Privacy Policy

# Privacy Policy — NorthStar-Habit, Mood Improver

**Effective Date:** May 2, 2026

**Last Updated:** May 2, 2026

**Developer:** NorthStar Developers

**App Package:** `com.sanjeev.northstar `

**Contact:** priyankachhoker123@gmail.com

> **Plain-English summary:** Your habits live only on your device. We don't have an account system. We don't see, store, or sell your habit data. We collect anonymous crash reports and aggregated usage stats only — and you can opt out.

---

## 1. Introduction

NorthStar ("we," "our," "us," or the "App") is a daily habit and routine tracker for Android, published by NorthStar App. This Privacy Policy explains what data we collect, why, how we use it, with whom we share it, how long we keep it, and the rights you have over it.

We comply with:

- **GDPR** (EU/EEA — Regulation 2016/679)

- **UK GDPR** & Data Protection Act 2018

- **CCPA / CPRA** (California — Cal. Civ. Code § 1798.100 et seq.)

- **LGPD** (Brazil — Lei 13.709/2018)

- **PIPEDA** (Canada)

- **Google Play Data Safety** disclosure requirements

- **Children's Online Privacy Protection Act (COPPA)**

By installing or using NorthStar you acknowledge you have read this policy.

---

## 2. Data We Collect

### 2.1 Data stored locally on your device only (NEVER transmitted to us)

| Data Type | Examples | Storage |

|-----------|----------|---------|

| Habit content | Habit names, descriptions, icons, colors, schedules, categories | Encrypted SQLite (Room) |

| Completion history | Check-offs, streaks, skip reasons, notes | Encrypted SQLite (Room) |

| Preferences | Theme, language, reminder times, locale | Android DataStore |

| Authentication | Biometric lock state (Premium) | Android Keystore (hardware-backed) |

This data is **never** transmitted off your device by us. If you uninstall the app, this data is permanently deleted.

### 2.2 Anonymous data we collect via Firebase (Google LLC)

|-----------|---------|---------|---------------|----------|

**We never send your habit names, completions, or any free-text content to Firebase or any other third party.**

### 2.3 Subscription data (only if you purchase Premium)

If you subscribe, **Google Play Billing** processes the payment. We receive:

- Purchase token (for receipt validation)

- Product ID (`premium_monthly` or `premium_yearly`)

- Subscription status (active, trial, grace, on-hold, paused, expired)

We do **not** receive: your name, email, payment method, card number, billing address, or any other PII from Google Play.

### 2.4 Data we DO NOT collect

❌ Your name, email address, phone number

❌ Any habit content (names, descriptions, completions, notes)

❌ Location data (GPS, IP geolocation, Wi-Fi SSIDs)

❌ Photos, videos, files, or media on your device

❌ Contacts, calendar, SMS, call logs

❌ Browsing history or app-usage history outside NorthStar

❌ Biometric data (fingerprints / face data — kept only by Android system)

❌ Health & fitness data from Health Connect (we don't read it)

---

## 3. How We Use Data

| Purpose | Legal Basis (GDPR Art. 6) |

|---------|---------------------------|

| Provide core habit-tracking functionality | Contractual necessity — Art. 6(1)(b) |

| Send local reminders you configure | Consent — Art. 6(1)(a) |

| Process Premium subscriptions | Contractual necessity — Art. 6(1)(b) |

| Diagnose crashes & improve stability | Legitimate interest — Art. 6(1)(f) |

| Aggregate usage analytics for product decisions | Legitimate interest — Art. 6(1)(f) |

| Comply with legal obligations | Legal obligation — Art. 6(1)(c) |

**We will never:**

- Sell, rent, or trade your data

- Use your data for ad targeting

- Build behavioral profiles for marketing

- Make automated decisions with legal effect about you

- Send marketing emails (we don't have your email)

---

## 4. Third-Party Services

|---------|----------|-------------|---------|--------------|

We do not integrate with: ad networks, social media SDKs, attribution networks (AppsFlyer/Adjust/Branch), or data brokers.

---

## 5. International Data Transfers

Anonymous Firebase telemetry may be processed by Google in the United States. Google is certified under the EU-U.S. Data Privacy Framework and provides Standard Contractual Clauses for transfers from EEA/UK/Switzerland.

---

## 6. Data Retention

| Data | Retention |

|------|-----------|

| Local habit data | Until you delete it or uninstall the app (no remote copy exists) |

| Crash reports (Crashlytics) | 90 days (Firebase default) |

| Analytics events (Firebase) | 14 months, then automatically deleted |

| Performance traces | 90 days |

| Subscription records (anonymized) | Duration of subscription + 180 days for tax/refund purposes |

---

## 7. Your Rights

### 7.1 All users — built into the app

- **Access:** View all your data inside the app at all times

- **Export:** Settings → Export → JSON / CSV (Premium feature)

- **Delete:** Settings → Privacy → Clear All Data, or simply uninstall

- **Disable analytics:** Settings → Privacy → Crash reporting / Analytics toggles

- **Reset advertising ID:** Android system Settings → Google → Ads

### 7.2 EEA / UK (GDPR & UK GDPR)

You have the right to: access (Art. 15), rectification (Art. 16), erasure / "right to be forgotten" (Art. 17), restriction (Art. 18), data portability (Art. 20), object (Art. 21), withdraw consent (Art. 7(3)), and lodge a complaint with your supervisory authority.

To exercise any right, email priyankachhoker123@gmail.com with subject "GDPR request". We respond within 30 days.

### 7.3 California (CCPA / CPRA)

You have the right to know, delete, correct, opt out of sale or sharing (we do neither), limit use of sensitive personal information (we don't process any), and not be discriminated against for exercising rights. We do not sell or share personal information for cross-context behavioral advertising.

### 7.4 Brazil (LGPD)

You have the rights of confirmation, access, correction, anonymization/blocking/deletion, portability, information about sharing, and revocation of consent.

### 7.5 Other regions

If your jurisdiction provides additional rights (e.g., Quebec Law 25, Virginia VCDPA, Colorado CPA), we honor them on the same `priyankachhoker123@gmail.com ` channel.

---

## 8. Children's Privacy

NorthStar is **not directed at children under 13** (or under 16 in the EEA, where local law requires a higher age). We do not knowingly collect data from children. If you believe a child has used the app and you wish their data deleted, contact **priyankachhoker123@gmail.com **.

NorthStar is rated **Everyone / PEGI 3 / ESRB E** but is intended for users aged 13+.

---

## 9. Security

- **Encryption at rest:** Sensitive preferences via `EncryptedSharedPreferences` (AES-256-GCM with hardware-backed Android Keystore master key)

- **Encryption in transit:** All Firebase traffic uses TLS 1.2+

- **No cleartext traffic:** Network Security Config blocks plain HTTP

- **Certificate pinning:** Backup pins included with 90-day rotation

- **Code obfuscation:** R8/ProGuard with full mode

- **Screenshot prevention:** `FLAG_SECURE` on Settings, Premium, and Backup screens

- **Biometric lock (Premium):** App-level lock backed by `BiometricPrompt.Authenticators.BIOMETRIC_STRONG`

- **Backup exclusion:** Sensitive data excluded from Android Auto Backup

No security system is impenetrable; we cannot guarantee absolute security but follow industry best practices and the OWASP Mobile Top 10.

---

## 10. Permissions We Request

| Permission | Why | When asked |

|------------|-----|------------|

| `POST_NOTIFICATIONS` | Send habit reminders you configure | First time you enable a reminder |

| `RECEIVE_BOOT_COMPLETED` | Re-schedule reminders after device reboot | At install (no runtime prompt) |

| `SCHEDULE_EXACT_ALARM` | Deliver reminders at exact times | Only on Android 12+, via system Settings deep link |

| `BILLING` | Process Premium subscriptions | Only when you tap "Upgrade" |

| `INTERNET` | Firebase telemetry + subscription verification | At install (no runtime prompt) |

| `USE_BIOMETRIC` | App lock (Premium) | Only when you enable biometric lock |

We do **not** request: location, camera, microphone, contacts, storage, calendar, phone, body sensors, or any other sensitive permissions.

---

## 11. Changes to This Policy

We may update this policy. When we do:

1. We update the "Last Updated" date at the top

2. For **material changes**, we show an in-app banner for 14 days requesting acknowledgement

Continued use after a material change constitutes acceptance.

---

## 12. Contact

| Channel | Address |

|---------|---------|

| **Privacy email** | priyankachhoker123@gmail.com |

| **General support** | priyankachhoker123@gmail.com |

| **Postal mail** | NorthStar App, [Postal address — fill before publishing] |

| **EU Representative** (if required) | [GDPR Art. 27 representative — appoint before EU launch] |

| **Data Protection Officer** | [If appointed — fill] |

We respond within 30 days for GDPR/CCPA/LGPD requests; usually within 72 hours for general support.

---

## 13. Quick-Reference Summary

| Question | Answer |

|----------|--------|

| Do you have my account / email? | No — no accounts |

| Do you collect my habit data? | No — stored only on your device |

| Do you share data with advertisers? | No |

| Do you sell data? | No |

| Can I delete my data? | Yes — in-app or by uninstalling |

| Can I export my data? | Yes — JSON or CSV (Premium) |

| Is my data encrypted? | Yes — at rest and in transit |

| GDPR / CCPA / LGPD compliant? | Yes |

| Children under 13? | Not directed at them; we don't knowingly collect |

| Tracking SDKs? | None (no AppsFlyer/Adjust/Branch/Meta SDK) |

| Ad networks? | None |

---

*This policy is provided for compliance with Google Play's User Data policy, GDPR Articles 13–14, CCPA § 1798.130, and LGPD Article 9. It is reviewed at least annually and on any material change.*

Page updated

Google Sites

Report abuse