Version 2.0 — October 2026

This Privacy Policy complies with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018), the European Union General Data Protection Regulation (GDPR — Regulation (EU) 2016/679), the UK GDPR, U.S. state privacy laws (including the California Consumer Privacy Act — CCPA/CPRA), and Apple App Store and Google Play Store policies.

General Table of Contents

Data Controller, Data Protection Officer (DPO), and Contact
Core Principle: Minimization and Offline-First Operation
Personal Data Collected by Plan and Feature
Sensitive Personal Data and Emotional Signals
Purposes of Processing and Legal Bases (LGPD, GDPR, and Global Laws)
Access to Camera, Photo Library, and Image Synchronization
Artificial Intelligence, LLM Providers, and No-Training Clause
Data Sharing with Authorized Sub-processors
Integration with Routine Creators (Lead Machine)
International Data Transfers and Safeguards
Information Security and Encryption at Rest (Double Envelope)
Retention Periods, Data Purging, and Post-Cancellation Grace Period
Data Subject Rights and How to Exercise Them
Specific Provisions for the European Union and the United Kingdom (GDPR / UK GDPR)
Specific Provisions for the United States (CCPA / CPRA / State Laws)
Privacy and Protection of Minors
Security Incident Management
Changes to this Privacy Policy

1. Data Controller, Data Protection Officer (DPO), and Contact

1.1. The Data Controller responsible for processing your personal data within Consigo is:

Data Controller: Jeff Monteiro (Individual Taxpayer Registry CPF No. 214.402.918-02)
Location: São Paulo, SP, Brazil
Data Protection Officer (DPO) and Privacy Contact Email: oi.jeffmonteiro@gmail.com

1.2. To exercise your privacy rights or submit any inquiry regarding this Policy, please email our DPO at the address above. Requests are handled within applicable statutory timeframes.

2. Core Principle: Minimization and Offline-First Operation

2.1. Consigo is engineered according to Privacy by Design and Privacy by Default standards.

Users without cloud backup (Free Plan): All habit data, completion history, notes, and photos remain saved exclusively in your device's local memory and encrypted database. This data is never sent to, read by, or mirrored on our cloud servers.
Users with active sync (Paid Plans PRO, ULTRA, CREATOR): Data uploaded to our Firebase (Google Cloud) infrastructure acts strictly as an encrypted backup mirror to enable multi-device continuity, history recovery, and account safety.

3. Personal Data Collected by Plan and Feature

Data collection is strictly limited to the features you subscribe to and use:

3.1. Technical and Usage Data Collected Across All Plans

Pseudonymous Installation Identifier: A locally generated identifier (anonymousCid) used to track usage metrics without linking to your real-world identity;
Product Telemetry and Performance Diagnostics: App version, device model, OS version (iOS/Android), system language, and aggregated feature metrics (e.g., number of habits completed, streak milestones, navigation flows). Handled via Mixpanel in a de-identified format (never containing message text or photos).

3.2. Additional Data Processed in the Free Plan

Advertising Identifiers: Mobile advertising ID (IDFA on Apple or GAID on Android), IP address, and ad interaction metrics, processed by Google AdMob subject to user consent and operating system privacy controls (such as App Tracking Transparency on iOS).

3.3. Additional Data Processed in Paid Plans (PRO, ULTRA, CREATOR)

Profile Information: Display name, username, verified mobile phone number (via SMS OTP), verified email address (via email OTP), and profile avatar picture;
Habit Data: Habit titles, scheduling frequencies, custom templates, completion history logs, and streak defense shields;
Photo Records: Photos taken during habit completions that the user chooses to store, synced to private cloud storage;
AI Coach Agent Interactions: Chat messages exchanged with the assistant, contextual habit signals, lifestyle onboarding quiz answers, conversational memory items, and feedback ratings.

4. Sensitive Personal Data and Emotional Signals

4.1. Recognition of Sensitive Data: In conversational interactions with the AI Coach Agent, users may voluntarily share reflections regarding emotional states, mood fluctuations, anxiety, personal stress, and lifestyle hurdles. Consigo treats such information with heightened security safeguards as SENSITIVE PERSONAL DATA (under Article 11 of LGPD and Article 9 of GDPR).

4.2. Strict Purpose: This information is processed exclusively to provide personalized, supportive, and context-aware conversational feedback to assist in daily habit discipline.

4.3. In-Chat Fact Erasure: Users may instruct the AI Coach Agent directly within the chat to erase specific recorded memories or facts (via the forgetUserFact command), triggering immediate deletion of that memory.

5. Purposes of Processing and Legal Bases (LGPD, GDPR, and Global Laws)

In accordance with Article 9 of LGPD and Article 13 of GDPR, the table below maps our processing activities to their respective legal bases:

#	Processing Activity	Data Categories	Brazil (LGPD) Legal Basis	EU/UK (GDPR) Legal Basis
1	Local offline app operation	Local habits, records, and photos	Performance of Contract (Art. 7, V)	Performance of Contract (Art. 6(1)(b))
2	Cloud backup & sync (paid plans)	Profile, habits, history, shields, photos	Performance of Contract (Art. 7, V)	Performance of Contract (Art. 6(1)(b))
3	Encryption at rest & key management	Device hardware keys, cipher envelopes	Legal Obligation & Security (Art. 7, II & IX)	Legitimate Interest & Security (Art. 6(1)(f) & Art. 32)
4	AI Coach Agent chat processing	Chat text, mood signals, habit context	Explicit Consent (Art. 11, I) & Contract (Art. 7, V)	Explicit Consent (Art. 9(2)(a)) & Contract (Art. 6(1)(b))
5	Internal AI quality review (Wave 3)	De-identified text & signals (no photos, no PII)	Data Subject Consent (Art. 11, I), revocable in app	Data Subject Consent (Art. 9(2)(a)), revocable in app
6	Usage telemetry & diagnostics	Pseudonymous ID, technical metrics	Legitimate Interest (Art. 7, IX)	Legitimate Interest (Art. 6(1)(f))
7	In-app advertising (Free tier)	Ad IDs (IDFA/GAID), IP address	Consent / Legitimate Interest (Art. 7, I & IX)	Consent (Art. 6(1)(a) / ePrivacy Directive)
8	Subscription entitlement validation	User ID and app store purchase receipts	Performance of Contract (Art. 7, V)	Performance of Contract (Art. 6(1)(b))
9	Authentication via SMS & Email (OTP)	Phone number, email, ephemeral codes	Performance of Contract (Art. 7, V)	Performance of Contract (Art. 6(1)(b))
10	Antifraud username verification (IG)	Publicly checked username	Legitimate Interest (Art. 7, IX)	Legitimate Interest (Art. 6(1)(f))
11	Creator Lead Machine sharing	Name, email, phone, routine progress	Specific Consent (Art. 7, I) at routine import	Specific Consent (Art. 6(1)(a)) at routine import
12	Legal compliance and log retention	Internet access logs, audit records	Legal Obligation (Art. 7, II; MCI Art. 15)	Legal Obligation (Art. 6(1)(c))

6. Access to Camera, Photo Library, and Image Synchronization

6.1. Consigo requests camera and photo library access solely to allow voluntary capture and attachment of photos to habit completion cards.

6.2. Access is requested via operating system dialogs and can be adjusted or revoked at any time in device privacy settings.

6.3. Photo Policies:

Captured photos are never scanned for facial recognition or used to train computer vision models;
In paid plans with backup enabled, photos are synced to Google Cloud Storage under dedicated user directories ({uid}/history) protected by owner-only access rules;
In the free plan, photos never leave the local storage of the device.

7. Artificial Intelligence, LLM Providers, and No-Training Clause

7.1. To deliver the conversational AI Coach Agent experience, messages are securely proxied via backend functions to leading Large Language Model (LLM) providers: OpenAI, LLC and Groq, Inc.

7.2. EXPRESS COMMITMENT: NO TRAINING ON USER DATA:

Our enterprise API agreements with our AI infrastructure providers strictly stipulate that:
Prompts, conversational text, habit reflections, and user inputs ARE NOT USED by OpenAI, Groq, or any third party to train, retrain, fine-tune, or improve general or commercial foundation models;
Transmitted data is processed ephemerally solely to generate the immediate text completion returned to the user;
Consigo never sells or monetizes user conversation data.

7.3. Internal Product Quality Reviews (Wave 3) and Right to Opt-Out:

To monitor technical accuracy and prevent hallucinations, Consigo's engineering team may perform internal reviews on de-identified AI interactions;
Mandatory De-identification: Texts are permanently separated from user identity and assigned a non-reversible pseudonym (R-<hash>), automatically stripping names, emails, and phone numbers. Photos are NEVER included in internal quality reviews;
Every internal review generates an audit log entry;
Instant Revocation in App: You can disable internal AI review sharing at any time in the app under Account > Data Sharing. Toggling this off immediately stops future internal review access on our servers.

8. Data Sharing with Authorized Sub-processors

We never sell or rent your personal information. Data is shared only with technical service providers acting as sub-processors under strict contractual instructions:

Sub-processor	Country	Role and Purpose	Processed Data
Google LLC (Firebase / Google Cloud)	United States	Cloud infrastructure, Firestore database, Auth, Storage, and serverless Cloud Functions	User IDs, profile, habits, encrypted envelopes, photo backups
OpenAI, LLC	United States	Natural language processing API for the AI Coach Agent	Chat text and contextual routine data included in requests
Groq, Inc.	United States	High-speed AI inference routing	Same as OpenAI (when active as inference provider)
Mixpanel, Inc.	United States	Product analytics and app stability telemetry	Pseudonymous ID (`anonymousCid`), app version, aggregate event metrics (no text/photos)
RevenueCat, Inc.	United States	Subscription receipt validation and entitlement management	App user ID, subscription status, and store receipt tokens
Google LLC (AdMob)	United States	In-app programmatic advertising (Free tier only)	Mobile ad IDs (IDFA/GAID), IP address, ad interactions
Resend, Inc.	United States	Transactional verification emails (OTP)	Recipient email address and temporary passcode (not stored)
APIDirect	United States	Technical proxy for public Instagram creator bio check	Publicly checked username

9. Integration with Routine Creators (Lead Machine)

9.1. If you choose to import a habit routine published by a CREATOR plan user, the creator may require contact information in exchange for access ("Lead Machine").

9.2. Lead Machine Rules:

Explicit Prior Consent: Any routine requesting data presents an upfront screen specifying the exact data fields (e.g., Name, Phone, Email, progress milestones) and the creator's identity;
Legal Roles: Consigo acts solely as a secure transmission conduit. Once data is transferred to the creator's secure HTTPS webhook, the creator becomes an Independent Data Controller governed by their own privacy policy;
Creators are contractually bound by Consigo's Creator Terms of Service.

10. International Data Transfers and Safeguards

10.1. Because our cloud infrastructure providers are based globally, personal data may be transferred to and stored on servers outside your home country, primarily in the United States.

10.2. Transfer Safeguards:

For transfers from Brazil: We implement safeguards under LGPD Article 33 and ANPD Resolution CD/ANPD No. 19/2024, utilizing Standard Contractual Clauses;
For transfers from the EU/UK: Transfers are governed by the European Commission's Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework (where applicable).

11. Information Security and Encryption at Rest (Double Envelope)

Consigo uses robust technical safeguards to protect your personal data:

11.1. On-Device Double Envelope Encryption at Rest:

Sensitive account information (profile, habits, completion logs, AI conversations, memories, and emotional signals) is encrypted on your device using AES-256-GCM with Authenticated Associated Data (AAD). The primary Data Encryption Key (DEK) is protected by device hardware keystores (Apple Keychain / Android Keystore).

11.2. Cloud Mirror Encryption:

For paid tier cloud backups, data rests in Firestore within encrypted envelopes. Server-side administrators cannot read conversations or emotional reflections in plaintext without user keys.

11.3. Encryption in Transit:

All data in transit between your mobile device, our cloud services, and AI providers is encrypted using TLS 1.3 or TLS 1.2.

11.4. Log Hygiene (Wave 1):

Cloud logging policies actively exclude user conversational content. No chat text or intimate reflections are written to persistent technical server logs.

12. Retention Periods, Data Purging, and Post-Cancellation Grace Period

Data is retained only as long as necessary to serve its legitimate operational purposes:

Data Category	Retention Period	Purge Mechanism
Local App Data	Until uninstallation or device storage clear	Permanently wiped from device storage
Active Cloud Mirror	For the duration of an active paid subscription	Continuously updated and synced
Post-Cancellation Cloud Mirror (Churn)	90 (ninety) days following the end of the paid billing period	Automatically purged from cloud servers after 90 days; local device data remains
Cloud Photo Backups	Maintained while backup plan is active; purged 90 days post-cancellation	Deleted from Google Cloud Storage on cloud purge or account deletion
System Backups (GCS)	Up to 90 days	Overwritten cyclically via automated bucket lifecycle
Security Audit Logs	Up to 5 (five) years	Maintained in access-controlled audit buckets for regulatory compliance
Telematics Access Logs	6 (six) months	Retained pursuant to Brazilian MCI Art. 15 requirements
Cloud Logging Diagnostic Logs	30 days	Automatically purged by Google Cloud Logging

13. Data Subject Rights and How to Exercise Them

13.1. Regardless of your location, you enjoy comprehensive data privacy rights (LGPD Art. 18 and GDPR Arts. 15–22):

Access and Confirmation: Confirm processing and obtain copies of your data;
Correction: Rectify incomplete, inaccurate, or outdated data;
Erasure and Anonymization: Request deletion or anonymization of unnecessary data;
Withdrawal of Consent: Revoke previously granted consents without affecting prior lawful processing;
Objection: Object to processing based on legitimate interests;
Portability: Request your profile data in a structured, machine-readable format.

13.2. Instant Self-Service in the App:

Account Deletion: Go to Account > Delete Account in the app to instantly delete profile, credentials, history, photos, and cloud data;
Opt-Out of AI Quality Review: Go to Account > Data Sharing to toggle off de-identified internal review;
Profile Editing: Edit name, username, phone, and email anytime in profile settings;
In-Chat Fact Erasure: Instruct the AI Coach Agent directly to forget specific memories.

13.3. Formal Inquiries via DPO:

For requests that cannot be resolved in-app, contact our Data Protection Officer at: oi.jeffmonteiro@gmail.com. Legitimate requests are answered within 15 business days (or applicable statutory deadlines).

14. Specific Provisions for the European Union and the United Kingdom (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom:

14.1. Legal Bases: We process your personal data only under recognized GDPR Article 6 bases (contract performance, consent, legal obligation, or non-overriding legitimate interests) and Article 9 for sensitive data.

14.2. Automated Decisions and Profiling: The AI Coach Agent provides conversational habit guidance. It DOES NOT MAKE AUTOMATED DECISIONS that produce legal effects or significantly affect you under GDPR Article 22.

14.3. Right to Lodge a Complaint: You have the right to lodge a complaint with your local EU Member State Data Protection Authority (DPA) or the UK Information Commissioner's Office (ICO).

15. Specific Provisions for the United States (CCPA / CPRA / State Laws)

For residents of California and states with similar privacy frameworks:

15.1. Notice of No Sale or Sharing:

CONSIGO DOES NOT SELL AND HAS NEVER SOLD YOUR PERSONAL INFORMATION.
We do not share personal information with third parties for cross-context behavioral advertising without your explicit system-level consent.

15.2. Your Rights under CCPA/CPRA:

California residents have the right to:

Know what categories of personal information are collected and the business purposes;
Request deletion of their personal information (Right to Delete);
Request correction of inaccurate personal information (Right to Correct);
Non-discrimination: You will never receive discriminatory treatment or diminished service quality for exercising your CCPA rights.

15.3. Submit CCPA requests by emailing oi.jeffmonteiro@gmail.com with the subject line "CCPA Request".

16. Privacy and Protection of Minors

16.1. Consigo is intended for individuals aged 13 and older. We do not knowingly collect personal information from children under 13, in compliance with the U.S. Children's Online Privacy Protection Act (COPPA), GDPR Article 8, and LGPD Article 14.

16.2. If a parent or guardian discovers that a child under 13 has provided personal data to Consigo, please notify us immediately at oi.jeffmonteiro@gmail.com so we can delete such data permanently.

17. Security Incident Management

17.1. We maintain technical monitoring to protect user data. In the unlikely event of a security incident presenting significant risk to user rights and freedoms:

We will promptly notify relevant data protection supervisory authorities (such as Brazil's ANPD and applicable international authorities);
Impacted users will be transparently notified with guidance on the nature of the event, affected data, and remedial protective actions taken.

18. Changes to this Privacy Policy

18.1. This Privacy Policy may be updated periodically to reflect service improvements, security enhancements, or regulatory developments.

18.2. Material updates will be communicated prominently within the app. The date of the most recent revision will always appear at the top of this document.

Consigo