Privacy Policy

1Who we are

H2U is a hydration tracking app for two people. You log what you drink; if you pair with a partner, each of you can see the other's daily progress and send short encouragements.

The controller of your personal data — the party that decides why and how it is processed — is:

Throughout this policy, "we" and "us" mean that entity, and "you" means the person using the app. It covers the H2U Android app and our website. It does not cover Google or any other service you reach from the app, each of which has its own policy.

2Summary at a glance

The detail follows, and the detail is what binds us. This is only an orientation. If you read nothing else, read §5, health data and your consent, and §10, how long we keep data — those cover the parts of this policy that are unusual.

3What we collect

Everything below is data the app actually stores. It is listed by category rather than by database table, but every category corresponds to real fields, and nothing has been padded with things we might collect one day.

Account and identity

• Email address — from Google sign-in, or from the address you enter to receive a one-time code.
• Google account identifier — if you sign in with Google, so we recognise you next time.
• Display name — taken from your Google profile, or set to "Me" if we have nothing. You can change it.
• Profile picture URL — only if your Google profile has one. Optional and often empty.

Health and body data

This is the category that matters most, and §5 deals with it separately.

• Sex, age, height and weight — used to calculate a recommended daily intake.
• Activity level and climate — the same calculation adjusts for both.
• Your daily hydration goal — the calculated result, or a figure you set yourself.
• Every drink you log — the amount, the type of drink, and the time you logged it.
• Daily totals and streaks — including the time of day you met your goal.

Your daily routine

We store the wake and sleep times you set, so reminders arrive while you are awake, and your time zone, so a "day" means your day and not ours.

We want to be plain about this, because it is more revealing than it looks: taken together, these fields describe the hours you are usually awake. We use them only to schedule reminders and to draw the day boundary correctly. We do not use them to infer anything else about you, and they are not shared with your partner or anyone else.

Pairing and messages

• Who you are paired with, and when the pairing was made.
• Invite codes you have issued or redeemed.
• Nudges — the short encouragements you send, including custom text of up to 140 characters.
• Blocks — if you block someone, we record it, so we can enforce it.

Device and technical data

• Push notification token and your device platform, so we can deliver notifications.
• Whether you granted notification permission, so we stop asking.
• Crash reports — if the app crashes, Firebase Crashlytics receives the stack trace, your device model, OS version and a device identifier.
• Install referrer — Google Play tells us which link brought you to the store, so an invite you received still works after you install. It carries no personal identifier of yours.
• IP address — visible to our hosting provider whenever the app talks to our servers, and to Google when the app loads its typeface (see §8).

Subscription data

If you subscribe, our payments provider gives us a subscriber identifier, which plan you bought, whether it is active, which store processed it and when it expires. It also records any free trial or coupon you redeemed. We never see your card number. Payment is handled entirely by Google Play.

Our website

Our web pages — the home page, this policy, our terms, the invite links and the account deletion page — set no cookies and carry no analytics, advertising or tracking scripts. They make no requests to any third party at all, including for typefaces, so visiting them discloses your IP address to nobody but our web host. There is no cookie banner because there is nothing to consent to. Our web host records standard server logs, including your IP address and request time, for a short period for security and diagnostics.

Because we do not track you across sites, there is nothing for a "Do Not Track" or Global Privacy Control signal to switch off. We honour them by default: we do not sell or share personal information, and we use no cross-site advertising technology.

What we do not collect

• No location data. The app has no location permission.
• No contacts, no calendar, no photo library.
• No advertising identifier, and no advertising or analytics SDK of any kind.
• No camera images. The camera reads a QR code during pairing; frames are decoded on your device and never uploaded or stored.
• No data from Google Fit, Apple Health or any wearable. We only have what you type in.

4Why we use it, and our lawful basis

If you are in the EEA, the UK or another jurisdiction that requires it, we must have a lawful basis for each purpose. Here they are, one row per purpose.

Where we rely on legitimate interests, we have weighed them against your rights and concluded ours do not override yours. You can object to any of it — §12 explains how, and we will explain our reasoning if you ask.

We do not use your data for automated decision-making that has a legal or similarly significant effect on you. The daily intake calculation is automated, but it is a suggestion you can override, not a decision about you.

5Health data and your consent

Your sex, age, height, weight, activity level and hydration record are data concerning health under Article 9 of the GDPR, and comparable categories under other laws. That places them in a stricter class than ordinary personal data, and we treat them accordingly.

Before we collect any of it, the app asks you to consent explicitly, in a separate step requiring a deliberate action of your own. We record the fact and time of that consent. We do not treat installing the app, signing in, or tapping through a screen as consent to health data processing.

You can withdraw that consent at any time, in Settings. Withdrawal takes effect from that moment: it does not undo processing that was lawful when it happened, but it stops processing going forward, and we erase the body metrics we hold. Withdrawing means we can no longer calculate a personalised target — you can set one yourself instead, or delete your account entirely.

6What your partner can see

Pairing is optional. The app is fully usable alone, and you are never required to pair to keep using it.

When you are paired, your partner sees:

• Your display name and profile picture.
• Your daily total and your goal, updating live.
• Whether you met your goal today, and your current streak.
• The last seven days of your daily totals as at the moment you pair, so the shared view is not empty on day one. Totals older than that stay private and are never exposed by pairing.

Your partner does not see:

• Your individual drinks, their types, or the times you logged them.
• Your sex, age, height, weight or activity level.
• Your wake and sleep times, your time zone, or your email address.
• Your subscription status, or anything you have blocked.

This is enforced in the database, not merely hidden in the interface. Partners read from a daily-totals table and have no access path to the underlying log rows, and the seven-day boundary is applied when the pairing is created rather than filtered in the app.

You can unpair at any time, from Settings, without your partner's agreement. Unpairing stops all future sharing immediately and removes their access to your past totals. Figures they have already seen are facts we cannot retrieve from their memory, but they lose access from that point on.

7Nudges and user content

A nudge is a short message — up to 140 characters — that you send to your partner as a notification. It is content you write, sent to another person, so a few things follow.

• We store nudges so they can be delivered and shown. They are not end-to-end encrypted; we hold them and could read them, though we do not do so routinely.
• Harassment is prohibited. Nudges used to threaten, abuse, demean or pressure another person breach our Terms.
• You can block. Blocking stops all nudges from that person immediately, and they are not told a block exists.
• Rate limits apply to how often nudges can be sent, and they are not delivered outside the recipient's waking hours.

There is no in-app reporting route today. If someone sends you unwanted nudges, block them — blocking stops all contact immediately — or write to us.

8Who we share data with

We name every recipient. We do not use phrases like "trusted partners" or "selected third parties", because they tell you nothing.

We do not sell your personal data, and we do not share it for advertising of any kind.

We may also disclose data where the law requires it — a valid court order, a lawful request from an authority — or to establish or defend legal claims. We will tell you if that happens, unless prohibited. If the business is ever sold or merged, your data may transfer to the acquirer, who will be bound by this policy until you are given notice of any change.

9International transfers

Our database is hosted in the ap-northeast-1 (Tokyo) region. Our other providers process data in the United States and elsewhere.

We are established in Japan, which the European Commission has recognised as providing an adequate level of data protection. Personal data reaching us from the EEA therefore transfers on the basis of that adequacy decision, without needing Standard Contractual Clauses.

Where data goes on to providers outside Japan and the EEA, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with the technical measures in §15. Where a provider states it is certified under the EU–US Data Privacy Framework, we rely on that framework in addition to the clauses above.

You can ask us for a copy of the safeguards applying to any specific transfer.

10How long we keep data

The two things that survive deletion

We are specific about this rather than letting "we delete everything" stand as a claim we cannot honour. Both are one-way hashes of your email address. Neither can be turned back into it, neither is used to contact you, and neither builds any profile of you.

1. So a reward cannot be claimed twice. H2U gives a free trial and a pairing reward, once per person. To stop the same person claiming them repeatedly by deleting and re-registering, we keep a hash of your address with the date it was claimed and the reason.

2. So a block cannot be escaped. If someone blocked you, a hash of your address stays on that block after your account is deleted. Without it, deleting your account would clear every block against you and let you reach the person again — which would make blocking meaningless for the person who relied on it.

For both:

• They are SHA-256 digests with a secret salt. They cannot be reversed into your email address.
• They are linked to no live account and hold nothing else about you — no name, no health data, no logs.
• Each is used for exactly one check, and nothing else.
• We keep them for three years from the date recorded, and then delete them automatically.

Three years is a deliberate number rather than a round one. What these hashes prevent is worth about five weeks of free premium, and nobody waits three years to collect that — so a longer period would add no real protection while holding your data for longer. We would rather keep less.

Our lawful basis is legitimate interests: preventing fraud for the first, and protecting another user from unwanted contact for the second. Because both exist to prevent harm, we may retain them even after an erasure request — GDPR Art. 17(3) permits retention where necessary for establishing or defending legal claims and for overriding legitimate grounds. The block hash in particular protects a different person's safety, and their interest weighs against your erasure request. If you object, tell us and we will review it against your circumstances and tell you what we decide.

11Deleting your account

Two routes, neither of which requires you to email us:

• In the app — Settings, then Delete account. Available even if your subscription has lapsed.
• On the web — our account deletion page, if you no longer have the app installed.

When you delete your account:

• Your profile, body metrics, drink logs, daily totals, routine times, push tokens, nudges, blocks and invites are erased.
• Any pairing ends immediately, and your partner stops seeing your data at once — including the shared history.
• Copies in encrypted backups disappear as those backups rotate.
• The two anti-abuse email hashes described in §10 are retained — one against rewards you claimed, one against any block another user placed on you.
• Subscription and payment records are retained for as long as tax law requires. Deleting your account does not cancel your subscription — cancel it in Google Play, which is the only place it can be cancelled.

If you want only part of your data removed rather than the whole account, ask us — §12 covers that.

12Your rights

Depending on where you live, you have some or all of the following. We honour them for everyone, regardless of location, because operating two standards is a way of getting one of them wrong.

Write to privacy@tennightlabs.com and tell us which right you want to use and which data it concerns. We respond within 30 days, and will tell you if a request is genuinely complex enough to need longer.

We will verify who you are before we act. Normally that means writing from the email address on your account, since handing someone else's hydration and body data to whoever asks would be a breach in itself. If we cannot match your request to an account, we may ask for one further piece of information — and we will not use it for anything else. An authorised agent may act for you with written proof of their authority.

Two limits worth stating plainly. We may keep records we are legally required to keep, such as payment records, even after an erasure request. And a request made mid-transaction — a subscription being processed, for instance — takes effect once that transaction completes.

Exercising any of these rights is free, and we will never treat you differently — no degraded service, no different price, no missing features — for having done so.

13Regional information

European Economic Area and United Kingdom

The rights in §12 are your rights under the GDPR and UK GDPR. Our lawful bases are in §4, and our transfer safeguards in §9. Health data is processed on the basis of your explicit consent under Art. 9(2)(a), which you can withdraw at any time.

You may complain to your national supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EEA, you may complain to the authority where you live, where you work, or where the alleged infringement took place; the list is at edpb.europa.eu.

India

Under the Digital Personal Data Protection Act 2023, we process your personal data on the basis of the consent described in §4 and §5, or for the legitimate uses the Act permits. You have the right to access a summary of your data, to correction and erasure, to nominate someone to exercise your rights if you die or become incapacitated, and to a grievance redressal mechanism. Contact us first; if we do not resolve your grievance, you may complain to the Data Protection Board of India.

California and other US states

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months.

California residents may request to know the categories and specific pieces of personal information we have collected, its sources, our purposes, and the categories of third parties to whom it is disclosed; may request deletion and correction; and may limit the use of sensitive personal information. Your health and body metrics are sensitive personal information under the CCPA/CPRA — we use them only to provide the service you asked for, but you can withdraw consent under §5 and we will erase them. We do not discriminate against anyone exercising these rights. An authorised agent may act for you with written proof.

Residents of Colorado, Connecticut, Virginia, Texas and other states with comprehensive privacy laws have broadly equivalent rights, including a right to appeal a refusal. To appeal, reply to our decision and we will review it and respond within 45 days.

14Children and minimum age

H2U is for people aged 16 and over. The app is not directed at children, it is not listed in a children's category, and we do not knowingly collect personal data from anyone under 16.

We chose 16 rather than 13 deliberately. Several EU member states set the age of digital consent at 16, and health data raises the stakes of getting it wrong. A single threshold satisfying the strictest applicable rule is safer than one that varies by country.

If we learn that someone under 16 has created an account, we delete it and the data with it. If you believe a child has given us personal data, write to us and we will act promptly.

15How we protect your data

• Encrypted in transit. Every connection between the app and our servers uses TLS. There is no unencrypted path.
• Encrypted at rest. Our database and its backups are encrypted on disk by our hosting provider.
• Row-level access control. Every table enforces, in the database itself, that you can read your own rows and — where you have paired — only the specific partner fields in §6. This is not an application check a bug could bypass; the database refuses the query.
• No passwords to steal. Sign-in is by Google or by a one-time code sent to your email. We never store a password. A code can be used once, and expires.
• Least privilege. Server credentials live only on the server. The app carries no key that can read another user's data.
• On-device camera processing. QR codes are decoded on your phone. No frame is uploaded.

No system is perfectly secure, and we will not pretend otherwise. What we can say is that the measures above are the ones actually implemented, not aspirations.

16If something goes wrong

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, as the GDPR requires.

If the breach is likely to result in a high risk to you, we will tell you directly and without undue delay — by email and in the app — describing what happened, what data was involved, what we are doing about it, and what you should do.

Given that we hold health data, we will treat any incident involving it as high risk unless we have clear evidence otherwise.

17Changes to this policy

We update this policy when what we do changes. Every version carries an effective date and version number at the top.

• Minor changes — clarifications, corrections, a renamed provider — take effect when posted.
• Material changes — a new category of data, a new purpose, a new recipient, a changed retention period — are notified by email and in the app at least 14 days before they take effect.
• Any new use of health data requires fresh explicit consent. We will ask; continuing to use the app is not an answer.

Previous versions are available on request.

18Contact us and complain

For anything in this policy, including any request under §12:

If you want to complain about how we have handled your data, say so and we will treat it as a complaint rather than a query. We will respond to a complaint within 45 days.

If you are not satisfied with our response, you can complain to a data protection authority. You do not have to come to us first, though we would rather you did — most complaints are misunderstandings we can fix in a day.

• EEA — the supervisory authority where you live or work (edpb.europa.eu lists them)
• UK — the Information Commissioner's Office, ico.org.uk
• India — the Data Protection Board of India
• California — the California Privacy Protection Agency, or the Attorney General