Privacy Policy

1. Who this covers

This policy applies to the Tiny Wins mobile app (com.dkenapp.tinywins) published by Dkendev on Google Play and the App Store. It does not cover any third-party services that integrate with the app (their own policies apply, listed below).

2. What we store locally on your device

The following data never leaves your device unless YOU choose to export it via Settings → Your data → Export backup.

• Your habits and check-in history (SQLite, AES-256 encrypted via SQLCipher).
• Your pet state and achievements (same encrypted SQLite store).
• Your brain-dump notes (same encrypted SQLite store).
• App preferences — theme, accent colour, reminder times, notification sound, Pause Week timestamp, lifetime points counter (Android SharedPreferences / iOS UserDefaults; not encrypted because OS-level sandboxing already protects them).

3. What leaves your device (and to whom)

• Google AdMob — Serves banner, interstitial, rewarded and app-open ads to free users only. Receives: your device's advertising ID and standard ad-tech signals. Personalised ads only when your OS-level tracking permission allows it (Android user consent / iOS ATT). Upgrading to Tiny Wins Plus removes ads entirely. AdMob's policy: policies.google.com/technologies/ads.
• Firebase Analytics — Anonymous, aggregated app-open and check-in counters. We do NOT send your habit names, brain-dump text, pet state, or any personally identifiable content. IP addresses are anonymised by Firebase before any geolocation lookup. Firebase policy: firebase.google.com/support/privacy.
• Google Play Billing — When you purchase Tiny Wins Plus, Google processes the transaction directly. We receive a purchase token (an opaque string) to verify your Plus status. We never see your card number, name, or billing address.
• Crashlytics (only if enabled in a future release) — Stack traces from app crashes, with no user content attached. Disable from the OS-level crash-reporting toggle.

4. What we do not do

• We do not run a server, account system, or sync service.
• We do not sell your data. Ever. (Not "with consent" — at all.)
• We do not share habit content, notes, or pet state with anyone.
• We do not use any third-party tracker beyond the ones listed above.
• We do not back up your encrypted database to Google Auto-Backup (android:allowBackup="false").

5. Your rights (GDPR, UK GDPR, CCPA / CPRA)

• Access & portability — Settings → Your data → Export backup hands you a complete JSON of everything stored locally. Nothing held back on a server.
• Erasure (right to be forgotten) — Settings → Your data → Delete all my data wipes the local DB, the encrypted pet assets cache, and all SharedPreferences immediately. The action is irreversible — there is no cloud backup we can restore from.
• Rectification — Edit any habit, check-in or brain dump in-app at any time.
• Withdraw consent — Disable Firebase Analytics at the OS level (Android: Settings → Privacy → Ads → Delete advertising ID; iOS: deny ATT). Disable ads entirely by upgrading to Tiny Wins Plus.
• Object to processing & non-discrimination — Free users get the same core habit-tracker as paid users. No feature is hidden behind data sharing.
• Lodge a complaint — EU residents may contact their national data-protection authority. UK residents: ICO. California residents: California Privacy Protection Agency.

6. Children's privacy (COPPA)

Tiny Wins is rated for ages 13+ on Google Play and 12+ on the App Store. We do not knowingly collect data from children under 13. If a parent or guardian believes their child has used the app and a brain-dump capture or check-in needs deleting, email us at the address below and we'll walk you through the in-app Delete All Data flow.

7. Data retention

Local data lives until you delete it via the in-app wipe, the OS-level app data clear, or by uninstalling the app. Firebase Analytics retains aggregated metrics for up to 14 months per Google's default. Play Billing tokens are kept by Google for the lifetime of the purchase relationship.

8. International transfers

Because we don't run a server, the only cross-border transfers involve the Google services listed in §3. Those transfers are governed by Google's Standard Contractual Clauses for EU/UK personal data and are covered in Google's own policies.

9. Changes to this policy

If we materially change what data leaves the device, we'll bump the "Effective" date at the top and surface an in-app notice on the next launch. Continued use after the notice constitutes acceptance. Trivial editorial fixes (typos, link updates) won't trigger a notice.

10. Contact