Privacy Policy

Version 1 — August 3, 2026 · Publisher: Nexa Technologies — Nathan Bardi

Rot Rehab is built to work with as little personal data as possible: no account required, no ads, no cross-app tracking, no third-party analytics. Everything the app measures lives on your device first — the server holds a copy so your history can survive a lost phone, nothing more.

What we collect

• An anonymous identifier, created automatically the first time you open the app. It contains no name, no email, no phone number — it only ties your own measurements together.
• Your measurements — reaction times, benchmark scores, session records — synced to our servers against that anonymous identifier, so your curve can be restored on a new device.
• Your email address, only if you choose Sign in with Apple to secure a purchase across devices. Apple lets you hide it; either way it is used for authentication, never for marketing.
• A leaderboard entry, only if you opt in. The standing shows a result, not an identity. Separately, an anonymous reaction-time pool (no user identifier attached, insert-only) powers a population percentile that is only shown once at least 1,000 measurements exist.
• A screen-time self-report, only if you type one. It is voluntary, stays on its own axis, and never enters your score.
• Your subscription status, processed by Apple and by our subscription provider RevenueCat. We never see your payment details.

What we do not do

• No ad tracking, no selling of data, no profiling.
• No third-party analytics SDK.
• No comparison of your data with other users, except the strictly opt-in leaderboard above.

Where your data lives

Authentication and storage are operated by Supabase; subscriptions by Apple and RevenueCat — each acting as a processor strictly for the purposes described above.

How long we keep it

Your anonymous identifier and measurements live as long as your install does. Deleting your data in the app (Settings → Delete everything) erases the device and disconnects the anonymous identity; anonymous accounts left behind are periodically purged.

Your rights

Under the GDPR you have the right to access, rectify, object to and port your data: write to [email protected]. If you believe your rights are not respected, you can lodge a complaint with your data protection authority (in France, the CNIL).

Contact

Nexa Technologies — Nathan Bardi — [email protected]