Privacy Policy

1. Introduction

Welcome to LeetTracker ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our daily check-in tracking application and website at leettracker.leetlabs.app (collectively, the "Service").

This policy is informational: it describes what we process, why, and on which legal bases. If you do not agree with our practices, please do not use our Service.

2. Data Controller

For the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, the data controller is the individual developer operating LeetTracker (LeetLabs), based in the Netherlands. You can contact us by email at info@leetlabs.io.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

• Email address (required for authentication)
• Password (stored only as a secure cryptographic hash, never in plain text)
• Display name (optional)
• If you sign in with Google: your Google account identifier and, where provided, your name and profile picture URL
• Account metadata (account creation date, last login date)
• Security and session data: refresh tokens and short-lived email verification and password reset codes

3.2 Check-in Data

When you use our Service, we collect:

• Check-in timestamps (date and time, on your device and on our server)
• The timezone your device reported at check-in
• Streak information and history
• Achievement progress and unlocked achievements

3.3 Technical Data

When your device or browser communicates with our servers, we automatically process certain technical information:

• Server logs of API requests, which may include your IP address, request metadata and, in some error and security events, your email address (retained for up to 30 days)
• Aggregate service metrics (request counts, error rates) that are not linked to your profile

We do not use third-party analytics, advertising, or crash-reporting services in the app or on the website.

3.4 Cookies and Local Storage

The website uses only strictly necessary authentication cookies when you sign in to the web app: an accessToken cookie (expires after 30 minutes) and a refreshToken cookie (expires after 7 days), used to keep you signed in and to refresh your session. We do not use analytics, advertising, or other tracking cookies, which is why we do not show a cookie consent banner. During registration the website also briefly stores your email address in your browser's session storage while you complete email verification. The mobile app stores your check-in history, achievements, and preferences in a local database on your device, and your session tokens in the device's secure storage.

4. How We Use Your Information

We use the information we collect to:

• Provide and maintain our Service
• Sync your check-in data across devices when you're logged in
• Track your streaks and calculate achievements
• Send you account-related emails (email verification, password reset, and important notices about your account) — we do not send marketing emails
• Diagnose and fix technical issues
• Protect against fraud and abuse (including rate limiting)
• Comply with legal obligations

Check-in reminders are local notifications scheduled on your device; they are controlled entirely by your device settings and do not involve our servers. The Service automatically calculates streaks and achievements from your check-in data, but we do not make solely automated decisions that produce legal or similarly significant effects for you (GDPR Article 22).

5. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our Service to you
• Legitimate Interests: Processing of server logs for service security, abuse prevention, and operational troubleshooting, where our interests do not override your rights
• Consent: We do not currently process personal data on the basis of consent; if we introduce an optional feature that relies on consent, we will ask for it explicitly and make withdrawing it as easy as giving it
• Legal Obligation: Processing necessary to comply with applicable laws

6. Data Sharing and Third Parties

We do not sell, trade, or rent your personal information to third parties. We may share your data only in the following circumstances:

6.1 Service Providers

We use trusted third-party services to help operate our Service:

• Email Delivery: Google (Gmail SMTP) delivers our account emails, such as verification codes and password resets, to every user regardless of sign-in method
• Authentication Provider: Google, if you choose to sign in with your Google account

The Service itself, including its database, runs on our own servers located in the Netherlands — no third-party cloud hosting provider processes your data.

6.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

7. Data Retention

We retain your personal data for as long as your account exists. You can delete your account and data at any time through the app settings (Settings → Account → Delete Account) or by contacting us; deletion from our live systems is immediate. Residual copies in database backups are automatically pruned after 7 days, and server logs are retained for up to 30 days.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please email us at info@leetlabs.io. We will respond to your request within one month.

9. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS)
• Passwords stored only as salted cryptographic hashes
• Secure authentication mechanisms with rate limiting
• Automated dependency vulnerability auditing on every build
• Access controls and least-privilege database roles

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

10. Children's Privacy

Our Service is intended for users aged 16 and older. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will take steps to delete such information.

11. International Data Transfers

Our servers and database are hosted on our own infrastructure in the Netherlands (European Union). Google may process limited data outside the European Economic Area (EEA): your authentication data if you sign in with Google, and your email address when delivering our account emails (Gmail SMTP). Google LLC is certified under the EU–U.S. Data Privacy Framework and also offers Standard Contractual Clauses approved by the European Commission. Contact us at info@leetlabs.io for details of the safeguards applicable to any specific transfer.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your data, please email us at info@leetlabs.io.

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not complied with applicable data protection laws.