Privacy policy

Introduction

Reach it is developed and published by Yosua Koeswandy, an individual developer, who is the data controller for the information described here. This policy explains what information the Reach it Android app (“Reach it”, “we”, “us”) collects, why we collect it, who we share it with, and what control you have over it.

Reach it is a goal, habit and task tracker. It is designed to work fully offline. You do not need an account to use it, and if you never sign in, none of the goals, habits or tasks you create ever leave your device.

By using Reach it you agree to this policy. If you do not agree, please stop using the app.

Questions, requests or complaints: reach17.it@gmail.com

Summary

We do not show advertisements. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

1. Data stored on your device

Everything you create in Reach it is stored in a database on your phone:

• Goals: name, description, icon, target value and units, start and completion dates, progress entries and progress history, and links to habits or tasks
• Habits: name, description, icon, frequency settings, active days, start date, archive date, and the completion status (completed, skipped, failed or pending) recorded for each date
• Tasks: name, notes, due dates and completion status
• Reminders: the times of day you choose to be reminded
• App settings: theme, week start day, chosen navigation tab, widget configuration and onboarding hints

This information stays on your device unless you turn on Cloud Sync. It is removed when you uninstall the app or clear its data. If your device has Android backup enabled, Android may include the app’s data in your device backup; that backup is controlled by Google and your device settings, not by us.

2. Cloud Sync (optional)

Cloud Sync is off by default. You turn it on from Settings by signing in.

Signing in. Sign-in uses Google. When you sign in, Google Firebase Authentication creates an account record for you containing your email address, the display name and profile photo associated with your Google account, a unique account identifier, and the dates you created the account and last signed in. Firebase also records technical sign-in information such as your IP address. We never receive or store your Google password.

What is synced. Once Cloud Sync is on, the app copies the goals, habits, tasks, date statuses, reminders, goal and habit links, and goal progress entries described in section 1 to Google Cloud Firestore. They are stored under a path that is private to your account, and our security rules allow only a request authenticated as your account to read or write it. The app also uses Firebase App Check (Play Integrity) to reject requests that do not come from a genuine installation of Reach it.

When it syncs. After the first sync, the app syncs in the background roughly once an hour while your device has a network connection, and whenever you press Sync now.

Deleted items. When you delete a goal, habit or task while Cloud Sync is on, the record is marked as deleted rather than removed immediately, so that the deletion can be applied to your other devices. These markers are removed when your account data is deleted (see section 7).

Turning it off. Signing out stops syncing and leaves your data on the device. Signing out does not by itself delete the copy held in Firestore. To have that copy deleted, email us at the address above.

3. Analytics

Reach it uses Google Analytics for Firebase to understand how the app is used in aggregate, so we can decide what to improve. This includes screens viewed, session and engagement time, interactions with features, and general technical information such as device model, operating system version, app version, country and language.

Reach it does not use the Android advertising ID. The app removes that permission, so analytics cannot be tied to an advertising identifier. We do not run ads, we do not build advertising profiles, and we do not use analytics for advertising of any kind.

We do not attach your name, email address, or the content of your goals, habits or tasks to analytics events.

Your control. Uninstalling the app stops all analytics collection.

4. Crash reporting

The version of Reach it published on Google Play includes Firebase Crashlytics. If the app crashes or hits an error, it sends a report containing the technical details of the fault: the stack trace, device model, operating system version, app version, available memory and storage, and a random installation identifier. Crash reports do not contain your goals, habits, tasks or notes. Crashlytics is disabled in internal development builds.

5. Purchases

Reach it offers an optional premium upgrade. Payment is handled entirely by Google Play Billing. We never see your card number, bank details or billing address. We receive only the record of whether a purchase for your Google Play account is active, which the app uses to unlock premium features. Google’s handling of your payment is covered by the Google Payments privacy notice.

6. Who we share data with

We do not sell your personal information and we do not share it for advertising. We share it only with the service providers that make the app work, and only for that purpose:

• Google (Firebase Authentication, Cloud Firestore, Google Analytics for Firebase, Crashlytics, App Check) and Google Play Services / Google Play Billing. See policies.google.com/privacy.

We may also disclose information if we are legally required to, or where it is necessary to investigate abuse or protect the rights and safety of our users.

Google’s servers may be located outside your country, including in the United States. For users in the European Economic Area and the United Kingdom, these transfers rely on the safeguards in Google’s data processing terms, including the European Commission’s Standard Contractual Clauses.

7. How long we keep your data

• Data on your device: until you delete it in the app, clear the app’s data, or uninstall.
• Data in Cloud Firestore and your Firebase Authentication account: until you ask us to delete it, or until the account has been inactive long enough that we remove it as part of routine clean-up.
• Analytics and crash data: for Google’s standard retention periods for these products.

8. Deleting your data

Reach it does not yet offer in-app account deletion. To delete the copy of your data held in the cloud and the account itself, email reach17.it@gmail.com from the address you signed in with, or tell us which address to delete. We will delete your Firestore data and your authentication account and confirm when it is done, normally within 30 days.

Deleting your cloud data does not remove the copy on your device. To remove that, delete the items in the app or uninstall Reach it.

9. Your rights

Whatever country you are in, you can ask us to give you a copy of the data we hold about you, correct it, or delete it. Email reach17.it@gmail.com. We will respond within 30 days. We will not charge you or treat you differently for making a request.

If you are in the European Economic Area or the United Kingdom (GDPR)

You have the right to access, rectify, erase and receive a portable copy of your personal data, to restrict or object to processing, and to withdraw consent at any time. Our legal bases are:

• Providing the app itself, including Cloud Sync once you enable it: performance of our agreement with you.
• Analytics and crash reporting: our legitimate interest in keeping the app working and improving it.
• Anything you have specifically agreed to, such as signing in for Cloud Sync: your consent, which you can withdraw by signing out and asking us to delete your data.

You also have the right to complain to your local data protection authority.

If you are a California resident (CCPA/CPRA)

The categories of personal information described in this policy are the ones we collect. We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding twelve months. You have the right to know, delete, correct and to be free from discrimination for exercising those rights. Use the email address above to make a request.

10. Children

Reach it is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Security

Cloud data is transmitted over encrypted connections and stored by Google Firebase, which encrypts data at rest. Access is restricted by security rules to the signed-in account that owns the data, and by Firebase App Check. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy from time to time. The current version is always published at reachitapp.com/privacy.html, with the date of the last change at the top. Material changes will be highlighted in the app or in the release notes.

13. Contact

Yosua Koeswandy, developer of Reach it
reach17.it@gmail.com