Privacy Policy

1. About My 77 Days

My 77 Days is operated by Vital 24, Inc. at my77days.com. If you have questions about this Privacy Policy or how we handle your personal information, please contact us at hi@melodeecool.com.

2. Information involved

• Account information: username, email address, account identifier, and account/activity timestamps. Supabase Authentication processes passwords, confirmation and recovery information, and sessions. Your password is not stored in your progress records.
• Eligibility and preferences: historical adult-confirmation timestamps and stored privacy/leaderboard preference fields. Signup does not ask for a full birth date or country questionnaire. For accounts registered under the Terms agreement signup, we record a server-generated agreement timestamp and the Terms, Privacy Policy, and eligibility-notice versions linked to the account. This is a record of a declaration, not verified age or parental authorization. We do not create agreement records for existing accounts that did not make that declaration.
• Progress: journey start/end dates, stored time zone, status, check-in dates, and creation timestamps. The dashboard does not ask for medical history or record your dancing, songs, camera, or microphone.
• Mood information: the database supports optional mood entries linked to check-ins, but the current dashboard does not offer a mood-entry form. This is not required for participation.
• Technical information: hosting, authentication, and email providers may process IP addresses, browser/device details, request and security logs, and delivery records. Correspondence includes your email address and whatever information you send us.

Please avoid real names, school details, precise locations, and sensitive information in usernames or messages.

3. Purposes and processing grounds

We use information to provide and secure accounts, send authentication emails, display private progress, operate journeys and check-ins, prevent misuse, and respond to service and privacy requests. A time zone is used to determine your journey's calendar day; it is not precise location tracking.

Where applicable law requires a legal basis, we rely on performing our agreement with you for necessary account and challenge services; legitimate interests in protecting the service, preventing abuse, and responding to requests where those interests are not overridden by your rights; and compliance with legal obligations. Where consent or parental authorization is legally required for particular processing, we must obtain it before that processing. Agreement to the Terms is not blanket consent to data processing. Acknowledging this policy confirms notice, not consent to advertising, optional disclosures, or processing that requires separate authorization.

4. Private records and leaderboard restrictions

Progress records are private by default. Database access controls limit ordinary participants to their own records. Authorized operators and service providers may process information to deliver and protect the service. There are no public profiles, in-app messaging, or connected social accounts.

Participant leaderboard access and changes to leaderboard opt-in are disabled. Historical preferences remain stored; their presence does not mean a leaderboard is available. No friend-sharing interface is enabled by a stored progress-visibility value.

5. Invitations and progress cards

Sharing is optional. Copy Invite Link writes the public website URL to your clipboard. Native invitation sharing sends the full invitation to the destination you choose; where native sharing is unavailable, the full invitation is copied instead. WhatsApp invitation links include the invitation text and website URL. Facebook receives the public website link through its supported sharer.

Progress cards are generated locally in your browser when you request them. A card contains the challenge name, journey day or completion label, encouragement, and website, but not your username, email address, account identifier, or private check-in dates. A day number does not mean every day was completed. Downloading saves the PNG; it does not publish it.

Native image sharing passes the PNG and a short progress description to your selected app. The WhatsApp image option uses the device share menu where supported; otherwise you download and attach the PNG manually. Facebook link sharing does not upload the PNG; manual attachment is your choice. Browser support, installed apps, and permissions affect availability.

There is no automatic posting or referral tracking. Using an external sharing destination may disclose the payload and technical information to that provider under its own practices. Recipients may keep or forward copies; we cannot remove their copies by deleting your account. Review the destination and avoid adding identifying information, especially for younger participants.

6. Providers, cookies, and international processing

Supabase provides authentication and the application database; Vercel hosts the website. Authentication email delivery involves an email delivery service used with Supabase Auth. We share information with these providers as needed to operate and secure the service, not to publish your private progress. Providers may process information in the United States and other countries different from yours, where privacy protections may differ. Where required, international transfers must be covered by a legally valid mechanism, such as applicable contractual safeguards. Contact us for information about the providers and safeguards relevant to your account.

Authentication cookies and session information support sign-in, email confirmation, and account recovery. Confirmation may need the same browser used for signup. Application analytics collection is disabled, including the prepared Google Analytics 4 integration described below. Providers still process technical logs for service delivery and security; this is not a promise that no technical information is collected. We do not sell personal information or share it for cross-context behavioral advertising.

We may disclose information when legally required, to respond to valid legal process, or as reasonably necessary to protect people, rights, and the security of the service. A lawful business transfer may involve information subject to applicable privacy protections and required notices.

6a. Google Analytics 4: prepared, not active

We have prepared Google Analytics 4 (GA4), a service provided by Google, to understand visits and navigation and improve the website. It remains disabled: we do not load the Google Analytics tag, send analytics events to Google, or set GA4 cookies through this integration. No analytics choice or action is required to keep it off. This section describes the proposed processing, not permission to start it.

If enabled after the required review and notices, GA4 could collect page URLs and titles, referring pages, navigation and engagement events, timestamps, browser and device characteristics, language, and approximate location derived from IP addresses. Google receives technical connection information when its tag or collection endpoints are contacted; Google states that GA4 does not log or store individual IP addresses. Standard GA4 uses first-party cookies such as _ga and _ga_ identifiers to distinguish browsers and sessions; these are pseudonymous identifiers, not a guarantee of anonymity. Their duration depends on the approved cookie configuration and browser behavior. We have not approved a cookie duration for activation.

We will not intentionally send names, email addresses, account identifiers, passwords, authentication tokens, challenge responses, or private progress as analytics parameters. Automatic collection can still expose personal information in URLs, query parameters, page titles, referrers, links, or form interactions. Before activation, those risks must be addressed and tested; email redaction alone is not a guarantee. Advertising features, Google signals, User-ID, user-provided data collection, and advertising personalization are not authorized by this preparation.

Google would process analytics information on our behalf, including in countries outside your own, subject to the applicable terms and required transfer safeguards. Read Google's Privacy Policy and how Google uses information from sites that use its services. We have not verified this property's retention settings. Our proposed limit for user-level and event-level data is two months, with retention reset on new activity disabled, subject to approval and verification before collection. That setting does not limit the lifetime of standard aggregated reports or define cookie expiry. There is no GA4 data collected through this integration to retain while it is disabled.

Disclosing analytics or accepting the Terms is not consent. Where consent or parental authorization is required, collection must not begin without it; declining must not prevent access to the core service. We have not implemented an analytics consent or withdrawal interface, so GA4 remains off for all visitors, including younger and international visitors. We will not treat continued browsing as agreement. A no-banner approach must independently satisfy applicable law before any activation; disabling cookies or using Consent Mode does not by itself establish that it does.

You may manage cookies in your browser or use Google's Analytics opt-out browser add-on where supported. These tools do not replace any consent, objection, or withdrawal controls we must provide; clearing authentication cookies may sign you out. Contact hi@melodeecool.com with analytics or privacy questions or to exercise applicable rights. No browser add-on is needed to prevent this disabled integration from tracking you.

7. Younger participants and parental authorization

My 77 Days welcomes U.S. and international participants. The minimum age is 13, subject to applicable higher local requirements and any required parent or guardian permission. Under-13 accounts are not permitted. Privacy-protective defaults are intended for everyone, not only participants identified as teens.

The agreement checkbox and email confirmation do not verify age or parental authority. The current service has no verified parental-authorization process or parental dashboard. Where legally required parental authorization applies, contact us with your parent or guardian before registering. Registration and processing that require that authorization must wait until it has been established. Merely contacting us or checking the agreement box does not establish it.

If you believe an account belongs to someone under 13, or you have a concern about a child's information, contact hi@melodeecool.com. We assess reports, restrict access and further processing where appropriate, and remove information associated with accounts that do not meet our minimum-age requirements, subject to legal obligations. Access and deletion requests require proportionate identity and parental-authority checks. Please do not send identity documents unless a secure method is agreed.

8. Retention, security, and deletion

We keep account and progress information while your account is open and it is needed to provide the service. When you request closure, we remove the account and associated live progress records through an authorized administrative process, subject to applicable legal requirements. We retain limited information for longer only where necessary for security, resolving disputes, or complying with law. We assess the purpose, sensitivity, legal requirements, and availability of less identifying information when deciding retention; information is not kept indefinitely merely because storage is available.

Deleting an authentication account through the authorized administrative process cascades to its associated application profile, journeys, check-ins, and mood entries. Provider logs, backups, emails, downloaded images, and externally shared copies are separate and may remain subject to their own retention. Backup copies remain until overwritten under the provider's retention cycle; they are not used as active account records. We keep service correspondence only as long as needed to handle the matter and any necessary follow-up or legal obligations. There is no self-service deletion or export control in the current app.

Session checks and database access controls protect ordinary account access, but no service can promise absolute security. Keep your password private and report suspected misuse through our contact email. We limit administrative access to authorized purposes and respond to security incidents, including notices to affected people and authorities when required by law.

9. Requests and complaints

Email hi@melodeecool.com to request information about your records, access, correction, or deletion, or to raise a concern. Depending on applicable law, you may also have rights to portability, restriction, objection, withdrawal of consent where used, or a complaint to a competent privacy authority. Availability and exceptions depend on the processing and jurisdiction.

Requests require proportionate verification so information is not disclosed to the wrong person. We respond within applicable legal deadlines, explain any lawful limitation or refusal, and provide information about any applicable appeal route. We do not discriminate against you for exercising applicable privacy rights. Do not include your password in any request. See also the Terms of Service and Disclaimers.

10. Policy updates

We publish changes here with an updated effective date and version. We provide additional notice of material changes, and obtain consent where legally required, before applying the relevant change. Acknowledging this policy does not waive your privacy rights.