Privacy policy
Clear data choices, written for students.
This policy covers the BalanceMe competition prototype website, mobile web app, and shared API. The prototype is designed for students age 13 and older. It is not a medical service.
What the prototype collects
BalanceMe stores the app names and times entered by the user, daily and weekly averages, mood check-ins, goals, focus-session records, and reflection notes. Username sign-in creates an account identifier, stores a lowercase username, and records the date and time of the age-13 confirmation when a new account is created. Supabase Auth stores a case-sensitive password hash. A technical internal email identifier is generated for Supabase Auth; users do not supply an email address. BalanceMe does not request phone contacts, message content, browsing history, precise location, or an advertising identifier.
Why it uses this information
The data supports personal patterns, saved goals, focus-session records, and reflection in the app. Nudge switches control the on-screen preview; this web prototype does not schedule device notifications. BalanceMe does not infer a diagnosis or claim that one action caused a mood change.
Where data is stored
Before sign-in, entries, goals, journal notes, and unsynced changes stay in browser storage on the current device. After username sign-in, queued changes sync through the shared website API to Supabase under the signed-in user ID. The mobile app keeps account-specific local copies for use during connection failures. Signing out clears that account’s records and pending changes from the device. Guest records move to an account only after explicit username sign-in. Unsaved navigation drafts stay in memory; passwords are never stored in drafts. Username lookup and authentication run through the shared API and Supabase Auth. Both deployed interfaces use encrypted HTTPS connections. The desktop website also keeps a recent time breakdown in tab-scoped session storage valid for up to 15 minutes, plus a display-name draft and at most one pending name change. Private journal notes, goal text, focus text, and passwords are not included in that cache. Signing out clears the website cache, name draft, and pending name change; closing the tab clears its session storage.
Sharing and sale
BalanceMe does not sell personal information, run advertising, build marketing profiles, or share data for targeted advertising. Hosting and database providers process data only to operate the prototype.
Retention, export, and deletion
Records remain until they are deleted; this prototype has no automatic inactivity cleanup. App settings provide a machine-readable export and a control that deletes local entries plus synced daily entries, profile, journal, check-in, goal, and focus-session records. The separate Delete account control, after password confirmation, removes the username and authentication account and its associated saved records. Provider backups can remain for a limited technical recovery period.
Security
The API validates requests, limits accepted fields, uses encrypted HTTPS connections when deployed, and keeps database credentials on the server. No prototype can promise perfect security. The team should avoid entering private or sensitive details in reflection notes.
Students under 13
The prototype is not directed to children under 13 and does not knowingly collect their personal information. A real launch serving younger children would require a separate consent and compliance review.
Your choices
- Use the public educational website without saving app data.
- Turn off the nudge preview.
- End a focus session early without punishment.
- Export or delete stored prototype data.
- Decline device permissions. Core educational content remains available.
Email and network limits
Cross-device sync uses the same username and password on both sites. Usernames ignore case and must be unique. Passwords are case sensitive. BalanceMe stores a hashed network address alongside the username to limit each network to three accounts. It does not store the raw network address in the account table. No email is collected for password recovery, so a forgotten password cannot be reset through the prototype. Signing out does not delete records. Users can delete synced data or permanently delete their account from settings.
Contact and policy changes
Privacy questions can be sent to emailcomingsoon. Material policy changes will update the date at the top and receive a clear notice in the app.