Privacy Policy

1. Introduction & Overview

At nicaea Labs. ("Developer", "We", "Us", "Our"), we are committed to respecting and protecting the privacy and personal data of our users ("User", "You"). This Privacy Policy describes how we collect, process, store, transfer, and protect information when you use the luqluq mobile application ("App", "Service") across iOS and Android platforms, in strict compliance with the General Data Protection Regulation ("GDPR"), California Consumer Privacy Act ("CCPA/CPRA"), Turkish Personal Data Protection Law ("KVKK"), Apple App Store Review Guidelines, and Google Play Developer Policies.

2. Our Core Privacy Principle: No Access & No Sale of User Data

• We Do Not Access or Monetize Your Private Data: The Developer does not access, browse, monitor, inspect, sell, rent, license, or broker your personal consumption logs, hydration entries, or private information to data brokers, ad networks, or commercial third parties.
• Data Minimization: The App processes only the minimal amount of technical data strictly required to calculate hydration requirements, log beverages, and synchronize data across devices if you choose to sign in.
• Guest / Local-First Use: You can use luqluq without creating an account (Guest Mode). In this case, all your consumption and biometric records remain solely on your local device.

3. Data Categories We Collect and How We Use Them

A. Account and Authentication Data

When you voluntarily choose to create an account, we support only the following secure authentication methods:

• Email and Password: Your registered email address, chosen name/nickname, and password. Passwords are cryptographically hashed using one-way cryptographic algorithms (bcrypt) on secure servers; they are never readable or accessible in plain text by anyone, including the Developer.
• Google Sign-In (Credential Manager / Google Identity): Your unique Google OAuth User ID, display name, and avatar URL provided by Google. We never have access to your Google account password.
• Sign in with Apple: Your unique Apple identifier, display name, and Apple Private Relay email address if selected.

B. Hydration and Beverage Logs

• Type of beverage consumed, volume (ml or fl oz), timestamp of intake.
• Calculated Net BHI (Beverage Hydration Index), caffeine content (mg), sugar content (g), and osmolality metrics.
• Custom beverage recipes and ingredient definitions created by you.
• Used solely to render your daily dashboard, history trends, and exportable PDF health reports.

C. Biometric and Lifestyle Information (Optional)

• To calculate your daily hydration requirement according to scientific guidelines, you may optionally input age, gender, height, weight, physical activity level, climate, and wake/bed times.
• This information is never used for medical diagnosis; it functions strictly as mathematical input for personal wellness algorithms.

D. Generative AI Recipe Builder Data

When using the AI Recipe Builder, the recipe name, category, and list of ingredients (quantity and unit) are processed to estimate nutritional and hydration metrics. These inputs are sanitized against prompt injection and are not tied to your real identity.

E. Technical Diagnostics and Analytics Data

• Device hardware model, operating system version (iOS/Android), application version, system language, and time zone.
• Firebase Crashlytics: Anonymous stack traces and crash reports to identify and patch bugs. Crash logs are sanitized to eliminate emails, tokens, and PII.
• Firebase Analytics: Aggregated, de-identified usage statistics and user engagement trends.
• RevenueCat: Subscription status, entitlement checks, and purchase receipt validation. We do not store or process payment card details; all financial billing is handled directly by Apple App Store or Google Play Store.

4. Account Deletion and Total Data Erasure (Right to be Forgotten)

• In-App Immediate Deletion: You can delete your account at any time by navigating to Profile -> Delete Account (Hesabımı Sil) and confirming the prompt.
• Erasure Scope: Triggering account deletion executes the database procedure delete_user_account:
  1. Your authentication credentials (auth record, email, password hash),
  2. Your profile, biometric metrics, and preferences,
  3. All historical beverage consumption entries and statistics,
  4. Custom beverages, recipes, and notes,
  5. Unlocked badges, streak records, and leaderboard entries,
  6. All local device caches, tokens, and encrypted storage
  are permanently, irreversibly, and immediately destroyed and purged from all active databases and servers.
• Manual Request: If you cannot access the app, you may email hello@nicaealabs.com with the subject "Account Deletion Request" from your registered email address. We will verify your identity and purge all associated records within 7 business days.

5. Data Storage, Encryption and Security

• In-Transit Encryption: All communications between the App and backend servers are secured using TLS/HTTPS (SSL). Plaintext HTTP traffic is blocked.
• Local Storage Protection:
  • Android: Tokens and cached credentials are encrypted using EncryptedSharedPreferences backed by the Android Keystore (AES-256-GCM / AES-256-SIV).
  • iOS: Sensitive session tokens are kept exclusively in the iOS Keychain with the kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly flag, preventing leakage into unencrypted backups.
• Row Level Security (RLS): Our cloud database (Supabase PostgreSQL) strictly enforces Row Level Security. No user can read, query, or modify another user’s records.

6. Third-Party Infrastructure & Service Providers

We partner with industry-standard, SOC 2 / ISO 27001 certified technology providers strictly to operate the Service:

• Supabase Inc.: Cloud database, authentication services, and edge computing.
• Google LLC: Firebase Analytics, Firebase Crashlytics, and Google Cloud Gemini API for recipe estimation.
• RevenueCat, Inc.: In-app purchase verification and subscription state management.
• Apple Inc.: App Store distribution, StoreKit billing, and Sign in with Apple.
• Google LLC: Google Play Store distribution, Google Play Billing, and Google Sign-In.

7. Third-Party Technologies, Outages & Disclaimer of Liability

8. Medical and Health Disclaimer

9. Children’s Privacy

The App is not intended for children under 13 years of age (or 16 in certain European jurisdictions). We do not knowingly collect personal data from children. If we discover that a child has provided us with personal information without parental consent, we will delete such data immediately.

10. Notifications and System Permissions

• Notifications (POST_NOTIFICATIONS): Used to deliver periodic water reminders and limit threshold warnings according to your configured schedule. You can enable or disable notifications at any time via device settings or in-app settings.
• Exact Alarms (SCHEDULE_EXACT_ALARM): Used to trigger reminders accurately during your awake window without disturbing sleep hours.

11. Amendments to This Policy

We may revise this Privacy Policy periodically to reflect legal amendments, technological advancements, or app updates. Any updates become effective immediately upon posting. Material changes will be highlighted through in-app notices.

12. Contact Information

For any questions, privacy inquiries, or data requests, please contact:

• Developer: nicaea Labs.
• Email: hello@nicaealabs.com
• In-App Support: Profile -> App Info -> Privacy Policy