Privacy Policy

Account data. When you create an account, we collect your email address, authentication identifiers, and any profile details you choose to add, such as display name and avatar settings.

Habit and progress data. We store the habits you create, goals, reminder settings, completion logs, streaks, XP, badges, sleep entries, and related progress statistics.

Health and sensor data. If you grant permission, Lagan reads step-count and sleep data from Android Health Connect, sleep data from Apple HealthKit, and step data from your device pedometer or motion sensor. You can also enter sleep and habit data manually.

AI feature inputs. When you use AI Coach, AI routine refinement, AI smart reminders, validation, or weekly reports, we process relevant habit names, progress, completion history, reminder context, onboarding answers, and similar app data needed to generate the response.

Subscription data. If you subscribe to Lagan Pro, we receive subscription status, entitlement, product ID, billing period, platform, and store identifiers from RevenueCat. We do not receive or store your payment card details.

Device, diagnostics, and support data.We may process app version, platform, operating system, device model, crash reports, error logs, product analytics events, feedback messages, support requests, and approximate technical identifiers needed to operate and secure the service.

Lagan uses Health Connect, HealthKit, pedometer, and motion data only to provide the health and fitness features you choose, such as step habits, sleep tracking, sleep scores, habit progress, and reminders.

• We request only the health data types needed for the feature you enable.
• You can deny or revoke health permissions in your device settings.
• Manual habit and sleep logging remains available if you do not grant access.
• We do not sell health data, use it for advertising, transfer it to data brokers, use it for creditworthiness, or use it for unrelated secondary purposes.
• Health data may be stored in your Lagan account when needed to sync your progress across devices and display it inside the app.

We use personal data to:

• Provide habit tracking, streaks, XP, badges, leaderboards, sleep tracking, and data export.
• Generate AI coaching, routine suggestions, smart reminders, and progress reports.
• Send reminders and push notifications you configure or allow.
• Verify Lagan Pro trials, subscriptions, restore purchases, and entitlements.
• Respond to support, feedback, security, and account deletion requests.
• Measure product reliability and improve features using limited analytics and crash data.
• Prevent abuse, protect accounts, comply with law, and enforce our Terms.

We do not sell your personal data.

Lagan uses Google Gemini through server-side Supabase Edge Functions for AI-powered habit coaching, routine refinement, smart reminders, habit validation, and weekly reports. These features require you to attest that you are 18 or older. We store the attestation time and disclosure version, but do not store your birth date.

We send only the data reasonably needed for the specific AI feature through our paid Gemini service. We do not send passwords, payment card data, or raw store payment details to the AI model. AI telemetry contains structured outcomes and performance data, not prompts, responses, habit names, or health samples.

AI outputs may be inaccurate or incomplete. Lagan validates and limits many AI responses before showing them, but AI features are not medical, legal, financial, or professional advice.

AI features provide suggestions only. We do not use AI to make decisions that produce legal effects about you or that similarly significantly affect you without human involvement. You can revoke AI access at any time from Settings, then Privacy & Data. Revocation immediately stops new Gemini processing for your account and returns affected features to deterministic fallbacks.

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, Lagan Health is the controller of your personal data, and we process it on the following legal bases:

• Performance of a contract — to create and secure your account and provide the habit tracking, subscriptions, and features you request.
• Consent — for health and sensor data, AI processing (your 18+ attestation), optional product analytics and crash reporting, push notifications, and any marketing messages. You can withdraw consent at any time without affecting processing already carried out.
• Legitimate interests — to keep the service secure, prevent fraud and abuse, debug and improve features, and understand how Lagan is used, balanced against your rights and freedoms.
• Legal obligation — to comply with applicable law and with tax, accounting, and store-policy audit requirements.

Health data is treated as a special category of personal data, and we process it only with your explicit consent for the features you enable, or where otherwise permitted by law.

On the website, we use Supabase authentication cookies to keep you signed in and a timezone cookie named lagan_tz to show dates in your local timezone. In the mobile app, we use local storage and secure storage for session state, opt-out preferences, tracking preferences, and similar app settings.

These cookies and identifiers are strictly necessary to sign you in and show correct dates, or are used for the optional analytics and crash reporting you can turn off in Settings. We do not use advertising cookies or cross-site tracking for ads.

We share data with service providers only to operate Lagan, process subscriptions, deliver notifications, provide AI features, monitor reliability, support users, and comply with legal obligations.

If you opt in to the leaderboard by setting a display name, your display name, avatar, rank, XP, level, streak, and aggregate habit stats may be visible to other users in leaderboard and sharing features. You can opt out by removing your display name from the leaderboard.

We keep account and app data while your account is active or as needed to provide the service. When your account deletion request completes, we delete your authentication account, profile, habits, completions, sleep entries, and feedback linked to your account.

We may retain limited operational records, security logs, subscription records, completed deletion audit records, and legal or tax records where necessary for security, abuse prevention, compliance, dispute handling, or store-policy audit obligations. These retained records are not used to restore your deleted account.

Depending on your location, you may have rights to access, correct, export, object to, or delete personal data. You can:

• Export your data in the mobile app from Settings, then Privacy & Data, then View my data export.
• Delete your account from Settings, then Privacy & Data, then Request account deletion, or visit our account deletion page.
• Opt out of analytics and crash reporting from Settings, then Privacy & Data.
• Control health permissions in Android Health Connect, Apple Health, or your device settings.
• Control notifications in Lagan reminder settings and your device notification settings.
• Control AI processing by confirming or revoking AI access from Settings, then Privacy & Data.
• Contact us at privacy@lagan.health.

We will respond to rights requests within the timeframe required by applicable law. We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.

In addition to the choices above, you may have extra rights depending on where you live. Where regional law grants stronger rights, those rights apply.

EEA, UK & Switzerland (GDPR / UK GDPR). You have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You can also lodge a complaint with your local data protection supervisory authority — in the UK, the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); and in the EEA, your national authority. We would appreciate the chance to address your concerns at privacy@lagan.health before you do so.

California (CCPA / CPRA). In the past 12 months we have collected the following categories of personal information: identifiers (such as email and account IDs); commercial information (subscription status); internet or network activity (app and diagnostic events); and health-related information you choose to provide or connect. We collect it from you and your device for the business purposes described in this policy. We do not sell or share personal information as those terms are defined under the CPRA, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information beyond the purposes permitted by the CPRA, and we do not use it to infer characteristics about you. You have the right to know, access, delete, and correct your personal information, and the right not to receive discriminatory treatment for exercising these rights. You may use an authorized agent to submit a request. Under California's "Shine the Light" law, we do not disclose personal information to third parties for their own direct marketing.

Other US states. If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you have rights to confirm, access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. We do not sell personal data, serve targeted advertising, or carry out such profiling. If we decline a request, you may appeal by emailing privacy@lagan.health with "Appeal" in the subject line.

Brazil, Canada, Australia & other regions. If you are protected by Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, or a similar law, you have the corresponding rights to access, correct, delete, and obtain information about the processing of your personal data, and to complain to your national regulator. Contact us at privacy@lagan.health to exercise these rights.

Lagan and its service providers may process and store data in the United States and other countries whose data-protection laws differ from those where you live.

Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and adequacy decisions where available, together with our service providers' data-processing terms. You can contact us for more information about these safeguards.

Lagan is not directed to children under 13 or the minimum digital-consent age in your jurisdiction (for example, up to 16 in parts of the EEA). We do not knowingly collect personal data from children below the applicable age, and AI features are limited to users who attest they are 18 or older. If you believe a child has provided data to Lagan, contact us and we will take appropriate steps to delete it.

We use technical and organizational safeguards designed to protect personal data, including encrypted transport, access controls, row-level database protections, and monitoring. No system is completely secure, so you should use a strong password and protect access to your email and device.

We may update this policy from time to time. When we do, we will update the "Last updated" date. For material changes, we may also provide notice by email, in-app message, website notice, or another appropriate method.

For privacy questions or requests, email privacy@lagan.health or contact support at support@lagan.health.

Lagan Health