GDPR Information

Your Data Protection Rights

The General Data Protection Regulation (GDPR) gives individuals whose personal data falls within its scope specific rights regarding that data — because we are established in the Netherlands, this covers our processing regardless of where you live. At LeetTracker, we are committed to respecting and facilitating these rights. This page provides detailed information about your GDPR rights and how to exercise them.

Your Rights Under GDPR

Right of Access (Article 15)

You have the right to obtain confirmation as to whether your personal data is being processed, and if so, to access that data along with information about:

The purposes of the processing
The categories of personal data concerned
The recipients or categories of recipients
The envisaged storage period
The source of the data (if not collected from you)

How to exercise: Email us at info@leetlabs.io and we will provide a copy of your data.

Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected without undue delay. You also have the right to have incomplete personal data completed.

How to exercise: Contact us at info@leetlabs.io and we will correct or complete your data.

Right to Erasure (Article 17)

Also known as the "right to be forgotten," you have the right to request deletion of your personal data when:

The data is no longer necessary for the purposes it was collected
You withdraw consent (where consent was the legal basis)
You object to the processing and there are no overriding legitimate grounds
The data has been unlawfully processed
The data must be erased for compliance with a legal obligation

How to exercise: You can delete your account through the LeetTracker mobile app by navigating to Settings → Account → Delete Account, or request erasure by email. Deletion immediately and permanently removes your personal data from our live systems, including:

Your account credentials and profile information
All check-in history and streaks
All unlocked achievements
All associated authentication tokens

This action is irreversible. Residual copies in database backups are automatically pruned after 7 days.

Right to Restriction of Processing (Article 18)

You have the right to request restriction of processing when:

You contest the accuracy of the data (during verification)
The processing is unlawful but you prefer restriction over erasure
We no longer need the data but you need it for legal claims
You have objected to processing (pending verification)

How to exercise: Email us at info@leetlabs.io to request restriction of processing.

Right to Data Portability (Article 20)

Where processing is carried out by automated means and based on contract or consent, you have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit it to another controller (directly, where technically feasible).

How to exercise: Email us at info@leetlabs.io and we will provide your data in a portable format (JSON).

Right to Object (Article 21)

You have the right to object to processing of your personal data based on legitimate interests. Upon objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

How to exercise: Email us at info@leetlabs.io to object to specific processing activities.

Right to Withdraw Consent (Article 7)

Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

How to exercise: We do not currently process personal data on the basis of consent, so there is nothing to withdraw today. Device-level permissions (such as notification reminders) are controlled in your device settings and never reach our servers. If we ever introduce consent-based processing, withdrawing consent will be as easy as giving it — contact us at info@leetlabs.io with any questions.

What Data We Process

LeetTracker processes the following categories of personal data:

Category	Data	Purpose	Legal Basis
Account Data	Email, password hash, display name, Google account identifier and profile picture URL (Google Sign-In), creation and last-login dates	Authentication, account management	Contract
Security Data	Refresh tokens, email verification and password reset codes (short-lived, expire or are revoked automatically)	Session management, account security	Contract
Check-in Data	Timestamps, timezone, streaks	Core service functionality	Contract
Achievement Data	Unlocked achievements	Core service functionality	Contract
Technical Data	Server logs (IP address, request metadata, and in some error and security events your email address)	Security, abuse prevention, bug fixing	Legitimate Interest

Data Retention

We retain your personal data only for as long as necessary:

Active accounts: Data is retained while your account is active
Deleted accounts: Data is removed from live systems immediately; residual copies in database backups are pruned after 7 days
Server logs: Retained for up to 30 days

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of personal data in transit (TLS/SSL)
Passwords stored only as salted cryptographic hashes
Secure authentication mechanisms with rate limiting
Automated dependency vulnerability auditing on every build
Secrets stored encrypted in the cluster (sealed secrets)
Access controls and least-privilege database roles

International Data Transfers

Our servers and database are hosted on our own infrastructure in the Netherlands (European Union). Where a service provider processes limited data outside the European Economic Area (EEA) — Google, both for Google Sign-In and for delivering our account emails — we rely on:

Adequacy decisions where the destination provides adequate protection (Google LLC is certified under the EU–U.S. Data Privacy Framework)
Standard Contractual Clauses (SCCs) approved by the European Commission

How to Exercise Your Rights

You can exercise your GDPR rights by:

Deleting your account directly in the app (Settings → Account → Delete Account)
Emailing us at info@leetlabs.io for access, rectification, erasure, portability, restriction, or objection requests

When you submit a request, we will:

Verify your identity to protect your data
Respond within one month (or notify you of any extension)
Provide the service free of charge (unless requests are manifestly unfounded or excessive)

Right to Lodge a Complaint

If you believe that we have not complied with your data protection rights, you have the right to lodge a complaint with a supervisory authority. You can contact:

The data protection authority in your EU member state of residence
The data protection authority where we are established
The data protection authority where the alleged infringement occurred

A list of EU data protection authorities can be found at: European Data Protection Board

Contact Us

If you have any questions about your GDPR rights or how we process your data, please email us at info@leetlabs.io.