Privacy Policy
Effective date: 20 July 2026 Last updated: 20 July 2026
You V2 is a habit-tracking app. This policy explains exactly what it collects, where that data goes, and what you can do about it.
Two things worth stating up front, because they are unusual:
- You V2 contains no analytics, no advertising, and no tracking SDKs. We do not profile you, we do not sell your data, and we have never shared it for advertising.
- The most sensitive information the app holds never leaves your device. Your craving logs, weight history, sleep records, mood check-ins, and gratitude entries are stored only on your iPhone. They are not uploaded, and we cannot see them.
1. Who is responsible for your data
| Controller | Ilhan Akbudak (UniChat Dev) |
| Contact | info@unichat.dev |
| App | You V2 for iPhone |
You V2 is published by an individual developer, not a company. That person is the data controller and is personally responsible for the commitments in this policy.
2. What we collect, and why
2.1 Account information
Created when you sign in. You can use the app without an account.
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | Sign-in and account recovery | Performance of a contract |
| Account identifier | Links your data to you | Performance of a contract |
| Username (optional) | Shown to your group teammates | Consent |
| Profile picture (optional) | Shown to your group teammates | Consent |
| Language preference | Localizing the app | Legitimate interest |
If you use Sign in with Apple and choose Hide My Email, we only ever receive Apple's private relay address. We never see your real one.
2.2 Your habit data
Synced so your habits survive a lost phone and appear on your other devices.
- Habits you create — name, icon, colour, category, goal, schedule, and any notes you add.
- Daily records — the day, the amount logged, any note, an optional mood rating, and whether you skipped.
Notes and moods are free-form. Whatever you write there is synced, so please treat those fields as you would any note stored online.
Legal basis: performance of a contract (this is the app's core function).
2.3 Group data (Premium)
Only if you create or join a group.
- The group, its name, and its invite code.
- Which groups you belong to and your role.
- Shared habits, your check-ins, emoji cheers, and nudges you send or receive.
Everyone in a group can see your check-in history for that group's shared habits, your display name, and your profile picture. That is the point of the feature, but you should know it before joining. Anyone holding a valid invite code can join a group and see this, until the code is regenerated or expires.
Legal basis: performance of a contract.
2.4 Health data from Apple Health — please read this section
This is the one place where health information leaves your device, so we want to be unambiguous about it.
If — and only if — you switch on Apple Health integration and enable specific metrics, You V2 reads those metrics to mark matching habits complete automatically. You choose each metric individually and can revoke any of them at any time in Settings or the Health app.
You V2 can read: steps, active energy, workouts, water, mindful minutes, sleep, and body weight. You V2 never writes anything to Apple Health.
What happens to the reading: when a measurement completes a habit, the measured value is saved as part of that habit's daily record — and that record is synced to our servers along with the rest of your habit data. For example, if a step count completes your walking habit, that step count is stored on our server.
We are telling you this plainly because it is the kind of thing people assume does not happen. If you would rather no health measurement ever left your phone, do not enable Apple Health integration — every other feature works without it.
Health data is never used for advertising, never sold, and never shared with anyone beyond the infrastructure provider described in Section 4.
Legal basis: your explicit consent (GDPR Article 9(2)(a)). You give it by enabling a metric, and you withdraw it by turning that metric off.
2.5 Notifications
If you allow notifications, your device's push token is stored so teammates can nudge you. Delete the app or disable notifications and it stops being used.
Legal basis: consent.
2.6 Subscriptions
If you subscribe, Apple tells us your subscription's product, status, and expiry so we can unlock Premium. Apple handles the payment — we never see your card details, billing address, or any payment information.
Legal basis: performance of a contract.
2.7 What stays on your device only
The following is stored solely on your iPhone, is never uploaded, and is not visible to us under any circumstances:
- Quit-tracking: your substance, quit date, and every craving you log.
- Weight history and body measurements (units, sex, age, height, weight, activity level).
- Sleep logs, hydration logs, and workout sessions.
- Mood check-ins and gratitude journal entries.
- Savings, contributions, and no-spend days.
If you delete the app, this data is gone. It is not in any backup we hold, because we never held it.
2.8 What we do not collect
We do not collect your location, contacts, photos (beyond a profile picture you choose), browsing activity, advertising identifiers, or device fingerprints. There is no analytics SDK, no crash-reporting SDK, and no advertising SDK in the app. We do not track you across other apps or websites.
3. Who can see your profile picture
If you upload a profile picture, it can be seen by you and the members of any group you have joined — nobody else. It is not publicly accessible, and it cannot be fetched by someone who isn't signed in.
This is the same rule that governs your display name: your picture is visible to exactly the people who could already see you in a shared group. If you leave a group, its members stop being able to see it.
4. Who else touches your data
We use two providers. We do not sell your data, and we do not share it with advertisers, data brokers, or anyone for their own purposes.
| Provider | What they do | What they hold |
|---|---|---|
| Supabase | Hosts the database, accounts, storage, and server functions | Everything in Sections 2.1–2.6 |
| Apple | App Store, subscriptions, push delivery, Sign in with Apple | Purchase records, push tokens, sign-in identity |
Supabase acts as our processor: they store and serve the data on our instructions and may not use it for their own ends.
Where your data is stored: our servers are in the United States (Oregon,
us-west-2). If you are in the EEA or the UK, this means your data is
transferred outside your region. That transfer relies on the European
Commission's Standard Contractual Clauses, which Supabase incorporates into
its Data Processing Addendum, together with the EU–US Data Privacy Framework
where applicable.
5. How long we keep it
We keep your data for as long as your account exists. When you delete your account, it is erased — not archived, not anonymized, not retained for analytics. That includes your profile picture, which is removed from storage rather than left behind.
You can delete your account at any time from Profile ▸ Delete Account. It does not require emailing us or waiting for approval.
One exception, in other people's favour: if you own a group with other members in it, the group itself is not deleted — ownership passes to the longest-standing remaining member, so their shared history survives. Your personal data is still erased. A group with nobody else in it is deleted with your account.
Data stored only on your device is removed when you delete the app.
6. Your rights
Wherever you live, you can:
- See your data — export it from the app at any time.
- Correct it — edit anything in the app directly.
- Delete it — Profile ▸ Delete Account, effective immediately.
- Take it with you — export in a portable, machine-readable format.
- Withdraw consent — turn off Apple Health metrics or notifications whenever you like, without losing access to anything else.
If you are in the EEA or UK, you also have the right to object to or restrict processing, and to complain to your national data protection authority. If you are in Türkiye, you have the rights set out in Article 11 of the KVKK, including the right to apply to the Personal Data Protection Board. If you are in California, you have the rights to know, delete, correct, and opt out of sale or sharing under the CCPA/CPRA — though we do not sell or share your personal information, so there is nothing to opt out of.
We do not charge for any of this, and exercising a right will never degrade your experience. To make a request, email info@unichat.dev. We reply within 30 days.
7. Security
- Everything in transit is encrypted with TLS.
- Database access is enforced by row-level security, so one account cannot read another's data.
- Sign-in credentials are handled by Apple or by one-time email codes — we never store a password.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data, we will notify you and the relevant authority as the law requires.
8. Children
You V2 is not intended for anyone under 16. We do not knowingly collect data from children under 16. If you believe a child has given us data, email info@unichat.dev and we will delete it.
9. Changes
If we change this policy, we will update the date at the top. For anything that materially affects your privacy — a new category of collected data, a new processor, or any change to what leaves your device — we will notify you in the app before it takes effect, and where the law requires consent, we will ask for it rather than assume it.
10. Contact
Questions, requests, or complaints: info@unichat.dev