Privacy Policy

Effective date: September 30, 2026

Acta (“the app”, “we”, “us”) is operated by West-East Forte. Acta is a private, group-based habit tracker: you form invite-only “squads”, set stakes on your habits, and hold each other accountable. This policy explains what we collect, who processes it, and how you can remove it. It applies to the Acta mobile app and this website.

1. Data we collect

• Account: your email address and a hashed credential, used to sign you in. We do not collect your real name or a profile photo.
• Content you create: squads, stakes (challenges), check-in text logs, proof photos you attach, chat messages, votes, and the optional note you send when requesting to join a squad.
• Safety and moderation: the list of users you block, and any report you submit about another user's content (what you reported and why).
• Purchase status: if you subscribe to Premium, our subscription partner RevenueCat processes the store receipt and we store a yes/no premium flag. We never see your card or bank details - payment is handled entirely by the Apple App Store or Google Play.
• Advertising identifier (with your control): on iOS, your device's advertising identifier (IDFA), or on Android your Google advertising ID - only if the date of birth you entered at sign-up shows you are 18 or older, and on iOS only if you also allow tracking when prompted. Used solely to measure which ad brought you to Acta - see Section 5.
• Private commitments: your identity claims, values, actions, cues, check-ins (including any optional note, photo, or quantity you attach), reflections, and adjustment history. Private commitments are visible only to you - never to a squad, never to us beyond storing them on your behalf.
• Referral program: your own referral code, which referral code (if any) you signed up with, your referral's status and timestamps, and any Premium reward granted through it.
• Email delivery: your email address is passed to our email provider (Resend, see Section 4) solely to send you confirmation and password-reset emails.

We do not collect precise geolocation, your contacts, your browsing history in other apps, or videos.

2. How your content is shared

Squads are private and invite-only. Your stakes, check-ins, chat messages, and votes are visible only to the members of the squad you posted them in. They are never listed publicly, never aggregated into a public feed, and never sold or shared with third parties for their own purposes.

3. How your content is verified

Completion is confirmed by your squad-mates, by peer vote. A simple majority of the other members counts. We do not run automated or AI analysis over your proof photos, check-ins, or chat messages, and your content is never used to train any model.

4. Processors

Your data is stored on Supabase (Postgres database, Authentication, and file Storage) in the Northeast Asia (Seoul, ap-northeast-2) region. Subscriptions are managed by RevenueCat, and payments are processed by the Apple App Store or Google Play. Resend delivers our confirmation and password-reset emails on our behalf (your email address only - see Section 1). AppsFlyer processes install-attribution data on our behalf - see Section 5. These providers process data on our behalf. This website is served as static files by Vercel, which stores no user data.

5. Third-party data sharing for advertising and attribution (Meta, AppsFlyer)

Acta shows no ads and never sells your personal data. We do run install ads for Acta on Meta platforms (Facebook/Instagram), and to measure whether they work we embed the Meta (Facebook) SDK in the app. This is the one case where limited data leaves our systems for a third party's own advertising purposes, so here is exactly what that involves:

• What is shared: your device's advertising identifier (IDFA on iOS, Google advertising ID on Android - only if you are 18 or older, and on iOS only if you allow tracking; see below), basic device/app metadata (device model, OS version, app version), and two event signals - that you completed registration, and, if you subscribe, the purchase amount and currency. We do not share your email, your name, your squad content, chats, votes, or proof photos with Meta.
• Why: to attribute app installs to the ad campaign that drove them and to measure/optimize our advertising spend. Meta may also use this data per its own privacy policy, including to inform ad delivery on its platforms.
• Your control on iOS: if the date of birth you entered at sign-up shows you are 18 or older, iOS's App Tracking Transparency prompt then asks permission to track you. Nobody younger, or whose age we don't know, is ever shown the prompt or tracked. If you decline, we do not collect or send your IDFA, and Meta receives no device-level identifier from us. You can review or change this anytime in Settings → Privacy & Security → Tracking.
• Your control on Android: the app only reads and shares your Google advertising ID if the date of birth you entered at sign-up shows you are 18 or older. You can also reset or delete your advertising ID anytime in Settings → Google → Ads on your device.
• Your date of birth: on both iOS and Android, anyone younger than 18, or whose age we don't know (for example, logging in to an existing account on a new device), never has an advertising identifier collected or sent. We keep only an "adult / not adult" result on your device - your date of birth itself is not stored or sent to us.
• Meta's own policy: data received by Meta is additionally governed by Meta's Privacy Policy, which is outside our control.

We also embed AppsFlyer, an attribution/measurement SDK, to route invite links correctly and to understand which channel (an ad, a squad invite, a referral link) led to an install or a return visit. Here is exactly what that involves:

• What is shared: your device's advertising identifier (subject to the same iOS App Tracking Transparency choice and Android ad-ID controls described above), basic device/app metadata, install and in-app event signals (registration and purchase), and - only when you open an Acta invite or referral link - the referral/deep-link parameters needed to route you to the right squad or attribute the referral correctly.
• Why: to measure which campaign, invite, or referral link actually brought a given install or action, and to make invite/referral links work (opening the right squad or crediting the right referrer) even for someone installing the app for the first time.
• AppsFlyer processes this data on our behalf as a service provider, under AppsFlyer's Privacy Policy.

Meta and AppsFlyer are the only third-party ad or analytics SDKs in the app. We do not build advertising profiles beyond what is described above, and this website sets no cookies and runs no analytics.

6. Retention and deletion

We keep your data for as long as your account exists. You can delete your account and all associated data at any time from Account → Delete account inside the app, or by following the steps on our account deletion page. Deletion removes your account, the squads you own (including their stakes and chats), your check-ins, votes, and proof photos. It also removes your private commitments, check-ins, and reflections, and your own referral records. Proof photos are deleted whenever the stake they belong to is deleted, or when your account is deleted. Your messages in other people's squads are kept but anonymized, so the conversation still makes sense to the remaining members. If you referred someone else, the Premium reward already granted to you is kept (their side of the referral record is anonymized, not deleted, so your reward isn't retroactively taken away). Deletion is immediate and permanent.

7. Local notifications

If you turn on reminders for a private commitment, they are scheduled entirely on your device using its own local notification system. We do not send push notifications, and no reminder data is sent to our servers or any third party.

8. Children

Acta is not directed at children under 13, and we do not knowingly collect data from them. Sign-up asks for your date of birth and does not allow an account to be created by anyone under 13. Users aged 13 to 17 can use Acta, but their device's advertising identifier is never collected or shared (see Section 5). If you believe a child has given us data, contact us and we will delete it.

9. Your rights

You may access, correct, export, or delete your data. The fastest route is in-app account deletion; for anything else, email us and we will respond within 30 days.

10. Changes to this policy

We may update this policy. Material changes will be reflected in the effective date above and, where required, notified in the app.

11. Contact

West-East Forte - west.eastforte@gmail.com