This Privacy Policy explains how Fab5 Scorecard ("Fab5", "we", "us", or "our") collects, uses, discloses, and protects information about you when you use our website, applications, and related services (collectively, the "Service"). By using the Service, you agree to this Policy. If you do not agree, do not use the Service.

1. Who We Are & Scope

Fab5 Scorecard is a personal productivity and self-scoring tool. This Policy applies to personal information we process as a data controller. It applies to users worldwide, including users in Canada (PIPEDA and applicable provincial laws such as Quebec's Law 25), the United States (including the CCPA/CPRA for California residents, and comparable laws in Virginia, Colorado, Connecticut, Utah, Texas, and others), the United Kingdom (UK GDPR), the European Economic Area (GDPR), Brazil (LGPD), and Australia (Privacy Act).

2. Information We Collect

Information you provide

• Account data: email address, display name, password (hashed), authentication provider identifiers (e.g. Google).
• Profile data: optional profile fields such as display name, avatar, and leaderboard opt-in status.
• Content: daily scores, pillar items, priorities, notes, and any other content you enter.
• Communications: messages you send to support.

Information collected automatically

• Device & usage data: IP address, browser type, operating system, referring pages, pages viewed, timestamps, and interaction events.
• Cookies & similar technologies: see our Cookie Policy.

Information from third parties

• Authentication providers (e.g. Google) share basic profile info when you sign in.
• Infrastructure providers (hosting, database, analytics) process technical data on our behalf.

We do not knowingly collect precise geolocation, biometric data, or sensitive personal information.

3. How We Use Information

• Provide, operate, secure, and improve the Service.
• Authenticate you and maintain your account.
• Personalize your experience (streaks, trends, leaderboard).
• Communicate with you about the Service, updates, and security notices.
• Prevent fraud, abuse, and violations of our Terms.
• Comply with legal obligations and enforce our rights.

4. Legal Bases (GDPR / UK GDPR)

• Contract: to provide the Service you request.
• Legitimate interests: to secure, improve, and market the Service, balanced against your rights.
• Consent: for optional features (e.g. leaderboard opt-in, non-essential cookies, marketing emails). You may withdraw consent at any time.
• Legal obligation: to comply with applicable law.

5. How We Share Information

We do not sell your personal information. We share it only:

• Service providers that host, store, or process data on our behalf under written agreements (e.g. cloud hosting, authentication, analytics, email).
• Other users, only if you opt in to the leaderboard (display name and score visible).
• Legal & safety: to comply with law, respond to lawful requests, or protect rights, property, and safety.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, with notice to you.
• With your consent for any other purpose.

6. International Data Transfers

We may transfer, store, and process your information in countries other than your own, including the United States and Canada. Where required, we rely on lawful transfer mechanisms such as the EU Standard Contractual Clauses, the UK IDTA/Addendum, and equivalent safeguards.

7. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or de-identify your personal data within a reasonable period, subject to backups and legal holds.

8. Your Rights & Choices

Depending on your jurisdiction, you may have the right to:

• Access, correct, delete, or receive a copy of your personal information.
• Object to or restrict certain processing; withdraw consent.
• Opt out of "sale" or "sharing" of personal information, and of targeted advertising and profiling with legal effects (we do not engage in these, but you may still submit a request).
• Appeal a decision we make about your rights request (US state laws).
• Lodge a complaint with a supervisory authority (e.g. your data protection authority, the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the FTC, or your state attorney general).

To exercise your rights, contact us at the address in Section 14. We will verify your request and respond within the timeframes required by applicable law. We will not discriminate against you for exercising your rights.

9. Children's Privacy

The Service is not directed to children under 13 (or under 16 in the EEA/UK, or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

10. Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, and row-level security on our database. No system is 100% secure; we cannot guarantee absolute security. Notify us immediately of any suspected unauthorized access.

11. Automated Decision-Making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

12. Do Not Track

Our Service does not currently respond to browser "Do Not Track" signals. We do honor recognized opt-out preference signals (such as Global Privacy Control) where required by law.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be posted here with a new "Last updated" date and, where required, notified to you. Continued use of the Service after changes constitutes acceptance.

14. Contact Us

Questions or requests about this Policy or your personal information:
Email: privacy@fab5scorecard.com

For Quebec residents, our Privacy Officer can be reached at the same address.