Privacy policy

Vimuk is run by [BUSINESS NAME], [ADDRESS], India. In this policy, "we" means them.

Our contact and grievance officer is [NAME]. You can reach them at support@vimuk.in.

First launch. The app asks your age and your consent first. If you choose under 18, setup stops and nothing is sent to any server.

After you consent, the app creates an anonymous account with a random ID. We do not ask for your name, phone number or email. You can link a Google sign-in to back up and restore your data. If you do, the app does not read your Google email or name.

Stored on our servers (Supabase), linked to your random ID:

• Product type, how long you have used it, amount per day and cost per unit.
• Your craving triggers, language and adult age bracket.
• Consent version and time, your chosen start date, your phone's time zone and when you last opened the app.
• Plan status and expiry, and streak counts.
• Daily check-ins: clean or slipped, an optional trigger choice and urges resisted.
• Savings goals: the title you type, the target and the amount saved.
• Arena sessions: when, how each one ended, which tools you used, urge strength and whether the urge passed.
• A push-reminder token.
• Basic usage events: screen names, plan choices and purchase steps. Never free text.

We use this to run the app for you: your plan, streaks, savings, reminders and purchases.

Push messages can contain personal figures, such as streak days, rupees kept and urges resisted today.

No advertising. The app has no analytics or crash-reporting SDK.

Permissions. Notifications, asked on a reminders screen and never at launch. Photo-library access, only when you add the optional photo.

• Your name.
• Your pledge text.
• Who you are quitting for.
• Your optional photo.

The optional jaw-check answer is not stored on our servers. It is sent to Gemini during setup, as explained below.

• Supabase — database and sign-in. Region: [CONFIRM: Supabase region].
• RevenueCat — purchase status, keyed to your random ID.
• Google Play — payments. We never see your card or UPI details.
• Google Firebase Cloud Messaging and Expo — push delivery. They receive the device token and the message text.
• Upstash QStash — queues push messages. It receives the token and text, with no user ID.
• Upstash Redis — a daily request counter keyed to your random ID. Region: [CONFIRM: Upstash region].
• Google Gemini API — writes one short paragraph during setup. It receives product type, amount per day, how long, triggers and the optional jaw-check answer. No name or ID is sent. [CONFIRM: paid or unpaid Gemini quota; unpaid means Google may use and human-review the content]
• WHO public data service — your phone requests one public India statistic. That host can see your phone's IP address. No user data is sent.

• Server data is kept until you delete your account.
• Anonymous accounts that never paid and have been inactive for 180 days are deleted automatically.
• Accounts linked to Google, or that ever paid, are not deleted automatically.
• Rate-limit counters expire after 24 hours.
• Backups and logs: [CONFIRM: Supabase backup and log retention].

You can ask us to:

• Access the data we hold about you.
• Correct data that is wrong.
• Erase your data. You can do this yourself in the app. See Delete account.
• Raise a grievance with our grievance officer, [NAME].
• Nominate another person to use these rights for you.

To use any of these, email support@vimuk.in. Because accounts are anonymous, include [CONFIRM: how we identify the account].

Vimuk is for adults 18 and over. If you choose under 18 at first launch, setup stops and nothing is sent to any server.

Your account uses a random ID, not your name, phone or email. Personal details such as your name, pledge and photo stay on your phone. No method of storing data is perfectly secure, but we keep what we collect small.

If we change this policy, we will update the version and the "Last updated" date at the top of this page.

[NAME], grievance officer, [BUSINESS NAME], [ADDRESS], India. Email support@vimuk.in.