Privacy Policy

1. Data Controller

Zen Berry is operated by Norman Bautista, an individual developer based in the Republic of the Philippines. For purposes of the Philippine Data Privacy Act (RA 10173), Norman Bautista is the Data Controller responsible for the processing of your personal data.

2. Personal Data We Collect

We collect and process the following categories of personal data:

• Account Information: Full name, email address, and hashed password (if you register with email). If you sign in via Google OAuth, we receive your name, email address, and profile avatar from your Google account.
• Task Data: Task titles, task types, and completion status.
• Pin Board Data: Headings, content, color assignments, and position coordinates.
• Timer Sessions: Session duration, break mode selection, and timer preset used.
• Timer Presets: Preset name, focus duration, and break duration.
• AI Insights: Anonymized productivity statistics and AI-generated review content. No personally identifiable information is sent to the AI.
• Reviews: Star rating, text answers, and additional feedback. Reviews are publicly displayed on our website.
• Bug Reports: Issue description, explanation, and suggested fix.
• Waitlist Information: Email address and optional name provided during waitlist signup.

3. Purpose & Legal Basis of Processing

4. Data Sharing & Third-Party Processors

We share your personal data with the following third-party service providers who act as data processors:

• Supabase Inc. (United States): Database hosting, authentication, and file storage. Your account information, tasks, pins, timer sessions, presets, reviews, and bug reports are stored on Supabase's infrastructure.
• Google LLC (United States): Provides Google OAuth authentication and the Gemini AI API used for AI-powered productivity insights. Only anonymized, non-personally-identifiable productivity statistics are sent to Gemini AI. No names, email addresses, or other personal identifiers are included in AI processing.

5. Cookies & LocalStorage

Cookies

We use the following cookies on our website:

• Supabase session cookies: Strictly necessary cookies for authentication and maintaining your logged-in session. These are httpOnly and secure.
• beta_bypass: A cookie used to manage beta access authorization. Set only for authorized beta testers.

LocalStorage

We use the following localStorage keys to store client-side preferences:

• zenberry_timer_presets — Custom timer preset configurations
• zenberry_timer_streak — Current focus streak count
• zenberry_active_session — Active timer session state
• zenberry_timer_alarm_sound — Selected alarm sound preference

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services.

• Account data: Retained until you delete your account or request erasure.
• Public reviews: Reviews you submit may persist on the website even after account deletion, as they are anonymized and serve as community content. You may request removal of your review at any time.
• Bug reports: Retained for product improvement purposes. Bug reports are anonymized after resolution.
• Waitlist data: Retained until you are notified of app availability or upon your request for removal.

7. Your Data Subject Rights

Under the Philippine Data Privacy Act (RA 10173), you have the following rights regarding your personal data:

• Right to be Informed: To know how your personal data is being processed. This Privacy Policy serves as our privacy notice.
• Right to Access: To request a copy of the personal data we hold about you.
• Right to Correction: To request correction of inaccurate or incomplete personal data.
• Right to Erasure or Blocking: To request suspension, withdrawal, or removal of your personal data from our records.
• Right to Portability: To receive your personal data in a commonly used, machine-readable format, or to have it transmitted to another data controller.
• Right to Withdraw Consent: To withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to File a Complaint: To file a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact us at dpo@zenberry.app. We will respond to your request within the timeframe required by law.

8. Security Measures

We implement appropriate technical and organizational security measures to protect your personal data:

• Row-Level Security (RLS): All Supabase database tables are protected by RLS policies, ensuring users can only access their own data.
• Secure Cookies: Session cookies are httpOnly and secure, preventing access via client-side scripts.
• Input Validation: All user input is validated using Zod schemas to prevent injection attacks.
• Rate Limiting: Rate limiting is applied to authentication and AI endpoints to prevent abuse.
• AI Processing Safeguards: No personally identifiable information is sent to Gemini AI. Only anonymized productivity statistics are processed.

9. Cross-Border Data Transfer

Your personal data may be transferred to and processed in countries outside the Philippines where our third-party service providers operate.

• Supabase Inc.: Data is stored on servers located in the United States.
• Google LLC: Data processed for OAuth and Gemini AI is handled on servers located in the United States.

We ensure that appropriate safeguards are in place for such transfers in compliance with NPC Circular 16-04, including entering into data processing agreements that require the recipient to implement data protection standards equivalent to those under Philippine law.

10. Children's Privacy

Zen Berry is not intended for use by individuals under the age of 13. We do not knowingly collect personal data from children under 13. If you are under 13, please do not use or provide any information through this application.

If you are between 13 and 18 years old, you may use Zen Berry only with the consent of a parent or legal guardian. If we learn that we have collected personal data from a child under 13 without verification of parental consent, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will revise the "Last updated" date at the top of this page and notify you via email or in-app notification, depending on the significance of the changes.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal data. Your continued use of Zen Berry after changes to this policy constitutes your acceptance of the updated policy.

12. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our Data Protection Officer: