Privacy policy

1.Who we are and what this covers

AddVantage is a private accountability community for Christian men. This policy covers the AddVantage mobile app and the servers behind it. Nothing else.

The app is run by [RESPONSIBLE PARTY NAME], [RESPONSIBLE PARTY ADDRESS]. Under South Africa's Protection of Personal Information Act (POPIA) that makes us the responsible party for your information. Our Information Officer is [INFORMATION OFFICER NAME]. You can reach us at [CONTACT EMAIL].

This policy is written in plain language on purpose. If something in it is unclear, email us and ask.

2.The short version

Read the whole thing if you can, but here is the honest summary.

• AddVantage is a community app. Most of what you put into it is visible to every other member. That is the point of the thing, but it means you should assume the community can see your profile, your chat messages, your workouts, your personal bests, your badges and your daily task ticks.
• Six things are private to you and nobody else in the community can see them: your vision board, your weigh ins, your book reading notes (unless you choose to share one), your Bible reading progress, your alarm settings, and your own extras on the 100CC list. Section 5 sets this out in full.
• Your information is stored with Supabase, on servers in Switzerland. That is outside South Africa.
• We run no analytics, no ad networks, no tracking and no AI on your data. If the app crashes, a technical report of what went wrong goes to Google so we can fix it, with anything that could identify you taken out first. Section 3.5 explains exactly what it contains.
• We send push notifications to your phone. The morning report, jersey changes, messages that concern you, evening reminders to finish your 100CC, and reminders from other members. Section 7 says exactly what passes through Google's notification service to reach you.
• If you live outside South Africa you can choose to run your 100CC day on your own time zone. Only then do we store which time zone it is. Section 3.2.
• You can delete your account yourself, from your profile. Section 9 explains exactly what that removes.

3.What we collect

We only collect what you type in or upload, plus the small amount of technical information any app needs to work. We do not buy data about you, and nothing is collected from other sources.

3.1 When you sign up

• Your email address. Used to sign you in, to send you a six digit code if you reset your password, and so that we can reach you about your account if we ever need to. We do not send marketing email.
• Your password. This one matters, so here is exactly what happens. Your password goes straight to our authentication provider over an encrypted connection and is stored only as a scrambled hash. It is never stored in the app, never written to our database in readable form, and nobody at our end, including community admins, can read it or recover it. The app requires at least eight characters, a capital letter, a number and a special character, and shows you which of the four you have met as you type.
• Your age, as a band. You tell us whether you are 18 or over, 16 or 17, or under 16. We keep the band, not your birthday, because the band is all we need to know which rules apply to you.
• Your parent or guardian's name, their relationship to you, and their email address, but only if you are 16 or 17. The law treats anyone under 18 as a child and lets us hold a child's information only with a parent or guardian's consent, so we have to record who gave it. We may use that address to confirm with them that they did. If you are 18 or over we never ask for this and never store it, even if you filled it in and then changed your answer.
• That you agreed, and to which words. We keep the date and a label for the exact wording you were shown, so that if we ever change what this policy says we can tell which version you actually read.

We do not ask for your phone number, your date of birth, your ID number, your home address, or any payment or banking details. The app has no payments in it.

3.2 When you set up your profile

• Your display name. Whatever you type. It does not have to be your legal name.
• Your profile photo, if you add one.
• Your province. You pick one of the nine South African provinces from a list. It is deliberately coarse. We do not ask for or collect your town, your street, or your GPS location, and the app never requests location permission. If you joined before the province picker existed, you may still have a free text town stored against you from that older version.
• Your 100CC time zone, only if you choose one. Your 100CC day runs from midnight to midnight South African time unless you choose otherwise. If your phone is set to another time zone, the app asks you once whether you want your day to close at midnight on that time instead. Your phone's time zone is read on your phone to ask that question. It is not sent to us unless you say yes, here or later in your profile. If you do, we store the name of the time zone, for example "America/Toronto", with the date your change starts and the last day of yours that has been closed. A time zone says roughly where in the world you are, so we treat it as location information. We use it for one thing: to work out when your day closes, which day your ticks belong to, and when your evening reminders go out. It is deleted with your account.
• Your bio, if you write one.

3.3 What you write inside the app

• Your Momentum Protocols. These are the two free text fields shown in the app as "I'm grateful for" and "I affirm that". Whatever you type there.
• Your two vices. The 100 Club challenge asks you to name two vices you are quitting. This is free text. Men typically name things like alcohol, pornography, or social media.
• Chat messages. The text of everything you post, the tag you pick for it if you pick one (General, Win, Prayer, Accountability or Question), any photo you attach, and the time you sent it. Two more things are stored on the message itself. If you post to your own province rather than to everyone, that province is saved on the message. It is a label used to sort and filter the chat and to decide who would be notified, not a privacy setting, and every member can still read the message either way. And if your message is a reply, the message it replies to is recorded, along with whether it went into a thread and a running count of the replies a message has collected.
• GIFs and stickers you send in chat. A GIF is not stored as a picture and not as a web address. What is saved on the message is a short code, which is KLIPY's own name for that GIF, and a word saying whether it is a GIF or a sticker. Your phone asks KLIPY for the picture that code stands for each time it draws it, and the picture is never copied onto our servers or kept on your phone. Delete the message and the code goes with it. What you typed into the search box to find it is not saved anywhere by us. See section 7 for what KLIPY itself receives.
• Workouts. Type, duration in minutes, the date, and any notes you add.
• Personal bests. The lift or metric, the number, the date you hit it, and any note. Some are against one of the club's listed activities, such as the 5K or the 2K row. Others are something you name yourself, like "Max pull-ups", that nobody else is tracking.
• Book reads. The book title and what you write about what you learned.
• Weigh ins. Your body weight and the date, plus any note.
• Goal weight. A target weight on your profile, if you set one.
• Vision board. The photos you upload and the captions you write on them.
• Your extras. Up to five short checklist points of your own that you add under your 100CC tasks, for example "Read the Word", and the days you tick each one. They never count toward the 100CC.
• A name on the boards, if you did the 100CC without the app. An admin can record your name, whether you finished or stopped, and the date, so that you appear on the club's Completed or broken run board. Nothing else is kept: no phone number, no email address and no account. Ask us and it is removed.
• Member challenges. If you turn a personal best into a challenge, or create one directly, the name you give it and any rules text you add. Your own entry, if you join one: your number and the date. If you share a challenge to General, the note you write with it. See section 4.6 for who can see all of this.

3.4 What the app records as you use it

• Daily task ticks. Which of the seven 100 Club tasks you completed on which date. One of those tasks is the no pornography and no masturbation task.
• Daily missions. Whether you ticked today's mission, and when. Admins choose the pool the app draws from, one mission a day for the whole club. Unlike your task ticks, this is private to you: see section 4.1 for what the rest of the club is shown instead, and section 5 for how it is kept private. A tick adds to your points total.
• Plans (Bible and self-improvement). Which plans you started, saved or finished, the day you started, which parts of each day you ticked, and when. If you set a reminder, the time you want it. If a day asks a question, the answer you write. If you do a plan with other members: which group you are in, who invited you, and anything you write in a day's talk thread.
• Strike missions (from Build 32, replacing the daily mission). Which strike mission you ticked on which day. Admins write the list, one order for every man, and nobody can reorder it. Private to you in the same way as the daily mission tick was. A tick adds 50 points to your total.
• Resources. Which resource items you have marked as read. From Build 32 the app also keeps, for each resource you have marked, the day it first paid you 20 points, so that the points are paid once and are never taken back by unticking it or by an admin deleting the resource. This record is private to you and is erased when you delete your account.
• Badges you earn, and when. The app also notes when it first showed you each new badge, so it tells you about it only once. Nobody else can see that note, and it is deleted with the badge.
• Streaks and the Yellow Jersey. Your current streak length, when it started, your best ever streak, and when you took or lost the jersey.
• First awake. Dismissing a wake up alarm is what claims the morning. If you are the first man to dismiss his alarm on a given day, and you do it between 03:00 and 10:00 South African time, the app records the date and the time you did it. Opening the app does not claim it, and neither does a dismissal outside that window.
• Alarm settings. The wake up time you set, whether the alarm is on, which tone you chose, and when it last went off.
• Callouts. If you log nothing at all for three days running, the system automatically drafts a short message about you by name. See section 4.3.
• Timestamps. When you joined, when you last signed in, and when you sent or logged each thing.

3.5 Technical information

• Your device's IP address, which is unavoidable for any internet connection. It is seen by our server provider and by the outside services listed in section 7. We do not store it ourselves or link it to your profile.
• A notification token for each phone you sign in on. Your phone gives the app a token so that notifications can reach it. We store that token against your account, with whether the phone is an Android or an iPhone, so we know where to send your notifications. We keep at most ten, dropping the oldest, and a phone's token is removed when you sign out on it.
• A few things saved on your own phone. The app itself writes a few dates to your phone: when the daily protocols prompt last showed, when you last opened the app, and whether you have finished today's 100CC, so that it opens on the right screen. It also keeps a message you have started typing in the chat but not sent, so it is still there when you come back, until you send it or sign out; the time of the newest chat message you have seen and when you last opened the chat, so it can mark what is new and count the messages that mention you; whether you answered the question about notifications; the version whose "What's new" notes you last saw; the time zone your 100CC day runs on and when your day closes, so the app knows your day before it has heard from us; and the time zone the app last asked you about, so it asks only once. The last two are removed when you sign out. Only your own words and times are kept this way, never anything another member wrote, and none of it leaves your device. Half-finished entries in the 100CC forms (a workout, a book reflection, your push-ups, your vices) are held only in the app's memory while it is open, never written to the phone, and never kept past midnight. The one exception is off grid mode: if you tell the app you will be without signal, the 100CC entries you make on those days (your ticks, your push-up count, a workout, a book reflection) and a copy of your own profile are written to the phone so the app can open and keep your days without a connection. They are sent to us when you are back online, removed from the phone once they have been saved, and removed when you sign out. Two of the libraries the app is built on keep their own local records as well: your signed in session is stored on the phone so you are not asked to log in every time you open the app, and the alarms you have scheduled are stored on the phone so they can ring without a connection. Neither of those holds anything you have written into the app.
• Crash reports. If the app crashes or runs into a serious error, technical details about what went wrong are sent to Firebase Crashlytics, a service Google provides. This happens in the app as you install it from the App Store, Google Play or a test invitation, and never in the development copies we build the app with. What is sent is a description of the error, which part of the app was running, technical details about your phone such as its model and operating system version, and a number Firebase gives this installation of the app. That number identifies the installation, not you by name. Before any of this leaves your phone, the app takes out anything that could identify you or another member: web addresses are cut down to the name of the server, and anything that looks like an id number, an email address, a security token, a long string of digits, a file on your phone, or the contents of something the app was trying to save is removed. Your name, your email address, your password and anything you have typed, ticked or posted are never sent. Google processes this information on our behalf and keeps it for 90 days, after which it starts removing it from its systems. Google may process and store it outside South Africa.

3.6 What we deliberately do not collect

• No location. No GPS, no coarse location, no location permission requested on either Android or iOS. The one exception is the 100CC time zone in section 3.2, which is stored only if you choose it and is never worked out from GPS.
• No contacts, no calendar, no microphone, no health app or fitness tracker data.
• No advertising identifier. On iOS the app tracking framework is compiled out of the build entirely, so the app cannot track you across other apps even if someone wanted it to.
• No analytics, no attribution SDK, no advertising network. There are none of these anywhere in the app. The one outside reporting service in the app is the crash reporting described in section 3.5, and it is told nothing about who you are.
• No AI and no language model touches your data. The daily report that posts to the chat every morning is a fixed template filled in with names and numbers. No member data is sent to any AI service, by us or by anyone else.
• We do not analyse the content of your messages. The tag on a message is always the one you picked yourself. An automatic tagging feature was built, tested, found to be inaccurate, and removed.

4.What other members can see

This is the most important section in this document. Read it properly.

AddVantage is built as an open community. The default is that other members can see what you do. Some of that is obvious, like chat. Some of it is less obvious.

4.1 Visible to every signed in member

• Your whole profile row. Your display name, your photo, your bio, your province, your two named vices, both of your Momentum Protocols texts, your goal weight, your membership tier and the date you joined.

  Be clear about what that means. The app screens do not display all of those fields to other members. But the database rule that controls who may read profiles allows any signed in member to read every column, and the app already downloads the full profile of every member onto every member's phone when you open the chat. Treat everything on your profile as visible to the community, including your vices and your goal weight, even where a screen does not show it.

• Every chat message you send, including the photo attached to it, the tag, and the time. Messages appear on other members' phones live as you send them.
• Your daily task ticks, per day. Any member can see which tasks you completed on which day. This includes the no pornography and no masturbation task. The leaderboard already reads exactly this data. If that is not something you want other men to be able to see about you, do not tick it in the app.
• How many men have done today's mission. A running count, shown to every member. It never says who, and it never names the mission you yourself skipped or ticked: see section 5 for what stays private. From Build 32 the same goes for strike missions: a count of the men who have ever done the mission on your screen, shown only once at least three have, never who.
• Your workouts, including the free text notes on them.

• Your personal bests against one of the club's listed activities, such as the 5K or the 2K row, including any note you attach. These are the ones that can appear on the club's boards, and they are listed on your profile and on the card other members see when they tap your name.

  A best you name yourself is different. It is a private record. No other member can read it, its date or its note, and it never appears on a board. Unless you turn it into a member challenge, or join one with it: see section 4.6.

• Your badges.
• Your streak, your Yellow Jersey history and your position on the leaderboard.
• Your Performance page. Any member can open it for any man. It shows how many of your days were whole, as a number and a percentage, for the last 7 days, the last 30 days and since you started; your last seven days, one mark a day; your 100CC run, your push-up run, your best push-up run and how many Hundreds you have finished; and your place among the men on each. All of it is worked out from the ticks and runs listed above, which every member can already see. When another member opens your page, or your member card, the app sets his own numbers beside yours and says who leads on each. That comparison uses only the numbers listed here and adds nothing to what he could already see. It also shows how many push-ups the whole club has done, once at least five men have logged some, and that number names nobody. [Your own push-up numbers are on it too: your total, your last seven days added up, your best day, your daily average and your place among the men. Your count for any one ordinary day is not.] The task by task list on your own page is shown to you alone.
• Whether you were first awake, and at what time. If you claim it, the app posts a message to the whole chat saying so by name.

4.2 Posted about you automatically

Every morning the app posts two lists to the community chat: the men who completed the 100 Club tasks the day before, and the men who did not. You are named on one of them. Each man sees them at 08:00 on his own 100CC time the next morning, together with the new leaderboards, or once the day has closed for every man in the community if that is later. It never says where anyone is.

Handing over the Yellow Jersey is also announced in the chat by name.

When you earn a patch, the app posts one line naming you and the patch to Announcements, once per patch. The 08:00 report also lists the patches earned overnight. When you set a new best on one of the club's listed activities, the app posts one line naming you, the activity and your number to Announcements, at most once a day for the same activity. A best you name yourself is never announced. None of these lines ever says which task you did or missed.

4.3 Callouts

If you log nothing at all for three days in a row, the system automatically writes a short, blunt message about you by name. An admin then either approves it or dismisses it. If it is approved, it is posted into the community chat as a system message tagged Accountability, where every member sees it.

There is no screen in the app that shows you a callout drafted about you. The database rule would let you fetch your own callout row if you went at the database directly, but nothing in the app puts it in front of you, and the only screen that reads callouts at all is the admin screen. In practice you find out when an admin approves it and it appears in the chat under your name. You cannot edit it, dismiss it, or delete it, and once it has been posted to the chat you cannot delete that either. Dismissed callouts stay in our database and you are not told about them.

This is a deliberate feature of an accountability community. We are telling you about it plainly so that nobody is surprised by it.

4.4 What admins can do

Community admins are members of the community, not staff.

• Admins can pin or delete any message in the chat, including yours. They cannot rewrite the words in one. The database rule that lets an admin change a message row does exist, so an admin going at the database directly could edit a message that way, but the app has no edit function and never writes the text of a message that has already been sent.
• Admins can delete your personal bests.
• Admins can approve or dismiss callouts, and can edit the wording of a callout before approving it.
• Admins can change your membership tier, and can remove you from the community.
• Admins can take you off the board of men who broke a run, with an optional reason that only the database keeps. Your record of the broken run stays as it was, and breaking another run puts you back on the board.
• Admins can add or remove the name of a man who did the 100CC without the app, with his result and the date, on the club's Completed and broken run boards. It is a name and a result only. If that is you and you want it gone, ask and an admin removes it.
• Admins can see that files from a deleted account are waiting to be removed: how many, whether they are photos, videos or vision board images, and when the account was deleted. They can remove them. They are not shown the files themselves, where they are stored, or whose account it was. Section 9.4 explains when this happens.
• Admins can see which time zone your 100CC day runs on, if you chose one, and when your day closes. They need it to correct a day or a credit on the right date. The app never shows it to other members. Be aware of one thing, in the same spirit as section 4.1: your ticks, which every member can read, carry the date of your day and the time they were saved, so a member who compared the two closely could tell roughly how far your day runs from South African time.
• Admins cannot edit your profile text, your protocols, your vices or your bio.
• Admins cannot see any of the private things listed in section 5. The database rules block them, not just the app screens.

4.5 What you cannot take back

• You cannot delete or edit your own chat messages. An admin can delete one. Nobody can edit one in the app once it is sent. If you post something you regret, ask an admin, or email us at [CONTACT EMAIL].
• You cannot remove a badge once you have earned it.
• You cannot delete your profile row.
• You can delete your own task ticks and your own personal bests.
• You cannot delete a workout from inside the app. There is no delete button for one and no screen that offers it. The database rule would allow you to remove your own workout row if you went at the database directly, but the app gives you no way to do it. A workout carries the free text notes you write on it and every member can read them, so treat a workout as permanent once it is logged. If you need one removed, email [CONTACT EMAIL].

4.6 Member challenges

A member challenge starts from a personal best you named yourself, which section 4.1 says is private. Turning it into a challenge, or joining one with a matching best of your own, moves that one number and its date out of your private records and onto the challenge's board, in the same instant, for every signed in member to see. Your private record itself is gone once it becomes an entry. Withdrawing later takes your entry off the board, and you can choose to keep the number as a private best again when you do; anyone who saw the board before then has already seen it.

• Your name and your number on a challenge's board are visible to every signed in member, ranked against everyone else in it, exactly like the club's own boards.
• Sharing a challenge to General posts a message from you. The card shows the challenge's name, its unit (reps or time), the man currently leading it and his number, and how many men are in it. It is your own chat message once posted: readable, reportable and deletable by an admin the same as anything else you send to General.
• Your entry stays on the board until you withdraw from it, or until you delete your account. Nothing removes it on its own.
• Admins can remove a single result from a challenge, or remove the whole challenge. Removing a challenge does not erase the entries already in it; it takes the board down and frees the name for someone else to use again.
• If you lose first place in a challenge, you get one push notification about it that day, naming the man who took it. You get at most one of these a day for the same challenge, however many times first place changes hands. A man you have blocked, or who has blocked you, never triggers this push either way.
• If the man who created a challenge has since left the community, the app shows "Set by a former member" in his place rather than his name.

5.What only you can see

These six things are private to you. No other member can see them, and neither can community admins. This is enforced by the database itself, not just by hiding a screen.

1. Your vision board. The photos and the captions. These are the only images in the app kept in a private store. They are shown to you through a temporary link that expires after ten minutes and cannot be opened by anyone else. See the note in section 6 about photos uploaded before this was built. One narrow exception: an admin can trigger the one time tool that moves those older photos into the private store. That tool never reads your captions, and it is worth being exact about the images rather than claiming more than is true. The tool has a preview mode, and the preview hands back to the admin's device the full old public web address of every legacy photo it found, other members' photos included, and those addresses open in any browser with no login. The admin screen displays only a count, but the addresses arrive on the device along with it, and an admin can call the tool directly and read them. The tool only ever lists photos still sitting in the old public store, so once the migration has been run there is nothing left for it to list.
2. Your weigh ins. The weight, the date and any note you attach. Note the difference: your recorded weigh ins are private, but your goal weight sits on your profile and is readable by the community. If you do not want a target weight visible, leave that field empty.
3. Your book reads. The book and what you wrote about what you learned. There is one exception, and it is entirely your choice: there is a share button which posts one entry, the title and your reflection, into the community chat as a normal post from you. It is off unless you tap it, one entry at a time. Once shared, it is a chat message like any other and you cannot delete it.
4. Your plans. Which plans, which day, which parts you have ticked, your reminder time, and every answer you write to a day's question. Your answers are private to you: no other member and no admin in the app can read them. One exception by design: if you join a plan with other members, they see your name, photo, how many days you have done and whether today is done (never which parts, never your answers), and what you write in that group's day threads. Leaving the group ends that; your plan carries on as your own.
5. Your alarm settings. Your wake up time, whether the alarm is on, the tone, and when it last rang. Nobody else can see what time you get up.
6. Your extras. What you call them and which days you ticked them. The database gives no member, and no admin in the app, any way to read them: the app can only ask for the extras of the man who is signed in.

Also private: the resources you have marked as read, any Bible plan or personal best metric you propose but that an admin has not yet approved, which is visible only to you and to admins, whether you ticked today's mission, which strike missions you have ticked, and which resources have paid you points. For the mission tick, "private" carries one exception by design: the count of men who ticked it that day is shown to the whole club, the same as a leaderboard total is. What stays private is which man is in that count.

Two more things are private to you:

• Your push-up numbers. The app adds up every push-up you have logged and shows the total on your own profile, and on your own Performance page with your last seven days, your best day, your average and your place among the men. [Other members can see these on your Performance page too: section 4.1.]
• How far you have read each chat room. The app keeps the time you last read General and Announcements so it can show how many messages are new, on the Chat button and on the app icon. When a message is pushed to your phone, your own number travels with that notification. No other member and no admin can read when you last read a room, and there are no read receipts.
• Your Bible highlights, notes and saved verses, with a short copy of each verse's words so your list can show them. No other member and no admin can read them, and they are deleted when you delete your account. If you share a verse to the chat, it is posted as a normal chat message from you, with the reference and the words only, and follows the same rules as any other message.
• Whether you said you are going to a club event. Other members see only how many men are going, never who. It is deleted with the event or with your account.

One honest qualification. "Only you" means inside the app. The small number of people who run the technical side of AddVantage hold the keys to the database and could technically read any row in it. We access member data only to fix a fault, to answer a request you have made, or where the law requires it. Our hosting provider likewise has technical access to the servers. There is no way to run a service like this without that being true, and any app that tells you otherwise is not being straight with you.

6.Photos and files

Photos and files in AddVantage are kept in separate stores and they are not all equally protected. This matters, so here it is plainly.

• Chat photos and profile photos are stored in a public bucket. Anyone on the internet who has the exact link to one of these images can open it without logging in to AddVantage. The links are long and effectively impossible to guess, but they are not secret, and they are handed to every member's phone as part of normal use. Do not post a photo in AddVantage chat that you would be unhappy for a stranger to see.
• Resource PDFs uploaded by admins are stored the same way and are equally public to anyone with the link.
• Vision board photos are stored in a genuinely private bucket. There is no public link. They can only be fetched through a short lived signed link that you alone can generate.
• Legacy vision board photos. Vision board images uploaded before the private bucket was introduced may still be sitting in the old public bucket, which means they may still be reachable by anyone holding the link. There is a migration built to move them. If you uploaded vision board photos in the early days of the app and want them checked or removed, email [CONTACT EMAIL].
• Deleting something in the app does not delete the file. If you remove a vision board tile, replace your profile photo, or an admin deletes a chat message, the underlying image file stays in storage. Nothing in the app ever deletes a stored file. For the public buckets, that means the old link keeps working. If you need a file genuinely removed, email us and we will remove it by hand.
• Uploaded files are checked automatically. Shortly after you upload a photo, video or PDF, a script reads the first few bytes of the file to confirm it really is the kind of file it says it is. It looks at nothing else and it does not look at what the picture shows. A file that is not what it claims to be is deleted, and it will show as unavailable wherever it was used. We keep a record of each check: the file's storage name, the result and the time. The record holds no part of the file.
• There is a limit on how much you can upload. Each member can add a limited number of files a day (at the moment 30 photos, 5 videos and 20 vision board photos in any 24 hours) and a limited total (at the moment 250 MB across photos, videos and vision board photos). If you reach a limit, the app tells you, and you can delete old files or try again later.

The app asks for photo library and camera permission only so you can pick or take a photo for the chat, your profile or your vision board. It does not scan your photo library and never reads a photo you have not chosen.

Video upload is not switched on. The app contains the code to upload a video and a storage bucket for videos exists, so a security scanner reading the build will report the app as video capable. Nothing in the app calls that code. There is no button anywhere that uploads a video, and no member video has ever been uploaded. If we switch it on, we will update this policy first.

7.Who else your information goes to

We do not sell your data. We do not share it for advertising. There is no advertising in the app. Here is the complete list of everyone your data reaches.

Opening a link in the app. The resources section can contain links that an admin has added. Tapping one hands the address to your phone's browser and AddVantage is no longer involved. Whatever site you land on has its own privacy policy and we have no control over it. The same goes for a meeting's Google Meet link, and for Add to calendar: it opens a Google Calendar page, or your Calendar app, with the event's name, time and details already in the link. AddVantage never reads your calendar and is not told whether you saved it. The same goes for the store: your profile can show a discount code for your rank and a link to the club's store, but the store is a separate site with its own policy, and nothing about what you buy there comes back to AddVantage.

Push notifications. We send notifications through Google Firebase Cloud Messaging, which reaches Android phones directly and iPhones through Apple. The title and text of each notification pass through Google, and for an iPhone through Apple, on the way to your phone. We send:

• The morning report and jersey changes, to the whole community, each man at 08:00 on his own 100CC time, or once the day has closed for every man if that is later. A jersey change names the man who took the jersey. We keep a record of which of these reached each member, so that nobody is sent one twice. Only the app's own service can read it, and we delete it after 14 days.
• Messages that concern you: a message that names you, a message to everyone, and a question to the admins and core members. These carry the sender's first name and the text of the message.
• Evening reminders to finish your 100CC, at 18:00, 20:00, 22:00 and 23:45 on your 100CC time, only while you are on a run and have not yet finished that day. A reminder never names which tasks you have left and never says how many.
• Reminders from other members. A member can remind you to finish your 100CC, and that notification carries his first name. It never says which tasks you have left. We keep a record of who reminded whom, which only the app's own service can read, and we delete it after 14 days.
• Plan reminders, at the time you choose on your own clock, only on a day you have parts left, and an invitation when another member asks you to do a plan with him. They carry the plan's name, the day, and for an invitation his first name. We keep a record of which went out, so nobody is sent one twice.
• Meeting and event reminders: a day before every meeting or event your rank can see, then an hour before an event you said you are going to, or 15 minutes before a meeting. They carry the name and time only. The day-before one is never sent between 22:00 and 06:00 South African time. We keep a record of which reminders went out, so that nobody is sent one twice.
• A notice to admins, and only to admins, when files from a deleted account could not be removed. It does not name the member and does not say what the files are.

You can turn notifications off in your phone's settings at any time. On Android, the phone's settings also let you turn off some kinds of notification without turning off the others.

The alarm rings from your own phone. The wake up alarm is a local alarm on your device. It does not need a connection and no outside company is involved. Your alarm settings themselves (the time, the tone, whether it is on) are saved to our database so they survive a reinstall, and they are private to you. The notification permission the app asks for on Android and iOS covers that alarm and the push notifications described above.

Law enforcement. If we are legally required to hand over information, we will. We are not aware of ever having been asked.

8.Where your data is stored, and what that means

Our Supabase project runs in the AWS eu-central-2 region, which is Zurich, Switzerland. Your information is physically stored in Europe, not in South Africa.

You should know what that means:

• Under POPIA section 72, sending personal information out of South Africa is a cross border transfer. We rely on Switzerland and the European Economic Area having data protection laws that are at least as strong as POPIA, which they are. Switzerland is recognised by the EU as having adequate protection.
• Because your data sits in Europe, the European GDPR is also likely to apply to it. That is generally good for you, because GDPR rights are strong ones.
• The Bible text service and Google Fonts are reached from your own phone, so your device's IP address goes to those companies wherever they are. Google is a United States company. Neither service is told who you are.
• KLIPY is reached from your own phone in the same way, and this one carries words you typed. When you search for a GIF, and again each time your phone draws a GIF somebody sent, the request goes straight from your phone to KLIPY and never passes through our database. So your search words and your device's IP address leave South Africa without us holding them or seeing them. KLIPY is not told who you are: the app leaves out the optional field KLIPY offers for identifying one user from another.
• Apple, for TestFlight, is a United States company and does hold your email address as a tester.
• Crash reports go to Google, a United States company, and Google may process and store them outside South Africa. They are not told who you are.

We are describing the legal position as we understand it. We are not claiming any certification, and nothing here is a legal opinion.

9.How long we keep things, and deleting your account

This section is the most uncomfortable one to write, and it is the one you most need to read.

9.1 We keep things indefinitely

Almost nothing in AddVantage deletes old data automatically. Your messages, your task history, your workouts, your badges and your profile stay until you delete your account or somebody removes them by hand. The only exceptions are short lived records the app keeps for its own running: the record of reminders and morning notifications sent to you, and of who reminded whom, is deleted after 14 days, and the nightly snapshot of the leaderboards and jerseys is deleted after 60 days. Crash reports are not kept by us at all: Google holds them for 90 days (section 3.5).

9.2 Being removed from the community is not deletion

An admin can remove you from the community. If that happens, you are shown a screen telling you so, and you can no longer post or log anything.

Being removed does not delete anything. Your name, your photo, your province, your vices, every message you ever sent and your entire task history stay in the database and stay visible to the community exactly as before. You are hidden from the leaderboard and from the daily report, and that is all. Removal is also reversible by an admin.

Being removed does not stop you deleting your account. The screen that tells you that you have been removed has "Delete my account" on it too, and it does exactly what section 9.3 describes. You do not need an admin to restore you first.

9.3 Deleting your account yourself

You can delete your account from inside the app. On your profile, tap "Delete my account" and type DELETE to confirm. If an admin has removed you from the community you can no longer reach your profile, so the same "Delete my account" is on the screen that tells you that you have been removed, under Sign out. It asks the same thing and deletes the same things.

It removes your files first: your profile photo, your chat photos and videos, and your vision board images. Then it deletes your account, which removes almost everything else with it: your profile, your messages, your task history, your workouts, your personal bests, your badges and jerseys, your weigh ins, your book reads, your gratitude entries, your vision board, your Bible progress, your alarm settings, your callouts, your streak records, your notification tokens and your invite redemption.

Two honest caveats:

• Content you created that belongs to the community stays, without your name on it. If you proposed a Bible plan or a personal best metric that an admin approved, it stays in the app, but it is no longer attributed to you. Resource documents an admin uploaded for everyone are not affected.
• If you are the only admin left, you are asked to make someone else an admin first, so the community is never left without anyone able to run it.

9.4 If something is left behind, or you cannot use the app

Now and then, our file storage may fail to remove one of your files when you delete your account. The app tries again, then checks that each file is really gone. If one still is not, your account is still deleted, and the app tells you so. Before your account is deleted, the place that file is stored is written down, and once your account is deleted the community admins are sent a notice. Only the location is written down, never the file itself, and no member, admins included, can read it. Admins can remove the file from inside the app, and if that does not work, we remove it by hand. If the location cannot be written down, your account is not deleted and the app asks you to try again. That order is deliberate: a file that fails to delete is never left behind without anyone knowing.

If you think anything of yours is still there, or you cannot get into the app to delete your account yourself, email [CONTACT EMAIL] from the address you signed up with and we will remove it by hand.

We will confirm to you when it is done. We aim to do it within 30 days, which is the GDPR standard and a reasonable reading of POPIA.

10.Why we are allowed to hold this

Under POPIA and the GDPR we have to have a reason. Ours are:

• Your consent. You chose to join a private accountability community and you choose what to type into it. Everything in section 3.3 is there because you put it there. You can withdraw consent by asking us to delete your account.
• Performing the service you asked for. We cannot run a leaderboard without task logs, or a chat without messages.

Some of what AddVantage holds counts as special personal information under POPIA section 26, and special category data under GDPR Article 9. Specifically: the fact that you are a member of a Christian community at all, what you write in your protocols, your named vices, your weight and goal weight, your workouts, and your daily record on the no pornography task. The lawful basis for that is your explicit consent, given by choosing to enter it. If you would rather not have any of it in the app, leave those fields empty. The app works without them.

11.Your rights

Whether under POPIA or the GDPR, you have the right to:

• Know what we hold about you. Ask and we will tell you.
• Get a copy of it. There is no export button in the app today. Email us and we will put it together by hand.
• Correct anything wrong. You can edit your own profile, protocols and vices in the app at any time. A chat message cannot be edited in the app by anyone once it is sent, not by you and not by an admin, so ask an admin to delete it, or email us.
• Have it deleted. See section 9.
• Object to how we use it, and to withdraw your consent.
• Complain. If you are unhappy with how we have handled your information you can complain to the Information Regulator (South Africa). Their contact details are on inforegulator.org.za. If the GDPR applies to you, you may also complain to a data protection authority in your country.

Email [CONTACT EMAIL] to exercise any of these. We will not charge you and we will not make it difficult.

12.Age

You must be at least 16 to use AddVantage.

When you create your account the app asks whether you are 18 or over, 16 or 17, or under 16. If you answer under 16 it will not create the account, and it tells you so rather than failing silently.

If you are 16 or 17, a parent or guardian has to agree first. South African law treats anyone under 18 as a child and allows us to hold a child's information only with the prior consent of a parent, guardian or other competent person. So the app asks for their name, how they are related to you, and their email address, and the box you tick says that they have read this and agree, not that you have. We may write to that address to check with them. If they tell us they did not agree, we delete the account and everything in it.

We take your word for your age. Nothing in the app verifies it, and we would rather say so than imply a check we do not do.

Be aware of what is inside before you or your parent agree. The 100 Club task list puts explicit wording about pornography and masturbation on the screen. The chat is what members write to each other and is not moderated in advance. The callout feature names individual members publicly.

If you believe someone under 16 has an account, email [CONTACT EMAIL] and we will remove it.

13.Security

• Everything the app sends travels over an encrypted connection.
• Your password is stored only as a scrambled hash and cannot be read by anyone.
• Access to your private data is enforced by rules in the database itself, not just by hiding things in the app.
• Only a small number of people hold the keys to the production database.

No app is perfectly secure, and we are not going to claim otherwise. If you find a security problem in AddVantage, please email [CONTACT EMAIL] rather than posting it in the chat, and we will fix it.

14.Changes to this policy

If we change this policy in any way that matters, we will post about it in the AddVantage community chat and update the date at the top. Small corrections of wording will just get a new date.

15.Contact

Questions, requests, complaints, or a deletion request: [CONTACT EMAIL].

Information Officer: [INFORMATION OFFICER NAME], [RESPONSIBLE PARTY NAME], [RESPONSIBLE PARTY ADDRESS].