Privacy Policy

1. Controller

The data controller for Acchi (acchi.io) is the Operator of the Service, based in Switzerland. Contact for any privacy matter: support@acchi.io.

2. What we collect

• Account: email address, password (stored as a hash), and, if you choose to verify, your phone number.
• Profile: username, date of birth (used only to enforce the 16+ minimum and age-restricted badges), home city and country (chosen by you, used only for leaderboards; no GPS, no background location), avatar configuration.
• Activity: the badges you claim, when you claim them, witness confirmations, and (for high-tier claims) the evidence photos you submit (kept private, visible to our review team only).
• Purchases: your subscription and purchase status. Card details go directly to Stripe; we never receive or store them.
• Trust & safety: records of warnings, strikes and witness events, kept to run the fraud-prevention system fairly.

3. What we don't do

• No advertising, no sale of personal data, no third-party tracking or analytics scripts.
• No GPS or background location: your city is a label you picked.
• Local storage on your device is used only to make the app work (session, preferences like your theme, dismissed banners).

4. Where your data lives

Data is stored with Supabase (database and file hosting, Zurich, Switzerland) and served through Vercel (hosting, Frankfurt, Germany). Payments are processed by Stripe. These processors act under their own GDPR-compliant data processing agreements.

5. Legal bases

We process your data to provide the Service you signed up for (contract), to keep the Service fair and secure (legitimate interest, e.g. the trust system and rate limits), and to meet legal obligations (e.g. payment records). Where consent applies (optional phone verification), you can withdraw it at any time.

6. What other members see

Your username, avatar, member number, badges, points, ranks, and city/country label are visible to other members on public profiles and leaderboards. That is the point of Acchi. You can set your profile to private in Settings; leaderboards then show only your username, avatar and score. Your email, date of birth, phone number and evidence photos are never public.

7. Retention and deletion

Your data is kept while your account exists. Deleting your account (Settings → Delete account) permanently removes your profile, badges, photos and avatar; payment records are retained where bookkeeping law requires it. Anonymized, aggregated statistics (like badge rarity percentages) survive deletion because they no longer identify you.

8. Your rights

Under the GDPR and the Swiss FADP you can request access to, correction of, or deletion of your personal data, ask for a copy in a portable format, object to processing based on legitimate interest, and complain to your local supervisory authority. Write to support@acchi.io and we will respond within 30 days.

9. Children

Acchi is not directed at children under 16, and accounts cannot be created below that age.

10. Changes

If this policy changes materially, we will announce it in the app before the change takes effect.