Happybara!Privacy Policy
Last updated: November 10, 2026
This is a translation. In case of any discrepancy, the Portuguese version prevails.
Summary: we use your data only to make Happybara! work. Your habits, tasks and mood are yours: no one else sees them, except for the lists you choose to share. We don't sell data, we don't show ads, and you can delete everything whenever you want.
1. Who we are
Happybara! (“Happybara!”, “we”) is a habits, tasks, mood and focus app available at happybara.com.br. The controller of the personal data processed in the app is [RAZÃO SOCIAL], registered under CNPJ (Brazilian company registration number) no. [CNPJ].
For any privacy matter, including contacting our data protection officer (DPO), write to contato@happybara.com.br.
2. What data we collect
| Category | What it is |
|---|---|
| Account data | Name, email and password (stored only in encrypted form). If you sign in with Google, we receive your name, email and profile picture. |
| Content you create | Habits, goals, daily entries, categories, lists, tasks, subtasks, notes, reminders and focus sessions. |
| Mood log | The mood you choose each day, the factors you mark (such as sleep or work) and optional notes. |
| Shared lists | Who participates in each list, the email of the people you invite and who completed each task. |
| Technical data | IP address, browser and device type, and access logs generated by our infrastructure providers for security and operation. |
| On-device storage | Preferences (theme and color), login session and a copy of your data so the app works offline. |
Your mood log may reveal information about your well-being. That's why it is optional, visible only to you and used solely to show your own reports inside the app.
3. What we use your data for
- To create and maintain your account and let you sign in with email or Google;
- To store and sync your habits, tasks and mood across your devices;
- To show progress, streaks and connections between mood and habits, only to you;
- To let the people you invite access the lists you've shared;
- To send emails required by the service, such as account confirmation and password reset;
- To protect the service against fraud, abuse and unauthorized access;
- To comply with legal obligations.
We don't use your data for advertising, we don't build profiles for third parties and we don't sell personal information.
4. Legal bases (LGPD)
- Performance of a contract (art. 7, V): to provide the service you signed up for when creating your account;
- Consent (arts. 7, I, and 11, I): for the mood log, which you keep voluntarily and can delete whenever you want;
- Legitimate interest (art. 7, IX): for security and abuse prevention;
- Compliance with a legal obligation (art. 7, II): when required by law.
5. Google data
If you sign in with Google, Happybara! accesses only your name, email and profile picture, solely to create and identify your account. We don't access your emails, contacts, calendar, files or any other data in your Google account. The use and transfer of this information follow the Google API Services User Data Policy, including the Limited Use requirements. You can remove access at any time at myaccount.google.com/permissions.
6. Who we share data with
We share data only with companies that help us operate the service, under contract and solely for that purpose:
- Supabase: database and authentication. Data is stored on servers in Frankfurt, Germany, in the European Union. Because these servers are outside Brazil, this is an international data transfer, carried out under article 33 of the LGPD and with the provider’s contractual safeguards;
- Netlify: hosting for the website and the app;
- Google: Google sign-in, when you choose that option;
- Locaweb: sending the service's emails.
We also share the content of a list with the people you invite to it. We may provide data to authorities when required by a legal obligation or court order.
7. International transfer
Some providers, such as Netlify, may process technical data outside Brazil. In these cases, we choose providers with adequate protection safeguards, as set out in art. 33 of the LGPD.
8. How long we keep data
We keep your data while your account is active. When you request account deletion, we delete your data within 30 days. We may keep for longer only what the law requires, such as access logs, for the period set out in the Marco Civil da Internet (Brazil's Internet Civil Rights Framework).
9. Your rights
Under the LGPD, you may, at any time:
- confirm whether we process your data and access it;
- correct incomplete or outdated data;
- request the anonymization, blocking or deletion of data;
- request the portability of your data;
- withdraw your consent, for example by deleting your mood entries;
- find out who we share your data with;
- file a complaint with the Brazilian National Data Protection Authority (ANPD).
To exercise any of these rights, including deleting your account, write to contato@happybara.com.br from your account's email address. We respond within 15 days.
10. Security
All communication is encrypted (HTTPS). Passwords are not stored in plain text. Each person can access only their own data and the lists they participate in, through rules enforced directly in the database. No system is 100% secure, but if there is an incident that could put you at risk, we will notify you and the ANPD.
11. Children and teenagers
Happybara! is not intended for children under 13. Teenagers between 13 and 18 must use the app with the permission of their parents or guardians.
12. Cookies and local storage
We use only essential browser storage: your login session, your preferences and the copy of your data for offline use. We don't use advertising cookies or third-party tracking tools.
13. Changes to this policy
We may update this policy. When a change is significant, we will let you know in the app or by email before it takes effect. The date at the top shows the last update.
14. If you are in the European Union (GDPR)
If you are in the European Union or the European Economic Area, the processing of your data is also governed by the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). This section supplements the previous ones; where they differ, this section prevails.
Controller and representative. The controller is [RAZÃO SOCIAL], based in Brazil. Our representative in the European Union (Article 27 GDPR) is [REPRESENTANTE NA UE]. You can reach either of them at contato@happybara.com.br.
Legal bases (Article 6 GDPR).
- Performance of a contract (Art. 6(1)(b)): your account, syncing, shared lists and service emails;
- Explicit consent (Arts. 6(1)(a) and 9(2)(a)): mood tracking, which may reveal information about health and well-being. It is optional, and you can withdraw your consent at any time by deleting your entries, without affecting earlier processing;
- Legitimate interests (Art. 6(1)(f)): security and abuse prevention. You can object to this use;
- Legal obligation (Art. 6(1)(c)): when the law requires it.
Where your data is stored. Your account data, the content you create and your mood entries are stored on servers in Frankfurt, Germany, inside the European Union. Some data leaves the European Economic Area: technical data handled by the website and app hosting provider and by Google (when you sign in with Google), in the United States; service emails, sent by Locaweb, in Brazil; and access by our team, in Brazil. These transfers rely on the EU-U.S. Data Privacy Framework, where the provider is certified, or on standard contractual clauses approved by the European Commission, or on another mechanism under Articles 45 to 49 GDPR. You can ask for a copy of these safeguards at contato@happybara.com.br.
Your rights (Articles 15 to 22 GDPR). You can:
- access your data and get a copy;
- correct inaccurate data;
- ask for your data to be erased, including by deleting your account;
- ask for processing to be restricted;
- receive your data in a structured, machine-readable format (portability);
- object to processing based on legitimate interests;
- withdraw your consent at any time.
We do not make automated decisions that produce legal effects on you, and we do not build advertising profiles. We answer requests within 15 days and never later than one month. You can also lodge a complaint with the data protection authority of the country where you live or work (list of authorities).
Minimum age. In the European Union, anyone under 16, or under the minimum age set by their country (between 13 and 16), may only use Happybara! with the consent of a parent or guardian.
Security incidents. If an incident puts your data at risk, we will notify the competent data protection authority within 72 hours and notify you without undue delay when the risk is high.
Cookies. Because we only use the essential storage described in section 12, we do not ask for cookie consent.
15. Contact
Questions, requests or complaints: contato@happybara.com.br.