PRIVACY POLICY

This privacy policy applies to the Metro Habit application for mobile devices, together with any related services operated by CDev (collectively, the "Application"). CDev is hereby referred to as the "Service Provider", "we", "us", or "our".

At Metro Habit Tracker, your privacy is fundamentally respected by architectural design. We believe your personal routines, habits, goals, and daily progress belong solely to you.

The Application is distributed via the Apple App Store (Apple ID: 6808981757) and Google Play Store (Package: com.cdev.metrohabit).

The Application is built with a local-first philosophy. Core tracking data remains isolated within an encrypted, sandboxed local SQLite database on your device:

• Habit definitions, custom categories, targets, and scheduling intervals.
• Completion logs, session durations, daily marks, and timestamps.
• Streak counters, milestone scores, and unlocked achievement badges.
• Custom Metro accent theme preferences and user settings.

This local data is never transmitted to external servers, harvested for analytics profiling, or sold to third-party data brokers.

// AUTOMATICALLY COLLECTED DATA

When you download and use the Application, certain technical information may be collected automatically by the platform or integrated SDKs:

• Your device's Internet Protocol (IP) address.
• The screens or pages of the Application that you visit, the time and date of your visit, and the time spent on those screens.
• The total time spent actively interacting with the Application.
• Your mobile operating system brand, version, and device hardware specifications.

The Service Provider may also use the information you provide (such as when you contact support via chuongdev97@gmail.com) to provide customer support, deliver important notices, and, where permitted by law, send critical product communications.

Subscribers to Metro Habit Pro may optionally choose to enable cross-device cloud synchronization.

• Infrastructure: Provided by Google Firebase Authentication & Cloud Firestore.
• Encryption: All habit records synced to the cloud are encrypted in transit via TLS 1.3 and at rest via AES-256 encryption.
• User Control: You can disconnect your cloud account or purge your synchronized cloud backup at any time with a single tap in Settings.

The Application or its third-party SDKs may use cookies, software development kits (SDKs), pixels, and local caching technologies to support essential functionality, analytics telemetry, or service delivery.

Where required by applicable data protection laws, the Service Provider will obtain explicit consent before initializing or using non-essential tracking technologies.

Only aggregated, anonymized data is periodically transmitted to external services to aid the Service Provider in diagnosing stability issues and improving the Application.

The Application utilizes third-party services that maintain their own independent Privacy Policies governing data processing. Below are direct links to their policies:

• Google Play Services
• Google AdMob
• Google Analytics for Firebase
• Firebase Crashlytics
• RevenueCat

To maintain the free tier of Metro Habit Tracker, non-intrusive advertisements may be served via Google Mobile Ads (AdMob).

• EEA, UK & GDPR Compliance: In compliance with the General Data Protection Regulation (GDPR) and the ePrivacy Directive, the Application implements the Google User Messaging Platform (UMP) to obtain verified consent before serving ads to users located within the European Economic Area (EEA) and the United Kingdom.
• Consent Management: You can review, update, or revoke your advertising and tracking consent preferences at any time in the app via Settings → Privacy & Ad Consent.
• Metro Habit Pro: Upgrading to Pro completely deactivates and disables all ad SDK initialization and tracking.

To ensure stability and accelerate bug fixes, the Application integrates Firebase Crashlytics. When an application exception occurs, technical telemetry is transmitted anonymously, including:

• Device model hardware identifier and operating system version (e.g., iOS 17.4 or Android 14).
• Application binary build number and version identifier.
• Stack traces and memory allocation states at the moment of failure.

Crash reports never include user habit titles, logs, notes, or personally identifiable information.

The Service Provider or its third-party service providers may process and transfer personal data to servers located in countries outside your country of residence, including outside the European Economic Area (EEA).

Where applicable law requires safeguards for cross-border transfers, the Service Provider relies on appropriate legal mechanisms, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions issued by relevant supervisory authorities.
• Your explicit consent, where required and legally permitted.

The Service Provider may disclose User Provided and Automatically Collected Information under the following limited circumstances:

• As required by law, such as to comply with a subpoena, warrant, court order, or similar legal process.
• When the Service Provider believes in good faith that disclosure is necessary to protect legal rights, defend against fraud, protect user safety, or respond to lawful governmental requests.
• With trusted service providers who work on our behalf, do not have an independent right to use the disclosed information, and are bound by strict confidentiality and data protection agreements.

The Service Provider retains personal data only as long as necessary for the stated operational and legal purposes:

• User Provided Data: Retained for the duration of your active use of the Application plus 12 months thereafter, unless a longer retention period is mandated by law.
• Automatically Collected Telemetry: Retained for up to 24 months from collection, after which it is automatically purged.
• Aggregated & Anonymized Data: Retained indefinitely for statistical modeling as it can no longer identify any individual.
• Compliance Records: Retained for statutory periods required by applicable regulatory obligations.

You may request deletion of your personal data at any time, subject to any statutory retention requirements. Contact the Service Provider at chuongdev97@gmail.com.

You possess comprehensive legal rights regarding your personal information under the GDPR, CCPA/CPRA, and international data protection laws:

• Right to Access & Portability: You can export all your habits, histories, and metrics as a standard JSON file at any time via Settings → Data Export.
• Right to Rectification: You can edit any habit data directly in the application interface.
• Right to Erasure (Right to be Forgotten): You can instantly wipe all local data via Settings → Wipe All Data. To request deletion of any cloud-synced records, contact the Service Provider.
• California Privacy Rights (CCPA/CPRA): California residents have the right to know what personal data is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal data (we never sell or share your data for monetary or cross-context behavioral advertising), and the right to non-discrimination for exercising these rights.

To exercise any of these rights, email the Service Provider at chuongdev97@gmail.com.

You can immediately halt all data collection by uninstalling the Application from your mobile device. Uninstalling will stop the Application from collecting further data from your device, but does not automatically purge information previously transmitted to cloud services or third parties.

To request complete deletion of previously transmitted data or to withdraw consent, contact chuongdev97@gmail.com.

The Application is not intended for children under 16 years of age (or such higher age as required by applicable law in your jurisdiction). The Service Provider does not knowingly solicit or collect personal data from children.

If the Service Provider discovers that a child under 16 has provided personal information, we will immediately delete that information from our servers. Parents or legal guardians who become aware that their child has provided personal information should immediately notify the Service Provider at chuongdev97@gmail.com.

The Service Provider provides physical, electronic, and procedural safeguards to protect the confidentiality and integrity of information we process and maintain.

// DATA BREACH NOTIFICATION

If a security incident or data breach occurs that impacts your personal data, the Service Provider will notify affected users and supervisory authorities in accordance with applicable legal requirements, detailing the nature of the breach, the affected data categories, and the remediation steps underway.

The Service Provider may update this Privacy Policy periodically. We will notify you of material changes by posting the revised policy on this page along with an updated effective date. Where legally mandated, we will obtain your affirmative consent before material changes take effect.

Previous revisions of this Privacy Policy are archived and will be provided upon request via chuongdev97@gmail.com.

Where processing is founded on consent, you provide consent by affirmatively opting in. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

For questions, feedback, or data privacy requests regarding Metro Habit Tracker, please contact:

Data Protection Contact: CDev
Email: chuongdev97@gmail.com

This privacy policy incorporates provisions generated via App Privacy Policy Generator and tailored for Metro Habit Tracker's local-first architecture.