Privacy Policy

1.1 Information You Provide

When you choose to use My Bad Day, you may provide:

• Account Information: Email address, display name, profile picture, and authentication credentials
• Mood Tracking: Daily mood entries, mood levels (1-5 scale), timestamps, and notes
• Sleep Tracking: Sleep quality ratings, duration, factors, interruptions, and environment details
• Period/Cycle Tracking: Cycle dates, flow intensity, pain levels, symptoms, and energy levels
• Journal Entries: Personal reflections, thoughts, and written content
• Relationship Data: Connection names, relationship types, interaction notes, and bond health information
• Partner Sharing (Optional): When you choose to share data with a selected partner or close person, you grant them access to specific wellness information you select to share
• Preferences: Notification settings and feature preferences

1.2 Technical Information Collected Automatically

We collect minimal technical information necessary to operate the app:

• Device Information: Device type, operating system version, app version
• Crash Reports: Technical error logs when the app crashes (to fix bugs and improve stability)
• App Performance: Basic performance metrics to ensure the app runs smoothly

We do not track your in-app behavior, navigation patterns, or which features you use. We only collect technical data required by app stores and for maintaining app stability.

2.1 Legal Basis for Processing Health Data

We process health data based on your explicit consent (GDPR Article 9(2)(a)).

Before you enter any health data, we will:

• Clearly explain what health data you can enter
• Explain how this data will be used
• Request your explicit consent
• Allow you to use the app without these features if you decline

3.1 Legal Bases for Processing

4.1 AI Features

My Bad Day uses artificial intelligence to enhance your experience. AI features include:

• Weekly journal summaries
• Mood pattern insights
• Wellness tips and recommendations
• Emotional coaching responses

4.2 What Data is Sent to AI Services

4.3 Consent for AI Processing

AI features require your explicit consent. You will be asked to consent when you first use AI-powered features. You may choose not to enable or use any features that utilize AI processing. The core functionality of My Bad Day remains fully available without AI features.

5.1 Service Providers

We work with trusted third-party service providers to deliver our services:

All service providers are bound by data processing agreements that require them to protect your data in accordance with GDPR.

5.2 Partner Sharing

You control partner sharing. My Bad Day includes an optional feature that allows you to share specific wellness data with a partner or close person you select.

• Your consent required: By inviting a partner and using this feature, you explicitly consent to share selected wellness information with that specific person
• You choose what to share: Control which data categories (mood, sleep, cycle, insights) your partner can view
• Revocable anytime: You can stop sharing or remove partner access at any time
• Single partner: This feature is designed for sharing with one selected partner or close person at a time

5.3 When We Share Data with Third Parties

• With your explicit consent
• With service providers under strict contractual obligations
• When required by law, court order, or government request
• To protect the rights, safety, or property of our users or others
• In connection with a merger or acquisition (with prior notice)

Security Measures

We implement industry-standard security measures:

• Encryption: All data transmitted between your device and our servers is encrypted, and data stored in our databases is encrypted at rest
• Access Controls: Strict access controls, multi-factor authentication for administrative access, and regular audit logs
• Infrastructure: Hosted on secure cloud infrastructure with regular security assessments and automated threat detection

How Long We Keep Your Data

We retain your personal data in accordance with GDPR requirements:

• Account and tracking data: Retained while your account is active. When you request account deletion, the deletion process initiates immediately and all personal data is permanently deleted from active systems within 30 days, with complete removal from backup systems within 90 days.
• Legal and billing records: Retained for up to 7 years as required by tax and legal regulations
• Anonymized technical data: May be retained indefinitely for service stability and improvement

Your Rights:

• Right to Access (Article 15): Request a copy of all personal data we hold about you
• Right to Rectification (Article 16): Correct any inaccurate or incomplete personal data (you can edit most data directly in the app)
• Right to Erasure (Article 17): Request deletion of your personal data (you can delete your account in settings)
• Right to Restrict Processing (Article 18): Limit how we process your data
• Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format
• Right to Object (Article 21): Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for any processing at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

Your data may be processed in the European Union (primary data storage in EU regions) and the United States (AI processing, payment processing).

For transfers outside the EEA, we ensure protection through Standard Contractual Clauses (SCCs) approved by the European Commission, data processing agreements with all service providers, and data anonymization (especially for AI processing in the US).