Privacy & POPIA

Effective date: [ Draft · to be confirmed ]

Your practice is personal. This policy explains, in plain language, what information Expanding Gratitude holds, why, and the control you have over it. It is written to align with South Africa's Protection of Personal Information Act (POPIA).

1. Who we are

Expanding Gratitude is built and operated by Hodova (the "responsible party" under POPIA), based in Cape Town, South Africa. For any privacy question, contact our Information Officer at privacy [at] expandinggratitude.com. Registered details: [ company registration number ], [ registered address ].

2. What we collect

• Account information you give us: name, email address, and password (stored securely, never in plain text).
• Your practice content: journal entries, gratitude reflections, emotion check-ins, vision boards, word of the year, time capsule moments, and reset scripts you create.
• Usage information: streaks, badges, and basic app activity that make the features work.
• Billing information: handled by our payment provider. We store your subscription status, not your full card details.
• Device information needed to deliver reminders and notifications, if you turn them on.

3. Your journal and sensitive data

Journal entries and emotion logs are among the most personal things a person can write. We treat them as special personal information. They are yours. We do not sell them, we do not use them for advertising, and we do not read them except where strictly necessary to provide the service or where the law requires it. Your entries are protected by row level security so that they are accessible only to your account.

4. How we use your information

• To provide the app and your daily practice.
• To keep your account secure and your data backed up.
• To send reminders and notifications you have asked for.
• To process your subscription and free trial.
• To understand, in aggregate and without identifying you, how to make the app gentler and better.

5. Legal basis under POPIA

We process your information on the basis of your consent, to perform our agreement with you (providing the app you signed up for), and to meet our legal obligations. You can withdraw consent for optional processing, such as notifications, at any time.

6. Who we share it with

We share information only with the operators who help us run the service, under agreements that protect your data:

• Supabase, our secure database and authentication provider.
• Paystack, our payment provider, for subscriptions and billing.
• Notification services, only to deliver reminders you enable.

We do not sell your personal information to anyone.

7. Storage and security

Your data is stored on secured infrastructure, with row level security applied to every table so records are tied to your account. We use encryption in transit and follow reasonable technical and organisational measures to protect your information. Some processing may occur outside South Africa; where it does, we take steps to ensure a comparable level of protection.

8. Your rights

Under POPIA you may: access the personal information we hold about you; ask us to correct or update it; ask us to delete it; object to certain processing; and lodge a complaint with the Information Regulator of South Africa. To exercise any of these, email privacy [at] expandinggratitude.com and we will respond within a reasonable time.

9. Keeping and deleting your data

We keep your information for as long as your account is active. If you close your account, we delete or anonymise your personal information within a reasonable period, except where we must keep certain records to meet legal obligations.

10. Children

Expanding Gratitude is intended for adults. We do not knowingly collect personal information from children without appropriate consent. If you believe a child has provided us information, please contact us and we will remove it.

11. Changes and contact

If we update this policy, we will post the new version here and update the effective date. For any question about your privacy, contact our Information Officer at privacy [at] expandinggratitude.com.