Privacy Policy

1. What stays on your device

Your personal tracker is written to Hobbiary’s private storage on your device by default. It is not uploaded until you sign in and explicitly apply the migration preview.

• Profile preferences: display name, bio, time zone, appearance, units, clock format, language
• Hobbies you keep, custom hobbies you create, and any tracker fields you add, rename, reorder or hide
• Activity records: date, time, duration and everything you enter into a tracker field, including free-text notes
• Weekly goals, reminder days and times, and the XP, level and streak values calculated from your records
• Photos you attach to an activity, and the weekly automatic snapshot the app keeps

2. What Hobbiary never does

In local-only use, Hobbiary makes no network requests and we never receive your records. Optional social access uses email OTP, verified phone and adult eligibility. Supabase stores the account, verified profile, migrated tracker copy, entitlements, devices, rooms, memberships and moderated chat needed for those features. Anonymous accounts are not used.

There is no advertising, no remote analytics and no use of personal tracker content for profiling. The device-first tracker can continue offline; queued authenticated sync resumes only after reconnecting. Reminders are scheduled locally by the operating system. Room notifications are a separate opt-in for social access: after you grant permission, a push token is stored with your account and notifications are delivered through Expo’s push service and Apple or Google. They carry a generic line and a room reference, never message text, and you can turn them off in Profile.

3. Permissions

Hobbiary asks for the minimum, at the moment it is needed, and never as a condition of using the app. Photo library access is requested only when you tap to attach a photo, and uses your system picker, which hands back only the image you select. Camera access is requested only when you choose to take a photo. Notification permission is requested only when you save your first reminder or turn on room notifications; declining leaves everything else working.

When you attach a photo, Hobbiary decodes it and writes a fresh, resized JPEG into its own storage. Because the saved file is re-encoded rather than copied, the original file’s embedded metadata, including any GPS coordinates, is not carried into the stored copy. Your original photo is left untouched.

4. When data can leave your device

Every route is under your control, and local tracker data stays local until you choose authenticated migration.

• Operating-system backup: if iCloud Backup or Android Auto Backup is on, your OS may include Hobbiary’s storage in its device backup, under its own terms. We cannot see or reach that backup.
• Manual export: Profile › Export backup file creates a JSON file and hands it to your system share sheet. You choose the destination; the file never passes through us.
• Authenticated social migration and sync: after email, phone and adult checks, the selected tracker snapshot is copied to your account. The account copy supports cross-device sync; the local snapshot is not deleted automatically.
• Rooms and chat: room discovery, membership, public profile fields and text messages are sent to the social service so the feature can work. Exact venue details are restricted to eligible room members; moderation and retention rules apply.
• Linked backup folder on Android: an optional extra weekly copy written to a folder you choose. When the provider permits listing and deletion, Hobbiary keeps the three newest linked copies. If it only permits writing, older copies can remain until you remove them.
• Anything you do yourself: screenshots, copy-paste, or sharing a photo you attached.
• Contacting us: Hobbiary never sends a support message or diagnostic report. If you choose to email us, we receive only the address, message and attachments you decide to send; that correspondence is handled through our email provider and is separate from the app’s local records.

5. Two things to know about export files

Exported files are plain, unencrypted JSON. Anyone who opens one can read every record in it, so store it somewhere protected, as you would any other personal document.

Exported files do not contain your photos. Photo files stay on the device and travel only through operating-system backup, not through export.

6. Our position under data protection law

For local-only use, Hobbiary does not receive your tracker records. If you opt into social access, the publisher and configured infrastructure process the account, migrated tracker, room and chat data described above to provide those services. The applicable rights under the GDPR, UK GDPR and comparable laws include access, correction, deletion and portability, subject to safety retention and legal obligations.

Apple, Google, Supabase and the configured messaging or payment providers may process information under their own notices. No service-role secret is shipped in the mobile app.

This social policy remains a release draft until the production legal review and the provider list are published.

7. Your rights, and the honest answer

For local data, access, export, correction and reset happen on the device. For social data, use the in-app account deletion flow, follow https://hobbiary.app/delete-account if you cannot use the app, or contact the publisher; deletion is carried out seven days after the request, can be cancelled until then, and does not erase local exports, OS backups or inaccessible device copies. Resetting does not reach copies in an Android linked backup folder or files you already exported elsewhere.

You can still write to us with any question or formal request, including through a supervisory authority such as the KVKK, your national data protection authority, the ICO or your state Attorney General.

8. Children, security and contact

Hobbiary’s local tracker is intended only for adults aged 18 and over. Social rooms additionally require an adult confirmation, verified email, verified phone and Premium entitlement.

Your records are protected by your device’s own lock screen, storage encryption and app sandboxing. Being straightforward about the limits: Hobbiary adds no separate password or biometric lock of its own, exported files are not encrypted, and sandboxing cannot be relied on on a rooted or jailbroken device. In local-only use we cannot recover your records if you lose your device, uninstall the app or reset your data, because no copy exists anywhere for us to restore from.

Publisher: Hobbiary, Istanbul, Türkiye. Privacy contact: contact@hobbiary.app. We respond within thirty days.