Routinity Privacy Policy
INTRODUCTION
Routinity ("we," "our," or "us") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service"). Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.
1. INFORMATION WE COLLECT
1.1 Information You Provide Directly
Sign-in methods: Google OAuth, Apple Sign In.
When you create an account through Google OAuth, we collect:
- Full name as registered with Google
- Email address
- Profile photograph
- Google account identifier
When you create an account through Apple Sign In, we collect:
- Name as provided by Apple (if shared)
- Email address (which may be a private relay email from Apple)
- Apple account identifier
1.2 Information Collected Automatically
Routine activity
- Routine usage data (the situation or emotion you select, completion status, duration)
- Emotional state ratings before and after routines (1-5 scale)
- Time of use (hour of day, day of week)
- Device type (mobile or desktop) and app version
- App usage patterns and behavioral data
We use this information to analyze your recovery patterns and generate your weekly report.
Usage analytics
- App opens, screen views, routine starts and completions (collected in anonymized form via an analytics tool)
- When an error occurs: device type, OS version, and error details
1.3 Subscription Information
- Whether Routinity Pro is active or expired, and which plan you are on (monthly or yearly)
- Payment details (card numbers and similar information) are handled by Apple. Routinity never collects or stores them.
1.4 Information We Do NOT Collect
- Payment information (card numbers are processed by Apple and never reach us)
- Location data
- Contacts or address book
- Camera or microphone data
- Biometric data
- Government IDs or Social Security numbers
2. HOW WE USE YOUR INFORMATION
2.1 Service Provision
- To create and manage your account
- To provide personalized routine recommendations
- To generate your weekly report and custom routines from your routine activity
- To track your routine history and progress
- To display your usage statistics
- To manage your Routinity Pro subscription status and provide paid features
2.2 Service Improvement
- To analyze usage patterns and improve features
- To develop new routines and content
- To fix bugs and optimize performance
- To conduct internal research and analytics (anonymized and aggregated data only — individual data is never used for research)
2.3 Communications
- To send service-related notifications
- To respond to your inquiries
- To send marketing communications (only with your explicit consent)
- To notify you of significant policy changes
2.4 Legal Compliance
- To comply with applicable laws and regulations
- To respond to lawful requests from authorities
- To protect our legal rights and interests
3. AI-POWERED WEEKLY REPORTS
Routinity generates your weekly report and custom routine solely from your routine activity. To do so, your activity data (selected situation, time of use, before/after state scores, routine type) is sent through Routinity's servers to an AI language model provider (Anthropic PBC, USA).
- This data does not include your name, email address, or any other directly identifying information.
- Anthropic processes the data only to generate your report and does not use it to train AI models (per Anthropic's API usage policies).
- Generated reports are stored in your account and deleted together with it when you delete your account.
- Reports are general self-reflection material based on your activity and do not replace medical or psychological diagnosis or treatment.
4. LEGAL BASIS FOR PROCESSING
We process your personal information based on:
- Your explicit consent (Article 15, Personal Information Protection Act of Korea)
- Performance of our contract with you
- Compliance with legal obligations
5. DATA SHARING AND DISCLOSURE
5.1 Service Providers
Google LLC
- Purpose: Authentication via Google OAuth
- Note: Your Google account security is your responsibility. We are not liable for damages caused by unauthorized Google account access.
Apple Inc.
- Purpose: Authentication via Sign in with Apple
- Note: Your Apple ID security is your responsibility. We are not liable for damages caused by unauthorized Apple account access.
Supabase Inc.
- Purpose: Database storage and management
- Location: United States
- All transfers encrypted
Anthropic PBC
- Purpose: AI generation of weekly reports and custom routines
- Location: United States
- Data shared: de-identified routine activity only (see Section 3)
PostHog Inc.
- Purpose: Service usage analytics
- Location: United States
- Data shared: anonymized usage flow information
Functional Software, Inc. (Sentry)
- Purpose: Error reporting and diagnostics
- Location: United States
- Data shared: device type, OS version, error details
5.2 Legal Requirements
We may disclose your information only when required by:
- Valid court orders or warrants
- Legal obligations under applicable law
- Emergency situations involving risk to life
5.3 What We Will NEVER Do
- Sell your personal information to third parties
- Share your data with advertisers
- Use your data beyond stated purposes
- Transfer data to unauthorized parties
6. DATA RETENTION AND DELETION
6.1 Retention Period
- Account information: Until account deletion
- Routine records: Until account deletion
- Weekly reports: Until account deletion
- Usage logs: 6 months
- Error logs: 90 days
- Legal dispute records: 1 year after resolution
Routine activity and weekly reports are kept until you delete your account, at which point they are deleted without delay. Usage statistics are kept only in anonymized form.
6.2 Deletion Process
Upon account deletion request:
- Acknowledgment email sent upon receipt of request
- All personal data deleted within 10 business days
- Completion confirmation email sent upon deletion
- Deletion records retained for 6 months as evidence
- Anonymized aggregate data may be retained for research
- Backup copies purged within 30 days
6.3 Data Deletion Method
- Electronic files deleted using methods that prevent recovery
- Backup data overwritten or destroyed
7. DATA SECURITY
7.1 Technical Safeguards
- All data transmitted via HTTPS/TLS encryption
- Data at rest encrypted
- Access controls limiting data to authorized personnel
- Regular security assessments
7.2 Data Breach Response
In the event of a data breach:
- Affected users notified within 72 hours via email and in-app notice
- Description of breach, affected data, and remediation steps
- Report filed with relevant authorities as required
8. INTERNATIONAL DATA TRANSFER
Your data is stored on servers in the United States (Supabase infrastructure). By using our Service, you consent to this transfer. All transfers are encrypted and subject to data processing agreements.
Your data is processed by the following service providers located outside your country:
- Anthropic PBC (USA) — AI report generation, de-identified routine activity
- Supabase Inc. (USA) — data storage and authentication
- PostHog Inc. (USA) — anonymized usage analytics
- Functional Software, Inc. / Sentry (USA) — error reporting
Each provider processes your data only for the stated purpose. You may refuse these transfers, but doing so may limit your use of the Service.
9. YOUR RIGHTS
9.1 Rights Under Korean Law (PIPA)
- Right to be informed about data processing
- Right to access your personal information
- Right to correct inaccurate information
- Right to delete your information
- Right to suspend processing
- Right to withdraw consent at any time
9.2 How to Exercise Your Rights
Email: routinity.app@gmail.com
Response time: Within 10 business days
Identity verification may be required.
Refusal will be communicated with reasons.
9.3 Right to Complain
- Personal Information Protection Commission: privacy.go.kr
- Personal Information Dispute Mediation: +82-2-2100-2499
- Cyber Crime Report Center: cyberbureau.police.go.kr
- Personal Information Infringement Report: 182 (no area code)
10. CHILDREN'S PRIVACY
10.1 Age Restriction
Our Service is not directed to individuals under 14 years of age.
10.2 False Age Declaration
If a user provides false age information to access the Service:
- Legal responsibility lies entirely with the user (or their legal guardian)
- We are not liable for any consequences arising from false age declarations
10.3 Discovery of Minor's Data
If we discover data collected from a user under 14:
- Account immediately suspended
- All data deleted within 48 hours
- Parent/guardian notified if contact info available
10.4 Parental Rights
Parents/guardians may contact us to:
- Access their child's data
- Request deletion of their child's data
- Withdraw consent on behalf of their child
11. COOKIES AND LOCAL STORAGE
Used for: Login state maintenance, onboarding completion tracking
To disable: Adjust browser settings
Note: Disabling cookies will prevent you from staying logged in.
12. AUTOMATED DECISION MAKING
Routinity uses AI to automatically generate your weekly report and custom routines from your routine activity (see Section 3). These are provided for your reference only and have no legal or similarly significant effect on you.
Apart from this, Routinity does not use automated decision-making or profiling; all other routine recommendations are based on your manual selections. You can stop this processing at any time by not using the weekly report feature or by deleting your account.
13. RESEARCH AND ACADEMIC USE
Your data may be used for academic research only in the following form:
- Completely anonymized and aggregated
- Individual users cannot be identified
- Raw personal data is never used for research purposes
14. MARKETING COMMUNICATIONS
Only sent with your explicit consent.
To opt-out: routinity.app@gmail.com
Processed within 5 business days.
15. DATA PROTECTION OFFICER
Email: routinity.app@gmail.com
Response Time: Within 10 business days
16. SERVICE TERMINATION DATA HANDLING
In the event of service termination:
- 30 days advance notice provided
- Data download period provided before termination
- All data permanently deleted upon service closure
17. CHANGES TO THIS POLICY
Policy version is dated and tracked.
- Minor changes: Updated version date only
-
Material changes: 7 days advance notice via in-app notification and email
- Email delivery records maintained as evidence of notification.
- Notice is deemed delivered upon email transmission regardless of receipt. Continued use after changes = acceptance
18. CONTACT US
Email: routinity.app@gmail.com
Response Time: Within 10 business days
Version: 2026-09-04