Privacy Policy

This Privacy Policy explains how Charos S.r.l. ("Charos", "we", "us") collects, uses, and protects your personal data when you use Progredi. We act as the data controller under the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679).

---

1. Who We Are

Charos S.r.l., Italy — charossrl@gmail.com

2. Data We Collect

2.1 Account Data

When you register, we collect:

• Email address
• Username
• Date of birth — to verify minimum age eligibility
• Password — stored as a secure cryptographic hash; we never see your plain-text password
• Timezone — used solely for scheduling check-in reminders

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.2 Wellness and Gaming Session Data

When you complete check-ins, we collect mood, sleep quality, stress, focus, and energy ratings, KSS scores, games played, session duration, time of day, habit streaks, and reward points.

2.3 Technical Data

Device OS and version, authentication tokens (short-lived JWTs stored in encrypted device storage), and app error logs if crash reporting is enabled.

Legal basis: legitimate interest in maintaining service security (Art. 6(1)(f) GDPR).

2.4 Subscription Data

Your subscription status (active/inactive) is received from RevenueCat. We do not process or store payment card information — all payments are handled by Apple App Store or Google Play.

3. How We Use Your Data

Purpose	Legal basis
Creating and managing your account	Contract (Art. 6(1)(b))
Delivering session check-ins and history	Contract (Art. 6(1)(b))
Generating AI Coach insights	Contract + Consent (Art. 6(1)(b), Art. 9(2)(a))
Managing your Premium subscription	Contract (Art. 6(1)(b))
Security monitoring and fraud prevention	Legitimate interest (Art. 6(1)(f))
Complying with legal obligations	Legal obligation (Art. 6(1)(c))

We do not sell your data. We do not use your data for advertising.

4. AI Coach and OpenAI

The AI Coach transmits a summary of your session data to OpenAI, L.L.C. (USA) to generate personalised insights. OpenAI acts as a data processor under a Data Processing Agreement. Under our agreement, your data is not used by OpenAI to train its models.

5. Third-Party Processors

Processor	Purpose	Location
Google Firebase	Authentication and token storage	EU / USA
OpenAI	AI Coach insight generation	USA
RevenueCat	Subscription management	USA
AWS (via Supabase)	Database hosting	USA
Railway	Application server hosting	USA
Apple App Store / Google Play	Payment processing	USA

International transfers to US-based processors are governed by Standard Contractual Clauses (Art. 46(2)(c) GDPR) or the EU–US Data Privacy Framework.

6. Data Retention

• Account and session data — retained while your account is active
• Deleted accounts — all data permanently erased within 30 days (Art. 17 GDPR)
• Authentication logs — retained up to 90 days for security, then deleted

7. Your Rights

To exercise any right, email charossrl@gmail.com. We will respond within 30 days.

You may also lodge a complaint with the Italian supervisory authority: Garante per la Protezione dei Dati Personali — garanteprivacy.it

8. California Residents (CCPA)

If you are a California resident, you have the right to know what data we collect, to delete it, and to opt out of its sale. We do not sell personal information. Contact us at charossrl@gmail.com to exercise these rights.

9. Children's Privacy

The App is not directed to children under 13. We do not knowingly collect data from anyone under 13. If we become aware of such data, we will delete it promptly. Users aged 13–15 in the EU must have parental consent. Parents may contact us at charossrl@gmail.com.

10. Security

We implement HTTPS/TLS encryption, cryptographically hashed passwords, short-lived JWT tokens stored in encrypted device storage, and server-side access controls. No internet transmission is 100% secure; you use the App at your own risk.

11. Changes to This Policy

Material changes will be communicated in-app at least 14 days before taking effect. Continued use after the effective date constitutes acceptance.