AVEO Privacy Policy

Data Controller

AVEO is operated by Maksym Oshodi, Dominick Odujebe, and Princess Nwedo. For privacy questions, contact support@aveoapp.com.

Information We Collect

• –Account information — If you create an account, AVEO collects your email address, username, display name, optional profile photo, optional profile emoji, and authentication details handled by Supabase. AVEO does not store your plain text password.
• –Activity and goal data — Session category (Focus, Move, Unplug, Create), duration, start and completion time, optional session notes, personal goals, daily target settings, and streak data.
• –Social and community data — Friend requests and accepted friendships, community membership and invite status, community rankings, active session status while a session is running, reactions, comments, comment likes, and reports you submit.
• –Local device data — AVEO stores app data locally on your device. In guest mode your data may remain only on your device unless you sign in and sync to cloud backup.

Lawful Basis for Processing

• –Contract (Article 6(1)(b) GDPR) — Account creation and management, session and goal storage, friend and community features, and push notification delivery are necessary to provide the service you signed up for.
• –Consent (Article 6(1)(a) GDPR) — Push notification permission is obtained via the iOS system prompt. You may withdraw consent at any time in iOS Settings.
• –Legitimate interests (Article 6(1)(f) GDPR) — Anonymised product analytics via PostHog are used to understand how the app is used and improve reliability. This processing does not identify individual users.

Notifications

AVEO uses Apple Push Notifications to send activity from friends and communities. Your device push token is stored securely in your account and used only to deliver AVEO notifications. It is not accessible to other users. You can withdraw notification permission at any time in iOS Settings.

How We Use Information

• –Create and manage your account.
• –Save sessions and goals, show stats, streaks, and progress.
• –Sync activity between devices when signed in.
• –Power friend and community features.
• –Deliver push notifications.
• –Review reported content to keep the community safe.
• –Improve app reliability and user experience through anonymised analytics.

Service Providers

• –Supabase — authentication, database, and file storage infrastructure. Data is processed under Supabase's data processing terms.
• –Resend — transactional email delivery (account confirmation, password reset). Only your email address is shared for this purpose.
• –Apple Push Notification Service (APNs) — device push token delivery. Tokens are transmitted to APNs to deliver notifications.
• –Expo Push Service — intermediary for delivering push notifications to APNs.
• –PostHog (EU region, eu.i.posthog.com) — anonymised product analytics. No personal data is included in analytics events.
• –AVEO does not sell your personal information to any third party.

International Transfers

Some of the service providers listed above process data outside the European Economic Area. Where this occurs, transfers are subject to appropriate safeguards such as Standard Contractual Clauses approved by the European Commission. PostHog data is processed within the EU (eu.i.posthog.com). Supabase, Resend, Apple, and Expo may process data in the United States under their respective data processing agreements.

Data Retention

• –Account data (email, username, display name, profile photo) — retained while your account is active and deleted within 30 days of account deletion.
• –Session logs, goals, and streak data — retained while your account is active and deleted with your account.
• –Push notification tokens — deleted when you sign out or delete your account.
• –Community and social data — deleted when you leave a community, remove a friend connection, or delete your account.
• –To delete your cloud account and all associated data, go to Settings → Delete Account. This action is permanent and cannot be undone.

Your Rights Under GDPR

• –Right of access — You can request a copy of the personal data AVEO holds about you.
• –Right to rectification — You can correct inaccurate data from Settings or by contacting support@aveoapp.com.
• –Right to erasure — You can delete your account and all associated data via Settings → Delete Account, or contact us to request erasure.
• –Right to restriction — You can ask us to restrict processing of your data in certain circumstances.
• –Right to data portability — You can request your data in a structured, machine-readable format.
• –Right to object — You can object to processing based on legitimate interests, including anonymised analytics.
• –Automated decision-making — AVEO does not make any automated decisions that produce legal or similarly significant effects on you.
• –To exercise any of these rights, contact support@aveoapp.com.

Your Choices

• –Use guest mode without cloud sync.
• –Sign in to sync data to cloud backup.
• –Edit your username, display name, and profile photo from Settings.
• –Remove your profile photo at any time from Settings.
• –Change your daily target.
• –Sign out or delete local device data.
• –Request a password reset.
• –Delete your cloud account and all data in-app (Settings → Delete Account).
• –Disable push notifications at any time in iOS Settings.

Children

AVEO is not directed to children under 13 and does not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided personal information through AVEO, contact us at support@aveoapp.com so we can review and remove it.

Security

AVEO uses Supabase authentication, database access controls, and row-level security to protect cloud data. Session tokens are stored in the iOS Keychain. Push tokens are protected by column-level access controls and are not readable by other users. No system is perfectly secure, but AVEO is designed to keep account and social data scoped to the correct user relationships.

Complaints

If you are based in the European Economic Area and believe your data has been handled unlawfully, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC). The DPC can be contacted at info@dataprotection.ie or at 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.

Changes

We may update this Privacy Policy as AVEO changes. If we make material changes, we will update the effective date and publish the revised policy at aveoapp.com/privacy.