Who we are
Three Buckets is operated by Michael Hendzel, an individual sole proprietor, of 232 Indian Rocks Rd N, Suite B, Belleair Bluffs, FL 33770, United States ("we", "us"). I am the data controller for the information described here. Contact: privacy@3buckets.app.
What we collect
| Data | Where it comes from | Why we hold it |
|---|---|---|
| User ID | Apple or Google, when you sign in | To connect you to your own data and nobody else's |
| Name and email address | Apple or Google, only if you choose to share them | To address you in the app and reach you about your account. Apple's Hide My Email relay is fully supported, in which case we never receive a real address. |
| Audit answers | You, in the app | The twelve 1–10 ratings and the scores calculated from them. This is the product. |
| Streak and activity | You, in the app | Which days you completed your daily move, so the streak is accurate |
| Goals and commitments | You, in the app | To show them back to you |
| Reminder time | You, in Settings | To schedule your daily notification on your own device |
That is the complete list.
What we do not collect
No contacts. No location. No photos or camera. No microphone. No health or fitness data from HealthKit or Google Fit. No advertising identifier (IDFA or GAID). No third-party analytics or attribution SDK — there is not one in the app. No bank, brokerage, calendar, or email connection. We run no advertising and have no advertising partners.
How your data is stored
If you sign in with Apple or Google, your data is stored in our database hosted by Supabase, Inc. on servers located in the United States, encrypted in transit (TLS) and at rest. Row-level security is enforced at the database level, meaning your rows can only be read or written by your own authenticated account.
If you choose "Continue on this device", nothing leaves your phone at all. There is no account and no server-side copy.
Notifications
Your daily reminder is a local notification scheduled on your own device. This version of the app sends no remote push, so we do not hold a push token.
Who we share it with
We do not sell, rent, trade, or share your personal information for advertising or cross-context behavioural advertising. Under the CCPA/CPRA we have not sold or shared personal information in the preceding twelve months.
The only third parties that process your data are:
- Supabase, Inc. — database and authentication hosting, acting as our processor under contract.
- Apple and Google — solely to authenticate you, under their own privacy policies.
We may disclose information if compelled by valid legal process, or to protect our rights or someone's safety. We will tell you unless legally prohibited.
Legal bases (UK/EU users)
- Contract — to give you the app you asked for: your account, answers, scores, streak and goals.
- Legitimate interests — keeping the service secure and working.
- Consent — device notifications, which you can withdraw at any time in Settings or in iOS/Android system settings.
How long we keep it
Until you delete it. We hold your data while your account exists. Delete your account and it is removed immediately — see below. Our hosting provider keeps encrypted database backups for operational recovery; any residual copy of deleted data in those backups is purged within 30 days.
Deleting your account and data
Open the app, go to Profile → Account → Delete account and data, and confirm once. This permanently deletes your profile, your audit answers, your score snapshots, your goals, and your activity history from our database, deletes your authentication record, and clears the copy stored on your phone.
It is a hard delete. There is no grace period, no archive, and no way for us to restore it afterwards. You do not need to contact support, and we will not ask you why.
Your rights
Wherever you live, you can access, correct, export, or delete your data. Most of that is immediate inside the app; for anything else, email privacy@3buckets.app and we will respond within 30 days.
If you are in the UK or EU you also have the right to object to or restrict processing, to data portability, and to lodge a complaint with your supervisory authority. If you are in California you have the rights to know, delete, correct, and to opt out of sale or sharing — though as stated above, we do neither. We will not discriminate against you for exercising any of these rights.
International transfers
Three Buckets is operated from the United States and your data is processed there. If you use the app from the United Kingdom or the European Economic Area, your personal data is transferred to the United States. That transfer relies on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), which form part of our data processing agreement with Supabase, Inc., supported by encryption in transit and at rest and by the fact that we collect no special-category data.
Children
Three Buckets is not directed at children under 13 (or under 16 in the UK/EU) and we do not knowingly collect their data. If you believe a child has given us information, email us and we will delete it.
Security
TLS in transit, encryption at rest, row-level security scoped to your own account, and no collection of data we do not need. No system is perfectly secure, and we will notify you and the relevant authority of a breach affecting your data as required by law.
Changes
If we change this policy we will update the effective date above and notify you in the app before the change takes effect. Material changes will ask for your acknowledgement.
Contact
privacy@3buckets.app
Michael Hendzel
232 Indian Rocks Rd N, Suite B
Belleair Bluffs, FL 33770
United States