RebuildXP Privacy Policy

01 / THE PRACTICE

Notification choices

Notifications default to Always on until you change the setting during setup or in Preferences. Accounts with no recorded preference receive this default; explicit opt-outs and email unsubscribe choices remain in effect. Supported notifications include achievement alerts and invitation emails. Requested sign-in, security, and password-reset emails are separate. Browser or device permission is a separate choice. Push notifications and inactivity reminder delivery are not currently available.

02 / THE PRACTICE

Squad discovery and competition

Member discovery is enabled by default for new and existing active accounts. You can switch it off during setup or later in Preferences. While enabled, Squad owners can search your display name and see your profile picture to send an in-app invitation. Your email and private activity are not included in search results. You must accept before joining. Squad owners can separately opt their Squad into authenticated competitive rankings, displaying its name, picture, accepted eligible member count, and aggregate membership-period XP. This is separate from personal leaderboard visibility. Squad images are stored privately and are available to authorized members, or to signed-in members when the Squad qualifies for opted-in rankings. Owners can disable competition or delete a Squad; deleting a Squad does not delete members’ personal progress.

03 / THE PRACTICE

Scope and effective date

Effective October 6, 2026. This Privacy Policy describes RebuildXP, a beta web application operated by Bill Cole, and the information processed through our public website and authenticated Mind, Body & Soul application.

04 / THE PRACTICE

Account and Google sign-in

We collect your email address, display name, account identifiers, sign-in information, and, when you choose Google sign-in, the basic profile information Google provides, including your name and profile picture. Google handles your Google credentials; RebuildXP does not receive your Google password. Supabase handles account authentication.

05 / THE PRACTICE

Your practices and progress

We store the preferences you choose, timezone, goals, habits, quests, completion history, activities, XP transactions, levels, streaks, achievements and recovery events. Faith preferences and health-related routines can reveal sensitive personal interests. Please enter only information you are comfortable storing. RebuildXP records completion rather than requiring private journal entries. Your progress is private by default. If you choose to participate in the authenticated global leaderboard, other signed-in members can see your leaderboard nickname (or first name and last initial), rank, XP, level, active streak and selected profile picture. You can opt out, choose a nickname, or hide your leaderboard picture in Preferences without losing progression. Private ranking snapshots and finalized weekly standings support rank movement and placement achievements; they are not public unauthenticated pages. Supported information is visible to authorized members of a private Squad as described below, or becomes public when you explicitly choose to create a public achievement share. Sharing does not expose your entire account.

06 / THE PRACTICE

Pictures, Squads and invitations

You may upload a profile picture. Custom profile pictures use public image URLs: anyone who obtains the URL may view the image. Removing an image may not immediately remove copies cached by browsers or providers. Squad members can see member names, avatars, XP rankings and challenge progress. Invitation recipients receive relevant Squad and inviter information. We store membership, invitation email addresses, delivery status and acceptance details. Invitation links should be shared only with intended recipients.

07 / THE PRACTICE

Direct friend invitations and reminders

An authenticated member may provide a friend’s email address, optional first name and short personal message to send a personalized invitation through Resend. The email includes the inviter’s chosen public name and existing challenge link, not the inviter’s private email address. Recipient email addresses and messages are not published on challenge pages or encoded in referral tokens. We retain invitation delivery records, provider message identifiers, sending times, reminder counts, delivery failures, bounces, complaints, reminder preferences, and associated account creation and sign-in milestones. Friendly reminders are sent every three days while eligible and stop when the recipient establishes a verified authenticated session, opts out, or the invitation is cancelled, bounced or complained about. Each email includes a reminder-stop link that works without an account; stopping reminders leaves the referral link available. Delivery webhooks support reliability and abuse suppression. Open or click events may be processed if provider tracking is enabled; they do not qualify referrals or award XP. Authorized administrators may inspect invitation timelines and aggregate conversion reports. We use operational invitation information for delivery, referral attribution, support and abuse prevention, rather than targeted advertising.

08 / THE PRACTICE

Voluntary achievement sharing and public links

You may choose to share earned badges, achievements, level milestones, lifetime XP milestones, streak milestones and other supported accomplishments. Earning progress does not automatically create a public share or publish a post. A sharing preview remains private until you explicitly create a share through an available sharing action. You choose whether to share, which supported optional fields to include, which available destination to use, and whether to copy or distribute the link. Anyone who possesses an active public achievement link can view its selected snapshot without signing in. The snapshot may include an achievement or badge name, description, accomplishment details and milestone, an earned date where available, and, according to your choices and available settings, a display or first name, profile picture, level, lifetime XP or streak. The shared snapshot reflects information when it was created, rather than exposing your live account.

• We do not intentionally include your email address, private habits or quests, journal or reflection content, health-related details, Squad membership information or authentication credentials in achievement shares.
• Achievement names and milestone details you choose to share may themselves reveal personal interests. Review the preview and selected fields before making them public.
• Any future feature that changes these practices will require updated disclosures.

09 / THE PRACTICE

Revoking a public achievement link

You can revoke supported links through the Shared Achievements controls in Preferences. RebuildXP then stops serving the associated public achievement snapshot and generated image through that link. Revocation cannot recall information already copied, downloaded, screenshotted, reposted or shared outside RebuildXP. Other people, browsers, search engines and social networks may have stored, indexed or cached copies or previews. We cannot guarantee removal of those external copies.

10 / THE PRACTICE

Generated images and external sharing

RebuildXP may generate social images from the information you select for an achievement share. You may download an image, use your device share sheet, or send it to Instagram or another supported application. Once exported, the image is under your control and the control of anyone or any destination receiving it. Facebook, Instagram and other sharing destinations operate independently, and their own terms and privacy policies apply. We do not control their use, retention or caching of shared content and cannot delete it from their systems. RebuildXP does not automatically post to a social network or require you to connect a Facebook or Instagram account simply to share. Opening a Facebook sharing interface is a user-initiated step, not an automatic published post. Instagram sharing may use native device sharing or image export rather than a direct account integration.

11 / THE PRACTICE

First-party sharing and referral analytics

We measure how voluntary achievement sharing introduces people to RebuildXP and how the referral experience works. We may record sharing actions, public achievement page views, referral call-to-action clicks, signup starts, attributed account creation, and onboarding completion or activation. Information processed includes the public achievement-share identifier, referring share or source, interaction type and time, an anonymous browser/session identifier, signup attribution, activation or onboarding completion, and sharing destination or channel where applicable. If you create a new account after following an eligible referral link, we may associate that account with the referring share for product analytics. Counts are approximate; a sharing action does not prove an external post was published. This is first-party operational and product analytics, not a paid affiliate program or targeted advertising. We do not sell referral information for advertising purposes.

12 / THE PRACTICE

Referral cookies and anonymous visitor identifiers

When you follow an eligible shared achievement link into the signup flow, RebuildXP may set a first-party referral cookie or similar browser mechanism for approximately 30 days. It preserves attribution through signup and supported authentication redirects, associates an eligible new account with the share that introduced you, and supports measurement of onboarding completion or activation. A separate first-party anonymous visitor/session identifier, also retained in the browser for approximately 30 days, helps prevent duplicate referral-event counting and supports basic referral analytics. These identifiers do not contain passwords, private habit information or the referring user’s private account data. Blocking or clearing browser storage may prevent attribution. The browser attribution period does not mean all recorded analytics events are deleted after 30 days; account-linked records are handled as described under retention and deletion.

13 / THE PRACTICE

Feedback and screenshots

Feedback includes your account identity, type, subject, message, optional screenshot, submission time and relevant page, browser, operating system, device type and app version. Feedback screenshots are stored privately and available through authorized access. Administrators can review submissions, update status and keep internal notes. Avoid including passwords, financial details, medical records or another person’s private information in feedback or screenshots.

14 / THE PRACTICE

Optional website and application analytics

With your permission, RebuildXP uses first-party browser identifiers to measure page visits, sessions, signup starts, acquisition campaign labels, and approximate country or US state. A visitor identifier expires after 90 days and a session expires after 30 minutes of inactivity. No precise location, browser fingerprint, private reflection, raw query string, password or authentication token is recorded in this analytics system. Your IP address may be processed transiently by our host for approximate geography and transformed into a daily keyed hash for a short-lived abuse budget; we do not store the raw IP in analytics. If you register, permitted browser attribution may be linked to that account. Authorized administrators see aggregate reports alongside existing account activity, achievement and referral records. Raw usage events expire after 180 days during daily collection maintenance; account-linked analytics is removed on account deletion. You may decline optional analytics without losing application features or change your choice using the analytics control on this Privacy page. We respect browser Do Not Track and Global Privacy Control. Counts exclude declined tracking and are estimates, not a complete census.

15 / THE PRACTICE

Technical information and local storage

Hosting, authentication and email services process technical information such as IP addresses, timestamps, request information, errors and delivery events. Cookies and browser storage support sessions and application operation. Blocking these may prevent sign-in. Public-page Google Analytics integration is optional and is not enabled in the current production configuration. If introduced, the policy and any required consent controls will be updated before collection begins. Active first-party sharing and referral measurement described above is separate from optional third-party Google Analytics; Google Analytics being disabled does not mean RebuildXP performs no product analytics.

16 / THE PRACTICE

Why we use information

We use information to create and secure accounts, save progress, personalize recommendations, calculate XP and rankings, operate Squads and invitations, deliver transactional messages, respond to feedback, investigate failures and abuse, and improve reliability. We do not use habit, faith or health routines for targeted advertising or sell account data. We also display voluntarily shared achievement snapshots, generate share images and measure sharing and referral effectiveness.

17 / THE PRACTICE

Service providers and other disclosures

Supabase provides authentication, database and storage services; Vercel hosts the application; Cloudflare provides domain and DNS services; Google provides optional sign-in; Resend delivers Squad invitation emails. Providers process information needed for their services under their own terms and privacy practices, potentially outside your state or country. We may disclose information when reasonably necessary to comply with law, protect rights or security, prevent abuse, or carry out a business transfer subject to appropriate safeguards.

18 / THE PRACTICE

Retention and deletion

Account records remain while your account is active unless removed through available controls. Preferences includes Delete My Account. Confirmed deletion removes your live profile, settings, habits, quests, activities, XP, streaks, achievements, recovery events, memberships, suggestions, feedback, feedback notes tied to your submissions, uploaded images and authentication account. Owned Squads transfer to the longest-standing remaining member; a Squad without other members is deleted. Invitation references are removed or anonymized. Some provider logs, cached images and backups, if maintained, may remain until their retention periods expire. Email suppression records may be retained to honor opt-out requests. A restricted deletion receipt containing only the removed account identifier and deletion time is retained so recovery can reapply deletion. Security and operational records not tied to your deleted account may also be retained as needed. Account deletion also removes your achievement shares and their public snapshots, so their links stop serving that content. Referral attribution attached to your deleted account is removed; referral events associated with your shares are removed, and retained events relating to you as a referred user have their account link removed. Anonymous operational events may remain. Deletion does not remove achievement images, snapshots or other content already copied, cached or distributed outside RebuildXP.

19 / THE PRACTICE

Deletion failures and recovery copies

Uploads and database records live in separate systems. If deletion is interrupted, your account is paused for ordinary operations and some uploads may already be removed. Retry Delete My Account in Preferences to finish, or request support. We do not intentionally restore deleted accounts when recovering a backup; any recovery must reapply recorded deletion requests. No fixed provider retention period is promised here.

20 / THE PRACTICE

Security

We use authentication, row-level access controls, restricted administrative roles, private screenshot storage and encrypted network connections. Profile images are public as described above. No system is completely secure. Keep credentials and invitation links safe and report suspected unauthorized access promptly.

21 / THE PRACTICE

Adults and minors

The beta is intended for adults age 18 or older. We do not knowingly invite or accept children’s personal information. If you believe a minor has created an account, contact us so we can investigate and remove the account where appropriate.

22 / THE PRACTICE

Your choices and privacy requests

Review or update account information in Preferences, remove your custom picture, or delete your account. Depending on your location, you may have rights to request access, correction, a copy, deletion or other controls over personal information. Request support at www.BillTheCole.com using its public contact option, identifying RebuildXP and your account email. We may verify identity before acting. Applicable legal rights are not limited by this policy. You can choose supported public fields before creating an achievement share and revoke supported public links in Preferences. Revocation affects the RebuildXP link, not copies held elsewhere.

23 / THE PRACTICE

Changes and contact

We will update this page and its effective date when practices change and provide additional notice where required. For privacy questions or if you cannot sign in, use the public contact option at www.BillTheCole.com and identify your request as RebuildXP support. Signed-in users can use Feedback.