The short version: We collect your account details, the location data needed to verify you showed up, your activity (commitments, sessions, streaks), and limited payment information. We use it to run the Service, charge stakes when due, and send reminders. We share it only with the providers that help us operate (like Stripe and our database host) — we never sell your personal data. You can access or delete your data at any time.

1. Who is responsible for your data

The "data controller" for your personal data is FORCEL LTD, registered in England & Wales (company number 13315753), registered office 71-75 Shelton Street, London, Greater London, WC2H 9JQ, United Kingdom. This policy is written primarily to the UK GDPR and the Data Protection Act 2018, with additional notes for users in the EU/EEA and California.

2. What information we collect

Information you give us

Information collected automatically

Payment information — handled by Stripe (see Section 5). We do not store your full card number; we receive limited details such as the card's last four digits, expiry, and payment status.

3. How and why we use your data (and our legal bases)

4. Location data — the details

Because Commity verifies that you actually showed up, it needs access to your device location, including background ("always") location on most devices, so it can detect when you enter and leave your spot even when the app isn't open. We process location to: detect arrival/departure at the spots you choose, log the minutes you spend inside them, and decide whether a day is complete.

We collect location only in connection with the commitments you set up, and we aim to do so efficiently (for example, using lower-power location and only switching to precise GPS near your spots). You are in control: you can revoke location permission at any time in your device's settings. If you do, automatic attendance tracking will stop working and scheduled days may be recorded as missed. We do not sell your location data or use it for advertising.

5. Payment data

Payments are processed by Stripe, Inc. When you add a card or are charged a stake, your card details are collected and processed directly by Stripe under its own privacy policy and security standards (Stripe is PCI-DSS compliant). We receive confirmation and limited, non-sensitive details (such as the last four digits and the result of a charge) so we can show your billing status and operate the comeback. We do not store your full card number on our systems.

6. Who we share your data with

We share personal data only as needed to run the Service:

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

7. International transfers

Some of our providers (for example, Stripe and Supabase) may process data outside the UK and EEA, including in the United States. Where data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or the EU Standard Contractual Clauses, or transfers to countries with an adequacy decision.

8. How long we keep your data

We keep personal data for as long as your account is active and as needed to provide the Service. After you delete your account we delete or anonymise your data within a reasonable period, except where we must keep certain records longer — for example, transaction and tax records for the period required by law, and limited data needed to resolve disputes or prevent fraud.

9. Security

We use technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; please keep your account credentials safe.

10. Your rights

Depending on where you live, you have rights over your personal data. Under UK/EU GDPR these include the right to: access a copy of your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and withdraw consent (such as location permission) at any time. You can exercise most of these in the App or by contacting us.

You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in the EU/EEA, your local data-protection authority.

California residents: under the CCPA/CPRA you have the right to know what personal information we collect and how it's used, to request deletion, to correct it, and to be free from discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under California law. To make a request, contact us using the details below.

11. Children

Commity is not directed to children under 16, and you must be at least 16 to use it. If you are under 18 you may only use the Service with the consent of a parent or guardian. If we learn we have collected data from a child below the applicable age without proper consent, we will delete it.

12. This website & cookies

This marketing website does not use advertising or tracking cookies. It loads fonts from Google Fonts, which means your browser contacts Google's servers to fetch them; that is subject to Google's privacy practices. If we add analytics or other cookies in future, we will update this policy and, where required, ask for your consent.

13. Changes to this policy

We may update this policy from time to time. If a change is significant, we will take reasonable steps to notify you (for example, in-app or by email). The "last updated" date at the top shows when it last changed.

14. Contact us

For any privacy question or to exercise your rights, contact us at info@thecommity.com, or by post at FORCEL LTD, 71-75 Shelton Street, London, Greater London, WC2H 9JQ, United Kingdom.