Privacy Notice
Thedashbit ("we", "us") provides the Thedashbit habit tracker and is the data controller for the personal data described here — we decide why and how it is processed. Short version: we store what the app needs to work, nothing else, and we never sell your data.
What we collect and why
- Account data (email address, sign-in credentials and login timestamps) — to create your account, sign you in and contact you about your purchase. Legal basis: performance of our contract with you.
- App content (habits, logs, streaks, goals, reflections) — to provide the Service and sync it across your devices. Legal basis: performance of our contract.
- Technical and usage data (error logs, timestamps, device and browser information, IP address) — to keep the app running, prevent fraud and abuse, and improve the product. Legal basis: our legitimate interests in a secure, working service.
- Support messages — to answer your questions. Legal basis: legitimate interests and contract performance.
- Purchase records (order reference, entitlement status) — to unlock what you bought and meet accounting obligations. Legal basis: contract and legal obligation.
Payments
Our order process is conducted by Paddle.com, which acts as the Merchant of Record and reseller for all our orders. Paddle handles payment, billing, tax compliance, invoicing and returns, and processes your payment and billing details as its own controller under Paddle's privacy notice. We never see or store your card details; we only receive confirmation that a purchase, refund or chargeback occurred.
Who we share data with
- Service providers and subprocessors that host the app, database and authentication on our behalf.
- Paddle.com, as Merchant of Record, for the sale of the product, payments, tax compliance and invoicing.
- Professional advisers (legal, accounting) where necessary.
- Authorities where we are required to disclose by law.
We do not sell or rent your data, and we do not send marketing email unless you ask for it.
How long we keep it
Account and app content are kept for as long as your account is active. If you delete your account, the account and its content are erased within 30 days, apart from backups which cycle out within 90 days. Technical and security logs are kept for up to 12 months. Purchase and tax records are retained for as long as accounting law requires (typically 6–7 years). Anything no longer needed is deleted or anonymised.
Security
We apply appropriate technical and organisational measures: encryption in transit (HTTPS) and at rest, row-level access rules so each account can only reach its own data, hashed credentials handled by our authentication provider, restricted administrative access on a need-to-know basis, and regular patching of dependencies. No system is perfectly secure, but we treat security incidents seriously and will notify you and any regulator where the law requires it.
International transfers
Our providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on adequacy decisions or Standard Contractual Clauses as safeguards.
Your rights
Subject to local law you may request access to your data, correction, erasure, restriction, portability, or object to processing based on legitimate interests, and withdraw consent where processing relies on it. You can export or permanently delete your account and all associated data at any time from Settings, or by emailing support@thedashbit.com. We respond within one month. If you are in the UK/EEA you may also complain to your local supervisory authority.
Cookies
We use a small number of essential cookies and local storage entries to keep you signed in and to secure the session. There are no advertising or third-party tracking cookies. You can clear or block cookies in your browser, but the app will not be able to keep you signed in.
Changes
If this notice changes in a meaningful way, we will say so in the app before the change takes effect.