Privacy Policy
Anvyl is an iOS habit tracker. This policy explains what we collect when you use it, why we collect it, who we share it with, and the rights you have over your data. It's short on purpose — the product is small, and so is the data footprint.
1. Who runs Anvyl
Anvyl is operated by Anvyl Inc., a US sole proprietorship. We act as the data controller for the personal information described below.
Mail: 30 N Gould St, Ste R, Sheridan, WY 82801, USA. Email: support@useanvyl.com.
2. What we collect
2.1 Information you give us
- Account: email address, password (hashed with bcrypt — we cannot read it), display name, optional avatar and short bio.
- Sign-in providers: if you use Sign in with Apple, we receive the verified email (real or relay) and an opaque Apple user identifier. Nothing else.
- Onboarding answers: the 24 behavioral signals you answer during onboarding. Used once to seed cohort matching; not exposed publicly.
- Activity: the actions you log against each FORGED letter, your streak history, badges earned, archetype, and any posts, replies, or flame reactions you submit in the cohort forum.
- Support communications: the contents of any email, in-app report, or appeal you send us.
2.2 Information collected automatically
- Device & app: iOS version, device model, app build, locale, and timezone — used to render the right UI and to triage bugs.
- Crash & performance logs: stack traces and a snapshot of recent in-app actions, sent on crash to help us reproduce the bug.
- IP address: recorded at request time, kept 90 days for fraud and abuse detection, then discarded.
- Push notification token: the Apple Push Notification token your device generates, so we can send notifications you have opted in to.
2.3 What we do NOT collect
- We do not collect your full payment card. Subscription billing is handled by Apple — we never see your card number.
- We do not collect government ID, biometric data, or identity verification documents.
- We do not collect precise GPS location.
- We do not collect contacts, calendar, photos, or microphone unless you explicitly grant permission to a future feature that requires it.
- We do not run third-party advertising SDKs and we do not have a tracking pixel on this website.
3. How we use it
- Run the service. Authenticate you, sync your streaks and challenges, place you in a cohort, send the push notifications you opted in to.
- Match cohorts. Your onboarding signals and current letter levels feed the cohort matcher. The matcher output is the cohort, not the inputs.
- Moderate. Detect and act on harassment, spam, or platform abuse. Posts you report are reviewed against the Community Guidelines.
- Improve the app. Crash logs and aggregate usage metrics. We do not build behavioral profiles for advertising.
- Comply with the law. Respond to lawful requests, retain tax-relevant subscription records, and prevent fraud.
4. Who we share it with
We share data only with the providers we need to run the service. Each one is bound by a Data Processing Agreement and processes data only for the purpose listed.
- Apple — handles all subscription billing through the App Store. Apple provides us the subscription status (active, trial, cancelled, renewal date). We never see your card.
- Amazon Web Services (us-east-1) — hosts our application servers and stores S3 object data (avatars). Encrypted in transit and at rest.
- MongoDB Atlas (us-east-1) — database hosting for account, streak, and cohort data.
- Apple Push Notification service — delivers any push notification you have opted in to.
- Sentry — receives crash reports and performance traces. We scrub identifying tokens before sending.
- Resend — sends transactional email (password resets, important notices).
We do not sell your personal information. We do not share data for third-party advertising. We may disclose information when required by law (subpoena, court order, lawful government request) and, where the law permits, will notify you before doing so.
5. What is public on Anvyl
The product is built around a witnessed streak. By default, the following is visible to other Anvyl users:
- Your display name and avatar.
- Your active streak, current Account Heat state, and per-letter levels.
- Posts, replies, and flame reactions you submit in a cohort forum or to a friend's profile.
- Whether you are currently in Tempering.
You can flip individual challenges to private mode in Settings. Your email, password, onboarding signals, IP address, and device info are never shown to other users.
6. Retention
- Account & activity: kept while your account is active.
- Subscription & tax records: 7 years (US tax retention).
- IP addresses: 90 days.
- Crash logs: 30 days.
- Support email: 3 years from the close of the conversation.
- Email hash after deletion: a one-way SHA-256 hash of your email is kept indefinitely to prevent re-registration with the same address. The hash cannot be reversed.
6.1 What happens when you delete your account
Use Settings → Account → Delete Account in the app. The following happens immediately:
- Your login is revoked.
- Your profile, avatar, bio, and friendships are deleted.
- Your posts and replies are removed from public view (soft-deleted within 30 days).
- Your cohort membership ends.
We retain the email hash, subscription/tax records, and audit logs of the deletion as described above. Deletion is irreversible.
7. Your rights
Regardless of where you live, you can:
- Access — request a copy of the data we hold about you.
- Correct — fix inaccurate data, either in-app or by writing to us.
- Delete — close your account using the in-app flow, or email us to request it.
- Export — receive your data in a structured, machine-readable format (JSON).
- Opt out — disable any push notification category, or unsubscribe from any non-essential email.
To exercise any of these, email support@useanvyl.com. We respond within 30 days. We may ask you to verify the email on file before we send data.
8. Regional rights
8.1 European Economic Area & United Kingdom (GDPR / UK GDPR)
If you are in the EEA or UK, your data is processed under one of: (a) the contract between you and Anvyl, (b) our legitimate interest in running and securing the service, (c) your consent (where you have given it, e.g. marketing email), or (d) a legal obligation. You have the rights listed in Section 7, plus the right to lodge a complaint with your local data protection authority and the right to object to processing based on legitimate interest.
Transfers to the United States rely on Standard Contractual Clauses. Email support@useanvyl.com for a copy.
8.2 California (CCPA / CPRA)
California residents have the rights to know, access, delete, correct, and limit the use of sensitive information. We do not sell or share personal information for cross-context behavioral advertising. To exercise a right, email us at the address above; we respond within 45 days.
8.3 Canada, Brazil, other jurisdictions
Equivalent rights apply under PIPEDA, LGPD, and similar laws. Contact us with your jurisdiction and we will route the request appropriately.
9. Children
Anvyl is not directed to children under 13 and we do not knowingly collect their data. Accounts known to belong to a user under 13 are deleted. Users aged 13–17 may use Anvyl with the consent of a parent or guardian, who can write to support@useanvyl.com to review or delete their child's account.
10. Security
We encrypt data in transit with TLS 1.2+ and at rest with AES-256 where applicable. Passwords are hashed with bcrypt. Access to production data is limited to staff with a documented business need, requires two-factor authentication, and is logged. No system is ever fully secure; if we ever confirm a breach affecting your account, we will notify you within 72 hours of confirmation, describe what happened, and tell you what to do.
11. Changes to this policy
We update this policy when our practices change. Material changes are announced by email and in-app banner before they take effect. Non-material changes (clarifications, typo fixes) take effect on publication. The "Last updated" date at the top of this page always reflects the current version.
12. Contact
Privacy & support: support@useanvyl.com.
General: hello@useanvyl.com.
Founder, direct: kyle@useanvyl.com.
Mail: Anvyl Inc., 30 N Gould St, Ste R, Sheridan, WY 82801, USA.