Who we are
This notice is from xPerDay (“we”, “us”), the maker of the xPerDay app and xperday.com.
We decide how your personal information is used, so we are the controller under the GDPR (EU) and UK GDPR, and the responsible party under South Africa’s Protection of Personal Information Act (POPIA). Where your local law gives you more protection, you get it. Contact: privacy@xperday.com.
What we collect and why
| Information | Why | Basis |
|---|---|---|
| Email and sign-in identifier (email, Apple or Google) | Create and secure your account; send sign-in and verification codes | Contract |
| Display name | Greet you in the app; shown as “By {your name}” on a program you publish | Contract |
| Time zone, country, units | Plan by your own calendar day and show the right units | Contract |
| Goals, usual minutes, level, equipment, preferences (floor, impact, quiet), reminder time | Build your daily plan | Contract |
| Areas to go easy on | Leave out movements that load those areas | Explicit consent |
| Gentle mode (on or off) | Keep plans easy and low-impact after the safety check | Explicit consent |
| Daily check-in: your energy and stress for the day | Shape today’s plan (easier strength on a low day, a breath first on a stressful one) | Explicit consent |
| Faith practices (on or off) and when you agreed | Include prayer and quiet-time practices in your plans | Explicit consent |
| Sessions: planned practices, what you did or skipped and why, how long, how it felt, swaps, and the program you follow | Your history and progress, and adapting tomorrow’s plan | Contract |
| Routines you save: name, note and practices | Play them, and share or publish them if you choose | Contract |
| Share links and programs you publish (title, summary, days, display name) | Show them to the people you share them with, or in the community after review | Contract |
| Reports you send (which program and the reason) | Review community programs and keep the community safe | Legitimate interest |
| Creators you hide | Leave their programs out of what you see | Contract |
| Funnel events (ids and fixed values only, e.g. “plan viewed”, “session completed”; never notes, health or faith details) | Measure whether the daily loop works; no third-party analytics | Legitimate interest |
| Subscription status (trial, active, expired) from RevenueCat | Provide Plus and remove ads | Contract |
| Waitlist email (site) | Tell you when the app is available | Consent |
| Security logs (IP address, request ids) | Prevent abuse and keep the service secure | Legitimate interest |
We don’t collect your location, contacts, photos or data from health apps or wearables. Reminders are scheduled on your phone; we don’t send push notifications in this version.
Health-adjacent information
xPerDay is a general wellness app, not a medical service. Some things it keeps are close to health information, and we treat them as sensitive:
- Areas to go easy on (for example knees or lower back). We ask for your explicit consent before saving them and record the version and time of that consent.
- Daily check-ins. Two taps for your energy and stress that day, saved under the same consent. You can skip them any day.
- Gentle mode. The safety check asks a few yes/no questions. We do not store your answers, only whether gentle mode is on.
- Skipping for pain. If you skip a practice because of pain or discomfort, that reason is kept with the session so your plans can go easier.
Withdraw your health consent in the app (You, then Privacy) and your areas to go easy on and your check-ins are deleted, and plans stop using them.
This information only shapes your plan. It is never used for advertising, never sent to analytics and never written to our logs. Our staff tools show totals only (for example how many check-ins were made each day), never yours.
Faith practices
xPerDay isn’t religious by default. If you turn on Faith practices, prayer and quiet time with your own sacred text can be part of your plans. Because this can reveal a religious or philosophical belief, the law treats it as a special category of personal information, so we ask for your explicit consent first.
We store only that the option is on and when you agreed. It is never sent to the ad network or to analytics, and our usage events leave out faith goals and practices. Our staff tools show counts only: how many people have it on, never who. Turn it off in the app at any time and the record that it was on is deleted; your past sessions stay.
What other people can see
Nothing you make in xPerDay is public unless you choose to share it.
- Share links. Anyone with a link to one of your routines can see its name and practices, and your note only if you choose to include it. A link never shows your name, email or anything else about your account. Stop sharing and the link stops working.
- Community programs. A program you publish shows its title, summary and days, and your display name as “By {your name}”. Every program is reviewed before it is public, and we may decline it or take it down later. People who joined it can finish it after you unpublish it.
- Reports. A report goes to the xPerDay team for review. They see the program, the reasons and how many reports it has, not who sent them. The creator only sees that it is hidden for review, never who reported it.
- Hidden creators. If you hide a creator, their programs no longer show for you. Only you can see your list (You, then Privacy, then Hidden creators), and the creator isn’t told.
What stays on your phone
Notes you write in reflections are stored only on your phone, encrypted with a key kept in your phone’s secure storage. They are never uploaded, so we can’t see, export or recover them. You can export them yourself from the app. Signing out or deleting your account deletes them from the phone; the app asks first.
The app also keeps a few other things on your phone so it works offline and doesn’t ask twice, such as today’s plan and how often you’ve seen an ad.
Ads on the Free plan
The Free plan shows ads from Google AdMob. We request non-personalised ads only: no ad profile is built from your use of xPerDay, and we don’t use Apple’s advertising identifier tracking (no App Tracking Transparency prompt). In the EU and UK, Google’s consent message asks for your choices first.
AdMob still processes some device information, such as IP address, device type and an app-scoped device identifier, to deliver, cap and measure ads and to prevent fraud. We never pass your goals, sessions, easy areas or any profile data to AdMob. Ads never appear during onboarding, the safety check, a session, the feedback questions or the subscription screen. Plus has no ads.
Service providers
These companies process data for us under contracts that limit them to providing their service:
- Cloudflare: hosting, our database (EU jurisdiction) and the website.
- Google Firebase Authentication: sign-in with email, Apple or Google (your email, a password hash, or your Apple or Google sign-in id).
- RevenueCat: subscription status for purchases made through the App Store or Google Play. It gets your xPerDay account id, never your email.
- Apple and Google: app distribution, payments and, if you choose them, Sign in with Apple or Google.
- Google AdMob: ads on the Free plan (see above).
- Resend: sending email, such as sign-in and verification codes and the waitlist announcement.
Where data is stored
Your account and plan data are stored in Cloudflare’s EU jurisdiction. Some providers above may process data in other countries, including the United States. Where they do, we rely on safeguards the law recognises, such as the European Commission’s standard contractual clauses, and on POPIA’s conditions for cross-border transfers.
How long we keep data
- While your account is open, we keep what the app needs to plan and show your history. On Free the app shows the last 30 days; Plus shows all of it.
- Check-ins and areas to go easy on are kept until you withdraw your health consent or delete your account.
- Routines, share links and published programs are kept until you delete them or your account. An unpublished program is kept, not public, so people in it can finish.
- Reports and hidden creators are kept until your account, or the program creator’s, is deleted.
- When you delete your account, we delete your personal information from our live systems straight away. Backups roll over within 30 days. How deletion works.
- Sign-in codes expire within minutes and are purged daily. Security logs are kept for up to 30 days.
- Waitlist emails are kept until we announce the launch or you ask us to remove yours.
Your rights
Wherever you live, you can access and export your data (in the app), correct it, delete your account, withdraw consent and object to processing based on legitimate interest.
In the app, You, then Privacy, has Export my data, Health consent, Faith practices and Hidden creators, and Delete account deletes your account and its data straight away. You can also delete a routine, stop sharing a link or unpublish a program at any time.
EU and UK (GDPR)
You can also ask us to restrict processing and to give you your data in a portable format. We don’t make decisions about you based only on automated processing with legal or similarly significant effects: the plan engine only chooses movements.
South Africa (POPIA)
You can ask whether we hold information about you and who has had access to it, and object to direct marketing. We only send marketing if you opt in.
How to use them
Use the app, or email privacy@xperday.com from the address on your account. We reply within 30 days. You can complain to your data protection authority: in South Africa the Information Regulator (inforegulator.org.za), in the UK the ICO (ico.org.uk), in the EU your national authority (edpb.europa.eu).
Security
Data is encrypted in transit and at rest. Staff access needs a password and an authenticator code, and every staff action is logged. If a breach puts your information at risk, we will tell you and the regulators as the law requires.
Children
xPerDay is for people aged 16 and over. We don’t knowingly collect information from anyone younger. If you think a child has an account, email privacy@xperday.com and we’ll delete it.
Changes
When this policy changes we update this page and the date at the top. If a change is significant, we’ll tell you in the app before it takes effect.
Contact
Privacy questions and requests: privacy@xperday.com. xPerDay, xperday.com.