Privacy Policy

Who we are

Ruction ("we," "us," "our") operates the Ruction app and website. N Kruger, is the responsible party under POPIA and the data controller under GDPR. Contact us at [nicci@viibebrands.co.za].

​

What we collect

• Account info: email address, display name (optional)

• Waitlist info, if you join before the app launches: email address, and whether you have or suspect you have ADHD

• Health and symptom data, once you use the app: cycle dates, logged symptoms, mood, energy, and medication-response ratings, and any free-text notes you choose to add

• ADHD status: diagnosed, suspected, no, or prefer not to say

• Tone preference: warm or unfiltered

• Technical data: device type, app version, crash logs, general usage analytics
   

Why we collect it

• To run the core service (tracking, patterns, the doctor report): contract necessity

• To send your daily prompt and, later, notifications in your chosen tone: consent, adjustable anytime in settings

• To improve the product: legitimate interest, using anonymised or aggregated data only [flag: your lawyer needs to define "aggregated" to a standard that actually holds up under POPIA and GDPR, de-identification claims get challenged if they're loose]

• Health data is treated as special category information under GDPR and as special personal information under POPIA, so we rely on your explicit consent to process it
   

What we never do

We don't sell your data. Not to advertisers, not to data brokers, not "anonymised and aggregated" in a way that gets re-identified down the line. No exceptions. 

​

Who we share it with

• Firebase / Google Cloud Platform, for hosting and storage [flag: confirm a data processing agreement is in place]

• RevenueCat, for subscription management, once payments launch [flag: DPA needed here too]

• Push notification and analytics providers [placeholder until you've picked these]

• Law enforcement or regulators, only where legally compelled, and we'll notify you unless the law prohibits it

International transfers

Ruction serves users in South Africa, the US, UK, Australia, and elsewhere. Your data may be processed outside your own country, including in the US, where Firebase infrastructure may be located. 
 

Your rights

Depending on where you live, POPIA and/or GDPR give you the right to:

• Access the personal information we hold about you

• Correct inaccurate information

• Request deletion of your account and data

• Export your data in a portable format

• Withdraw consent at any time

• Object to or restrict certain processing

• Lodge a complaint with your local regulator (the Information Regulator in South Africa, or your national Data Protection Authority in the EU/UK)
   

Contact nicci@viibebrands.co.za to exercise any of these. We aim to respond within 30 days under POPIA and within one month under GDPR.
 

Data retention

We keep your data while your account is active, plus a period afterward for legal and backup purposes, then it's permanently deleted. 
 

Security

We use encryption in transit and at rest via Firebase, and access controls that limit data to your own account. No system is fully secure, and we'll notify affected users and regulators of any breach as the law requires.
 

Children

Ruction isn't intended for anyone under 18. 
 

Changes to this policy

We'll notify you of material changes by email or in-app notice before they take effect.