Pactly Privacy Policy

Last Updated: October 30, 2026

Pactly is operated by Ghaith Labs (“Pactly,” “we,” “us,” or “our”).

This Privacy Policy explains what information is processed when you use the Pactly mobile and web app (the “App”), who can see it, and the choices you have.

At a glance: We use account details and activity to run your pacts. Members see shared progress; private encouragements are checked for safety and shown to their sender and recipient, with reported content available to authorized reviewers. Organizers may receive inactivity reminders even with an empty recipient list. Account-linked analytics is enabled automatically with no in-app off switch. You can delete your account from Profile → Privacy & Account; provider records follow separate deletion processes, and subscriptions must be cancelled separately.

1. Information We Collect

1.1 Account Information

You sign in with Apple, Google, or an email and password. We use your account identifier and email to authenticate you, maintain your account, and match invitations to you. Your display name and, if supplied by your sign-in provider, profile photo identify you to your pact members. Apple sign-in requests your name and email; Google sign-in uses basic account authentication. These sign-in methods do not give Pactly access to your email inbox, Google Drive, contacts, or other account files. For email-and-password sign-in, the App passes the password you enter to Firebase Authentication. We do not store your password in Pactly's application database; Firebase Authentication manages password verification.

1.2 Pacts and Activity

• Pacts you create or join, including the group name, goal, and check-in rhythm;
• Your check-ins and any short note you add to them;
• Cheers and private encouragement messages you send or receive;
• Invitations you send, accept, or decline.
• Pact photos you choose to upload, feedback you submit, and content reports with a copy of the reported content.

1.3 Device and Settings Information

• Your device time zone, used to place check-ins on the right day and respect quiet hours, and your preferred language for the interface and notifications;
• Push notification tokens, if you allow notifications;
• Notification preferences such as cheers, gentle nudges, and quiet hours, and the pact members selected to hear about your inactivity;
• A local record of your content-safety agreement, stored for your account on the device or browser where you accepted it.

We read your time zone and language from device or app settings without requesting GPS access. The device permissions and in-app choices described below serve different purposes and can have different defaults.

1.4 Product Analytics and Purchases

Firebase Analytics records product interactions such as onboarding steps, sign-in, pact creation and joining, check-ins, encouragements, notification interactions, and subscription events to help us understand and improve Pactly. We associate analytics with your Firebase account identifier when you are signed in; this is account-linked measurement, not anonymous usage statistics. Analytics may also process app-instance and device identifiers, session and device information, and approximate location derived from your IP address. This does not require or use a GPS permission. Our custom analytics events do not include your name, email address, note or message contents, photos, or goal text.

Product analytics is enabled automatically in the production App, with no separate opt-in prompt or in-app off switch. Notification permission and the content-safety agreement do not control analytics. We do not show ads, and advertising storage, advertising user-data use, and advertising personalization are disabled in our analytics configuration. We do not request Apple App Tracking Transparency permission.

RevenueCat processes your account identifier, subscription status, and purchase information to manage paid access. Apple processes payments for App Store purchases. These subscription functions are separate from device permissions and notification settings.

2. Device Permissions and Your Choices

2.1 Notifications

Notifications are optional. We explain them during onboarding and ask your device or browser for permission when you choose to enable them. You can skip this and keep using Pactly, request permission later from Profile, or change permission in your device or browser settings.

With permission, we store a Firebase Cloud Messaging push token with your account to deliver progress updates, encouragements, inactivity reminders, and weekly recaps. The App removes its registered token on sign-out. Delivery depends on device or browser settings and network conditions.

Device permission is separate from your account preferences. Progress updates and support reminders are enabled by default for a new account, and you can turn these categories off in Profile. Weekly recap pushes use the progress-update preference. Quiet hours can silence notifications during your chosen period. Turning off device notifications does not delete your activity, change who can see it in the App, or change who may receive an inactivity reminder about you.

The two category switches do not disable push notifications for private encouragements addressed directly to you; those notifications still depend on device permission and quiet hours. Private encouragement text is not included in the push notification: you read the message inside the signed-in App. Other notifications may include member names, the pact name, or inactivity information and may appear on a lock screen according to your device settings.

2.2 Photo Selection

To add or replace a pact photo, you choose an image in your device or browser photo picker. Any permission prompt depends on the platform. We use the selected image to help members recognize the pact; we do not require your entire photo library, scan other photos, or use the camera. Cancelling leaves the photo unchanged.

The App resizes and re-encodes the selected photo and uploads the processed copy to Firebase Storage. It requests no full photo metadata. The photo is checked for safety before publication and is then available to pact members. You can replace or remove the pact photo where your role permits. A profile photo supplied through Apple or Google sign-in is separate from this photo-picker feature.

2.3 Who Hears About Your Inactivity

When joining a pact, the inactivity-sharing switch is on by default. If you leave it on, the existing pact members are selected to receive support reminders when you go quiet. You can turn it off before joining and later change the selected recipients in that pact's settings. This is an in-app sharing choice, not an operating-system permission, and it is separate from your preference for receiving reminders about other people.

An empty recipient list does not mean that nobody is notified: under the current notification rules, the pact organizer is the fallback recipient. The organizer may also receive an additional group-health reminder after a longer period of inactivity, even if you selected other recipients. These messages can identify you and the pact and describe how long you have been inactive. Delivery depends on the recipient's notification preferences, quiet hours, and ability to receive push notifications. The current App has no setting that guarantees inactivity reminders about you will be withheld from the organizer while you remain in the pact.

2.4 Content-Safety Agreement

Before creating or joining a pact, changing shared content, uploading a pact photo, sending an encouragement, or posting a check-in note, you must accept the content-safety explanation. This allows the associated content to undergo the Google Cloud checks described in section 5. It is separate from photo access, notification permission, and analytics. Your choice is saved on that device or browser; another device or clearing local data may prompt you again.

If you decline, you can still read existing pacts and record a check-in without a note, but the action requiring agreement will not proceed. There is no in-app withdrawal switch; contact us about withdrawal or deletion. Clearing local data does not undo earlier processing.

2.5 Permissions We Do Not Request

Pactly does not request access to device contacts, precise or background GPS location, the microphone, the camera, or cross-app advertising tracking. Sending an invitation uses the address you enter; it does not require access to your address book or mailbox. Denying notifications does not disable analytics, and accepting these Terms or reading this policy does not grant a device permission.

3. How We Use Information

• Create and secure your account;
• Run your pacts, show group progress, and deliver invitations;
• Deliver notifications according to device permissions, account preferences, quiet hours, and the inactivity-sharing rules explained above;
• Keep the App working, secure, and free of abuse.
• Measure product usage and manage subscriptions and entitlements.

We do not sell your personal information, and we do not use it for advertising.

4. Who Can See Your Information

Members of a pact you belong to can see your display name, profile photo, check-ins, and notes within that pact. Private encouragement messages are shown only to their sender and recipient. Authorized safety reviewers can inspect a server-captured copy of content that is reported, including a reported private message. Your email address and settings are not shown to other pact members.

Organizers do not get access to your email address, private account settings, or private encouragement messages between other members. Their role does include receiving the fallback and longer-inactivity notifications described in section 2.3; those alerts are not necessarily sent to every pact member.

5. Service Providers

Google Firebase

Provides authentication, database, photo storage, cloud functions, hosting, product analytics and push notifications (Firebase Cloud Messaging). Google's privacy policy: policies.google.com/privacy.

Google Cloud Content Safety

Before publishing shared text and photos, Pactly sends the relevant text to Google Cloud Natural Language for moderation and selected or account-provider photos to Google Cloud Vision for safety analysis. Text may be sent to Cloud Translation for translation into English when needed for those checks. This processing is not limited to content that someone reports and also applies to private encouragements. Automated checks can reject content or temporarily prevent publication if the service is unavailable. The agreement and the actions available if you decline are described in section 2.4. These checks work alongside reporting and authorized human review of reported content.

RevenueCat

Manages subscription status and entitlements. See RevenueCat's privacy policy.

Apple and Google Sign-In

Verify your identity when you choose them, under their own privacy terms.

Apple and Google Play

Distribute the App and may process download and device information under their own privacy terms.

6. Children's Privacy

Pactly is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided information, contact us at dydemiryasir@gmail.com and we will delete it.

7. Data Retention and Deletion

We keep your account information while your account is active. You can delete your account in Profile → Privacy & Account. The server removes your profile and account settings, memberships, check-ins and notes, sent and received private encouragements, cheers, invitations you created, and Pactly's paid-access record before deleting your sign-in account and confirming success. These records are removed during the deletion request, without a 30-day waiting period. If the request fails, you can retry.

A pact with other members continues after you leave: its shared name, goal, and pact photo remain, and another member takes over if you were the organizer. If no members remain, the pact is deleted and a separate background process removes its stored photos and uploads.

Safety reports are scheduled for cleanup after 30 days. Deleting your account removes your reporter account link, but report evidence may still contain reported content until cleanup. Previously recorded analytics events and their identifiers are not erased by account deletion. Operational logs, submitted feedback, and provider billing records are also outside the account-deletion process. Contact us about access or deletion requests.

Blocking a member leaves all pacts you share with that member, removes your history from those pacts and prevents new interactions through Pactly. Deleting your account does not cancel an Apple subscription. You can delete your account immediately and manage or cancel your subscription separately in App Store settings.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your information, withdraw consent, and complain to a data-protection authority. To exercise these rights, contact dydemiryasir@gmail.com.

9. Security

Data is encrypted in transit and access is limited by security rules to the people who need it. No system is completely secure, and we cannot guarantee absolute security.

10. Changes to This Privacy Policy

We may update this policy when the App or our providers change. The updated policy will be posted here with a revised “Last Updated” date.

11. Contact Us

• Pactly / Ghaith Labs
• Email: dydemiryasir@gmail.com
• Website: https://ghaithlabs.com