Privacy Notice

This Privacy Notice explains how Alexandru Dimitriu("we", "us", "Three Lights") collects, uses, and shares personal data when you use the Three Lights app and website (the "Service").

We act as the data controller for personal data we collect about you through the Service.

1. What we collect and why

• Account data — your name, email, and password hash. Used to create your account, sign you in, and contact you about your account.
• Habit data — the daily green / yellow / red marks you enter, custom habits you create, and the groups you join. Used to provide the core habit-tracking features and show your history.
• Support messages — what you tell us when you contact support. Used to respond to you and fix issues.
• Notification tokens — if you enable reminders or nudges, we store the push token your browser or device issues. Used only to deliver the notifications you asked for.
• Usage and device data — basic telemetry such as IP address, device type, browser, and pages viewed, including privacy-friendly product analytics (Google Analytics) on our website. Used for security, fraud prevention, and to improve the Service.

1a. The Three Lights iOS app

The iOS app shows the same Three Lights service and collects the same data as the website. In addition it may use:

• Push notifications — an Apple push token, so we can send the reminders and group nudges you enable.
• Photos (save only) — when you export a progress card, the image is saved to your photo library on your device. We never read your photo library.

We do not track you across other companies' apps or websites, and we do not use your data for advertising. Subscriptions are not sold inside the iOS app.

2. Legal basis

We rely on:

• Contract — to create your account and provide the Service.
• Legitimate interests — to keep the Service secure, prevent fraud, and improve features.
• Consent — for any optional communications you opt into.
• Legal obligation — where we are required by law to retain or disclose data.

3. Who we share data with

We share data only with:

• Service providers (subprocessors) we use to run the Service, including hosting and database infrastructure (Supabase / Lovable Cloud).
• Paddle, our Merchant of Record, for processing payments, managing subscriptions, handling tax compliance, and issuing invoices. Paddle acts as an independent controller for payment data.
• Professional advisers such as legal and accounting advisers, where needed.
• Authorities, where required by law or to protect our rights.

We do not sell your personal data.

4. International transfers

Some of our service providers may process your data outside your country of residence, including outside the UK and EEA. Where this happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.

5. Retention

We keep your account and habit data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to keep it (for example, billing records).

6. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your data ("right to be forgotten");
• Restrict or object to certain processing;
• Receive your data in a portable format;
• Withdraw consent at any time, where we rely on consent;
• Lodge a complaint with your local data protection authority.

To exercise these rights, email hey@3lights.app. We'll respond within one month.

7. Security

We use appropriate technical and organizational measures to protect your data, including encryption in transit, access controls, and hashed passwords. No system is perfectly secure, but we take this seriously.

8. Cookies and analytics

We use essential cookies and local storage to keep you signed in and to remember basic preferences. We do not use advertising cookies and we do not sell or share data for cross-context behavioural advertising. Our website uses Google Analytics to understand aggregate usage; the iOS app does not run advertising or cross-app tracking SDKs.

8a. Deleting your account

You can permanently delete your account and data at any time from inside the app: More → Delete account. This removes your profile, habits, history and group memberships. You can also email hey@3lights.app and we will do it for you.

9. Children

Three Lights is not intended for children under 13 (or the minimum age in your country). If you believe a child has created an account, please contact us so we can remove it.

10. Changes to this notice

We may update this Privacy Notice from time to time. We will post the new version here and update the "last updated" date.

11. Contact

Questions about your privacy? Email hey@3lights.app.