your browser’s localStorage, and record a lightweight device fingerprint (browser language, screen size, timezone) that is hashed and used only for anti-abuse checks — the raw value is never stored or sent to us in plain form.

Habit and activity data. Everything you log: habit names and settings, daily completions, streaks, streak freezes, XP and levels, challenges, milestones, focus-session minutes, time capsules, reminders, notifications, and app-open timestamps.

Content you create. Photos (habit proof photos and photo-journal entries), voice notes attached to completions, mood logs (a 1–5 rating and optional note), chat messages in challenges/clans/mentor conversations, reviews, and accountability-partner content.

Payment information. We do not collect or store your card or bank details. Payments and subscriptions (Pro plans, freeze packs, and team seats) are processed by Razorpay; we receive only the transaction outcome and subscription status from Razorpay. Lifetime access is granted only by an administrator-issued activation code, not through a user payment flow.

Referral and campaign data. If you use a referral link or a tracking link (like /l/<slug>), we log a hashed IP address, the referral code, and your signup source so we can credit referrals and prevent fraud. Raw IP addresses and device fingerprints are never stored — only HMAC hashes.

• to operate the app — tracking habits, streaks, XP, analytics, and challenges;
• to sync your data across devices and keep guest data when you create an account;
• to process and manage subscriptions and one-time purchases via Razorpay;
• to run the referral program and attribute signups from tracking links;
• to send you notifications you asked for (reminders, streak alerts, push notifications);
• to keep the service safe — rate limiting, abuse prevention, and fraud detection;
• to respond to support requests and diagnose errors.

We do not sell your personal information. We share data only with service providers that help us run the service, and only as needed:

• Razorpay — processes payments and subscriptions. See Razorpay’s privacy policy for how they handle payment data.
• Google — sign-in (OAuth), only when you choose to use Google to access your Discipline Maniac account.
• Notion — only if you connect your own Notion workspace to sync habit data. We store the connection token you authorize.
• Media storage backend — stores uploaded photos and voice notes (served to you through authenticated, short-lived URLs).
• Sentry — error monitoring. We do not send personal content to Sentry; only technical error data.

We may also disclose information where required by law, to enforce our Terms, or to protect the rights, property, or safety of our users and the public.

We use cookies and browser storage to keep you signed in, remember your guest identity, and make the app work:

• Session cookie — keeps you signed in. It is HttpOnly and Secure, and named app_session_id (prefixed with __Host- in production).
• Guest identity — a random guest ID kept in localStorage so you don’t need an account to start tracking.
• Tracking-link and referral cookies — short-lived cookies that remember which campaign link or referral code brought you so we can attribute signups and pay referrers correctly.
• OAuth state cookies — transient cookies used only during sign-in to prevent request forgery.
• UI preferences — small values in localStorage (your display name, theme, widget order, timer state, dismissed prompts).

These technologies are strictly necessary for the app to function and for sign-in, guest mode, and referral attribution. We do not use third-party advertising cookies. You can clear them at any time through your browser settings, but the app may stop working correctly (for example, you may be signed out or start a new guest identity). Clearing your browser storage does not delete data already saved to your account on our servers — use the deletion tools described in Section 7.

Data linked to a signed-in account is kept until you delete your account. Abandoned guest sessions are automatically cleaned up after 90 days of inactivity. Hashed IP records for tracking links are purged after 30 days. Backups may retain data for a short additional recovery period.

You can access and correct your data at any time from Settings. You can also:

• Export your data — download a copy of your habits, logs, streaks, XP, and journal as JSON, CSV, or PDF from Settings, or request your full server-side data export.
• Delete your account — Settings provides account deletion, which permanently erases your account and the data keyed to it. (Note: an active Razorpay subscription must be cancelled with our support to stop recurring charges.)
• Clear guest data — clearing your browser storage removes the local guest identity and client-side data.

Under DPDP and GDPR you also have rights to object to or restrict certain processing and to complain to your local data protection authority. To exercise any of these rights, contact us at the address below.

We use encryption in transit (HTTPS), secure cookie flags, server-side hashing for IPs and device fingerprints, and encryption at rest for sensitive fields where a secret key is configured. Access to your habit data is scoped to your account or guest identity, and media is served through authenticated, short-lived URLs.

We may update this policy from time to time. Material changes will be posted here with a new “Last updated” date. Continued use of the app after changes means you accept the updated policy.

Questions or requests about privacy can be sent to support@disciplinemaniac.in. For security disclosures, see our security.txt.