Privacy Policy

We collect the following categories of personal data:

• Account data — your full name, email address, username, and password (stored only as a securely hashed value), provided when you sign up.
• Content you create — goals, descriptions, progress updates, comments, reactions, and any other information you choose to add to your profile or goals.
• Social graph — the friends you connect with and the group or head-to-head goals you take part in.
• Technical data — limited information such as your device type, browser, approximate location inferred from IP address, and log data generated automatically when you use the Service.
• Communications — messages you send us for support or feedback.

We use personal data to:

• Create and manage your account and authenticate you when you log in.
• Provide the core features of the Service, including goals, social connections, and notifications.
• Keep the Service secure, prevent fraud and abuse, and enforce our Terms.
• Respond to your requests and provide customer support.
• Understand how the Service is used so we can improve it.
• Comply with legal obligations.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR: performance of our contract with you (to provide the Service); our legitimate interests (to secure, maintain, and improve the Service), balanced against your rights; your consent (where required, for example for non-essential cookies); and compliance with legal obligations.

We do not sell your personal data. We share it only as needed to run the Service:

• Service providers (processors) — we use Supabase for database hosting and authentication. Such providers process data on our behalf under contractual safeguards.
• Other users — content you choose to share with friends or in group and head-to-head goals is visible to those participants.
• Legal and safety — we may disclose data when required by law or to protect the rights, safety, and security of kojo, our users, or the public.
• Business transfers — if kojo is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to this policy.

kojo is available globally, and your data may be processed in countries other than your own, including countries that may not provide the same level of data protection as your home country. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We keep your personal data for as long as your account is active and as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to keep it to comply with legal obligations, resolve disputes, or enforce our agreements.

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (the “right to be forgotten”).
• Restriction and objection — ask us to limit or stop certain processing.
• Portability — receive your data in a portable format.
• Withdraw consent — where we rely on consent, withdraw it at any time.

California residents have additional rights under the CCPA/CPRA, including the right to know what personal information we collect and the right to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under California law. To exercise any of these rights, contact us at [privacy@justkojo.com]. You also have the right to lodge a complaint with your local data protection authority.

We use cookies and similar technologies, primarily to keep you signed in and to keep the Service secure. For details, see our Cookie Policy.

We take reasonable technical and organisational measures to protect your data, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, however, so we cannot guarantee absolute security.

kojo is not directed to children under 16 (or the minimum age in your country). We do not knowingly collect personal data from children below that age. If you believe a child has provided us with personal data, contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by updating the “Last updated” date above. We encourage you to review it periodically.

For privacy questions or to exercise your rights, contact us at [privacy@justkojo.com] or [Legal Entity Name], [Company Address].