secondshed Privacy Policy

1. Scope and Operator

This Privacy Policy explains how information is handled when you use secondshed, the gamified wellness and fitness companion app published by Leories Games. It covers the secondshed mobile app, its account features, backend services, subscription flows, and local reminders.

Leories Games is a trading name used by VIKRAMADITYA SURESH DHUMAL, an individual based in India. In this policy, “Leories Games,” “we,” “our,” and “us” refer to that individual operating under theLeories Games trading name.

secondshed has product-specific terms. Please also read the secondshed Terms of Service.

2. Categories of Information

Depending on how you use secondshed, the current app and backend may handle the following information:

• Account information: Firebase user ID, email address, and display name where available from Google Sign-In or Firebase Authentication.
• Onboarding and personalization: date of birth, gender, height, weight, experience, focus areas, training days, intensity, session duration, and related preferences you enter or select.
• Plans and progress: personalized plans, tasks, task completion state, XP, streaks, achievements, event progress, app-open and activity summaries, and feedback you provide about tasks or workouts.
• Water information: your water goal and water logs, including amounts and local date keys.
• Custom tasks: tasks and task details that you create in the app, together with their completion state where applicable.
• Preferences and device context: time zone, notification preferences, notification permission state, app version, operating-system and device context where made available to a diagnostic event, and technical logs.
• Subscription information: RevenueCat customer and entitlement identifiers, including an anonymous App User ID and, where you sign in, a custom App User ID associated with your secondshed account; configured subscriber attributes such as an email address where the app passes one; trial and entitlement dates, product and environment details; and subscription-lifecycle metadata such as purchase, renewal, expiration, cancellation, and billing issue events. secondshed does not receive payment-card details and does not store raw app-store receipts or payment credentials in its account records.
• Crash and diagnostic information: Sentry may receive crash reports, diagnostic and performance information, and device, app, SDK, and runtime context attached to events collected by its React Native SDK and configuration.

3. How Information Is Collected

• You provide account, onboarding, personalization, preference, task, water, feedback, and other information through the app.
• Google Sign-In and Firebase Authentication create and maintain the authenticated account used by secondshed.
• Server-side services create plans, record progress, synchronize subscription access, process lifecycle webhooks, and support account deletion.
• RevenueCat receives the relevant anonymous or account-linked app user identifier and returns subscription and entitlement information from the applicable app store. Where configured, the app may also send limited subscriber attributes.
• Sentry receives diagnostic events when the initialized SDK captures them.
• The app reads device permission state and time-zone information to schedule local reminders; it does not register a remote push token.

4. Purposes of Processing

Information is used to:

• Authenticate you and secure access to your account;
• Build and deliver personalized plans and tasks;
• Save your preferences, custom tasks, water logs, and progress;
• Calculate XP, streaks, achievements, and event progress;
• Schedule and manage local reminders you enable;
• Provide, verify, and administer trials and subscriptions;
• Protect Firebase services and backend endpoints with App Check;
• Diagnose crashes, performance problems, and compatibility issues;
• Prevent fraud, abuse, unauthorized access, and repeated account misuse;
• Respond to privacy, support, and account-deletion requests; and
• Comply with applicable legal obligations and enforce our terms.

5. Firebase, Google, and Other Providers

secondshed uses Firebase Authentication, Cloud Functions, and App Check for authentication, protected backend operations, and service security. Google Sign-In is used to authenticate accounts. Server-side services handle operations such as plan generation, progress updates, subscription synchronization, and deletion.

The app also uses RevenueCat for subscription and entitlement management and Sentry for crash and diagnostic reporting. These providers may process information under their own policies:

• Firebase privacy and security
• Google Privacy Policy
• RevenueCat Privacy Policy
• Sentry Privacy Policy

6. Services Not Used by the Current App

Based on the current secondshed runtime implementation, the app does not use an advertising SDK, Google AdMob, Google UMP, HealthKit, Health Connect, precise location, contacts, camera capture, microphone recording, or remote push-token registration. Package dependencies or platform capabilities that are not described above do not by themselves mean that those services or data flows are active.

7. Local Notifications

If you grant permission and enable reminders, secondshed schedules notifications locally on your device for motivational messages and water reminders. The app can read notification permission state, create or cancel its scheduled reminders, and use your stored time zone to keep scheduling aligned with your local day. These are local device notifications, not a remote push service, and you can manage permission or disable the reminders in the app or your device settings.

8. Subscriptions and App-Store Processing

secondshed offers access through a RevenueCat-managed trial and subscription flow. RevenueCat and the applicable Apple App Store or Google Play billing service process purchases, billing, renewals, cancellations, and refunds. Leories Games receives subscription and entitlement status, configured account attributes, and lifecycle metadata needed to provide access. RevenueCat may associate those records with an anonymous App User ID before sign-in or a custom app user ID after sign-in. Payment details are handled by the applicable store and are not stored in the secondshed user record.

App-store providers and RevenueCat have their own privacy terms, retention practices, and account controls. Review the applicable provider documentation before purchasing. Apple information is available in Apple's Privacy Policy; Google information is available in Google's Privacy Policy.

9. Security

We use Firebase Authentication, server-side access controls, protected backend operations, Firebase App Check, authenticated callable functions, and reasonable technical and organizational safeguards intended to protect information. No application, network, or storage system is completely secure, so absolute security cannot be guaranteed.

10. International Processing

Leories Games and the providers described in this policy may process information in countries other than the country where you live, including through authentication and backend providers, RevenueCat, Sentry, and app-store infrastructure. Where required, applicable providers or Leories Games will use a lawful transfer mechanism or other safeguard. The laws in those countries may differ from the laws where you live.

11. Data Retention

We retain information for as long as reasonably necessary to provide secondshed, maintain account and subscription records, support security and fraud prevention, resolve disputes, comply with legal obligations, and enforce our terms. We do not state exact retention periods because they depend on the information, purpose, provider, and applicable requirements. Authentication and backend providers, RevenueCat, Sentry, Google, Apple, and Google Play may apply their own retention periods under their policies.

12. Access, Correction, and Privacy Requests

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or portability of your personal information, or to object to or withdraw consent from certain processing. Contact us using the details below. We may need to verify your identity and may direct you to Google, Apple, Google Play, RevenueCat, or Sentry for information they control directly.

13. Account Deletion

You can request deletion in secondshed from your signed-in Profile screen by choosing Delete account, entering the email address on the account, and confirming with CONFIRM. The protected deletion function verifies the signed-in account, requires Firebase App Check, and currently requires an active entitlement to be managed or canceled before deletion can proceed.

When the request succeeds, secondshed deletes the associated RevenueCat customer, removes account-associated app data, and deletes the authentication account. Deleting the account does not automatically cancel active Apple App Store or Google Play billing. Cancel or manage that billing through the relevant store before deleting the account.

A separate hashed account-protection record may remain after deletion for security and fraud-prevention purposes. The current implementation stores an HMAC-derived hash of the normalized account email together with account-creation and login timestamps and an account count; it does not store the raw email in that record. We retain this security record only as reasonably needed for those purposes and applicable obligations.

If you cannot access the app, email support@leoriesgames.com from the account email, use the subject “Delete my secondshed account,” and include enough information for us to identify and verify the request. Do not send your password or payment details.

14. Children's Privacy

secondshed is a general wellness and fitness companion and is not designed as a child-directed service. If a parent or guardian believes a child has provided personal information to us, please contact us so we can review the request and take appropriate action under applicable law.

15. Changes to This Policy

We may update this policy when secondshed, its providers, data practices, or legal requirements change. The revised policy will be posted on this page with a new “Last updated” date. Where required, we will provide additional notice or request consent.

16. Contact

For privacy questions or requests, contact:

Leories Games
Leories Games is a trading name used by VIKRAMADITYA SURESH DHUMAL, an individual based in India.
Email: support@leoriesgames.com
Website: https://www.leoriesgames.com