TriUnity

The short version

TriUnity needs an account. You create one at the end of setup, after the onboarding questions, and until that moment nothing you have entered leaves your phone.

When you sign up you choose where your faith and training records live: backed up to your account, so they follow you to a new phone, or on your phone only. Some of that data reveals your religious beliefs or your health, so backing it up needs your explicit consent. Both choices get you the whole app, and you can change yours in Settings at any time.

What you back up is kept in your account for you and used for nothing else. There is no advertising, no analytics or tracking tool and no crash reporting, and your written reflections never leave your phone.

Who is responsible

TriUnity is run by Lossos Balázs, an individual entrepreneur (egyéni vállalkozó), Hadvezér utca 28/b, 4225 Debrecen, Hungary, who is the controller of your data under the GDPR. Write to triunity66@gmail.com about anything in this policy.

What is stored on your phone

Your daily record, which challenges you ticked, the days you said you went to Mass (on a Sunday or on any other day), your streak and your score. Your written reflections. How long you spent in focused prayer. Your profile: display name, a short bio, up to ten tags and your photo.

Your settings, your answers to the onboarding questions, and your training log if you switched Training on, with any one-off change you made to a day’s workout and any note you wrote about a day’s training (see “Your training log”).

If your session on a phone ends without you signing out, and somebody else then signs in on that phone, your records are not handed to them. They are set aside on the phone, where nobody else can open them, and come back when you sign in on it again. They are kept that way for thirty days and then removed, and Start over in Settings removes them at once.

On Android you can put a TriUnity widget on your home screen that shows today’s verse, your week with your streak, or both. A widget is drawn on your phone from what the app has stored there, and nothing leaves your phone for it. Anyone who can see your home screen can see what it shows; removing the widget from your home screen, or deleting the app, takes it away.

What is sent to our server

When you create your account: your email address, your display name and the record of where you chose to keep your records. If you sign in with Google, Google gives us your name, your email address and a link to your Google profile picture, and these are kept with the account. If you sign up with an email address, the language the app is in is kept with the account, so that the emails with your codes arrive in that language.

Only if you choose to back up your records, at sign-up or later in Settings, and from then on so that a new phone does not mean starting over: your answers to the onboarding questions and the verse chosen for you from them at the end of setup, your settings (such as your language, which reminders you turned on and your daily prayer goal with the goals you had before it, but not your colour palette or the backgrounds you chose for prayer and for the daily verse), your daily records including how long you spent in focused prayer and the days you said you went to Mass, your challenge list with the lists you had before it, so that past days keep their score, your medallions, your level, the day you started, your training log, including the changes and notes you add to a day in the Training section, and your profile photo. Your streaks and score are not stored as their own numbers, they are recomputed from those records wherever they are shown.

If you keep your records on your phone only, none of that is sent, your profile photo stays on your phone too, and the server holds just your account. Your bio and your tags always stay on your phone. So do your written reflections, see below.

Everything travels over HTTPS. Your session tokens are held in your device’s Keystore or Keychain rather than in ordinary app storage.

Why we use it, and on what legal basis

To run your account: your email address, your display name, what Google gives us if you sign in with it, the language of an email sign-up and the record of your choice about backing up are what the account is, and we use them because the Terms of Service are a contract with you (GDPR Article 6(1)(b)).

To keep your records in your account, if you choose to back them up. Your denomination, what you said you are dealing with, how often you read scripture, your prayer and Mass records, your challenges and your training log can reveal your religious beliefs or your health, which GDPR Article 9 protects. We keep your backed-up records only with your explicit consent (Articles 6(1)(a) and 9(2)(a)), given by choosing to back them up, at sign-up or in Settings, and only so that they follow you to another phone. We do not analyse, count or share them, and we do not use them for anything else. Saying no costs you nothing but the backup: the app works in full with your records on your phone only. Accounts created before the question existed are asked it once in the app, and nothing is synced for them until they answer. The database itself refuses to store these records for an account without the consent.

To email you about your account, and only about your account: if you sign up with an email address, the code that confirms it, which also welcomes you, and a password-reset code when you ask for one. Signing in with Google sends no email. These are part of running the account (Article 6(1)(b)). We send no newsletters and no marketing.

To be able to show that your consent was real: we keep a record of when you chose to back up your records, which wording of the choice you saw and which version of this policy was current, and, if you later turn backup off, when you did. We keep it for as long as your account exists, and it is deleted with the account. The GDPR requires us to be able to demonstrate consent (Articles 6(1)(c) and 7(1)).

To handle a complaint, if you make one about TriUnity or a purchase: we keep the complaint and our answer to it for three years, because Hungarian consumer protection law requires it (Act CLV of 1997, section 17/A; GDPR Article 6(1)(c)).

Your written reflections are different

Writing about your faith is special category data under GDPR Article 9, and TriUnity treats it that way.

Your reflections never leave your phone. They are not uploaded, whether or not you back up your records, and there is no setting that uploads them. Signing out or deleting the app deletes them, and there is no copy to restore.

This is enforced in two independent places: the app never sends the text, and the database throws away any reflection text it is sent, for every account, with no exception.

Your training log

If you use the Training section and chose to back up your records, your training log is backed up to your account: every finished workout with its exercises, sets, weights and reps, your training plan, any exercises you added yourself (the name you gave each one, the muscle group you chose for it and the day you added it), and whether you use kilograms or pounds. It is there so that a new phone, or the app reinstalled, picks up where you left off.

What somebody lifts and how often can say something about their health, so it is used for that one purpose and nothing else. We do not analyse it, share it or use it to advise you. A workout you delete on your phone is deleted from the server as well, and deleting your account removes the whole log.

If you chose to back up your records, the one-off changes you make to a day’s workout, such as skipping today’s or doing another day’s workout in its place, and the notes you write about a day’s training, including your answer when the app asks once about a missed workout, are backed up with the rest of your training log, under the same explicit consent and for the same one purpose. The notes are meant for things like being tired or away on holiday, but they are free text and hold whatever you write, which can include something about your health. If you keep your records on your phone only, they stay on your phone like everything else.

What we do not do

No advertising and no advertising identifiers. No analytics or tracking tools, and no crash-reporting service. Nothing sold, rented or shared for marketing.

No location, contacts, microphone, camera, calendar or health-sensor data. No decisions about you are made automatically: your onboarding answers only choose what the app shows you, such as which verses you see and are reminded of.

Permissions

Notifications, to send the reminders you turned on. Refuse and everything else still works.

Photos: to choose a profile picture the app uses your phone’s photo picker, which hands over only the picture you pick. It cannot see the rest of your gallery and asks for no permission to do it. Saving a card you chose to share writes it into your gallery; on older versions of Android this uses the storage permission. Refuse and you can still share the card another way.

Internet, to reach your account. Vibration, for the small taps you feel on some buttons.

The app asks for nothing else. It does not request camera, microphone, location or contacts access.

Who else is involved

Supabase hosts the database, the uploaded photos and sign-in, on servers in the European Union (Ireland), and processes your data only on our instructions. The company behind it, Supabase Pte. Ltd., is based in Singapore, so its staff or systems outside the EU may reach that data, for example to run or support the service; its data processing agreement includes the European Commission’s Standard Contractual Clauses for that access (supabase.com/legal/dpa).

Google, if you sign in with it, tells us your email address, your name and a link to your profile picture. We never see your Google password.

The emails described above are sent from our Gmail address, triunity66@gmail.com, through Google’s mail servers. Only your email address and the text of the email go out, and the emails carry no tracking. Google Ireland Limited provides that mailbox under its own terms and privacy policy (policies.google.com/privacy), and the mailbox keeps a copy of every email we send and of every email you send us. Google may process these emails in the United States through Google LLC, which is certified under the EU-US Data Privacy Framework, so that transfer rests on the European Commission’s adequacy decision for the framework (GDPR Article 45). The copies of the automatic code emails, the one that confirms your sign-up and the one for resetting your password, are deleted from the mailbox automatically and permanently 30 days after they were sent. Nothing else in the mailbox is deleted automatically. Emails you write to us, for example for help or to exercise your rights, and our replies to them stay in the mailbox as long as we need them to answer you. We delete them when you ask us to, and as part of carrying out a request you made by email to delete your account or erase your data. The one exception is a complaint about TriUnity or a purchase and our answer to it, which the law requires us to keep for three years (see “Why we use it, and on what legal basis”).

Like any server, Supabase records technical details of each request, including your IP address and the type of device, for security and troubleshooting. Supabase keeps these logs for a limited time under its own retention rules (supabase.com/privacy), and they are not removed when you delete your account. We rely on our legitimate interest in keeping the service secure (Article 6(1)(f)).

If you back up your records, a profile photo you add is uploaded to your account and stored at an address nobody can guess. Anyone who has that exact link can view it, without signing in; the app uses it to show your photo on another phone you sign into. Turning backup off removes the uploaded photo from the server, and so does deleting your account. A copy already held by the storage network’s cache can still be shown for up to about a minute afterwards.

RevenueCat, Inc., a US company, keeps the record of which palettes your account has bought, so that they follow you to any phone you sign into. While you are signed in, the app gives RevenueCat your account’s id, a random code that is neither your email address nor your name, and asks which palettes the account owns; when you buy one, RevenueCat receives the purchase from Google Play and records it against that id: which palette, when, the price and Google Play’s order number. With each request it also receives basic technical details: the app version, your phone’s operating system, your country, and your IP address as part of the connection. It never receives your email address, your name or your records. If your account keeps all six premium palettes as a gift (see “Purchases” in the Terms of Service), the app does not contact RevenueCat at all. RevenueCat processes this only on our instructions, so that purchases work (Article 6(1)(b)), and the transfer to the United States is covered by the Standard Contractual Clauses. Some test versions of the app released before 30 September 2026 also contacted RevenueCat, in some cases with an id for the installation instead of the account.

Purchases are made through Google Play, which takes the payment under its own terms and privacy policy (policies.google.com/privacy). We never see your card or other payment details. Google shows us each order in the Play Console, such as which palette was bought, when, for what price and in which country, and pays us the proceeds; we use this only to run the purchases and to keep the accounts the law requires of a business (Article 6(1)(b) and (c)).

TriUnity is distributed through Google Play. Google may collect its own install and crash statistics from phones where the owner has allowed it, under Google’s own privacy policy; we see only the totals Google shows in the Play Console, and we add no analytics or crash-reporting tool of our own.

While TriUnity is in closed testing, Google Play lets only the Google accounts on our tester list install it. If you ask to join the test, we add the Google account address you give us to that list in our Google Play Console, where Google keeps it under its own terms and privacy policy. We do this because you asked for access (Article 6(1)(b)), we use the address for nothing else, and we remove it from the list when you ask us to.

This website, where these documents are published, is hosted by Netlify, Inc., a US company that is certified under the EU-US Data Privacy Framework and whose data processing agreement includes the Standard Contractual Clauses. When you open a page, Netlify’s servers receive the technical details every web request carries, such as your IP address and the type of browser and device, and keep them in server logs for a limited time under Netlify’s own rules, to deliver the pages and keep the site secure (Article 6(1)(f)). The pages contain no analytics or tracking scripts and set no cookies.

The page that an invitation link sent from the app opens is hosted by Cloudflare, Inc., a US company that is certified under the EU-US Data Privacy Framework and whose data processing agreement includes the Standard Contractual Clauses. When somebody opens that link, Cloudflare’s servers receive the technical details every web request carries, such as the IP address and the type of browser and device, and keep them in server logs for a limited time under Cloudflare’s own rules, to deliver the page and keep it secure (Article 6(1)(f)). The page contains no analytics or tracking scripts and sets no cookies; on an Android phone it passes the visitor straight on to Google Play.

No one else receives your data.

Your rights

Under the GDPR you can access, correct, export, delete, restrict or object to our handling of your data, and take the data you gave us to another service. You can also complain to a supervisory authority, in Hungary the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11, postal address 1363 Budapest, Pf. 9, phone +36 1 391 1400, ugyfelszolgalat@naih.hu, naih.hu. You can also take the matter to court.

You can withdraw your consent at any time, which does not affect what was done before: Settings ▸ Account ▸ Your records ▸ Keep them on this phone only. Anything newer in your account is brought to your phone first, then the copy on the server is deleted, your uploaded profile photo included, and your account stays.

Two of these are buttons in this app, under Settings ▸ Account: Export my data, which gives you everything the server holds about you, training log included, and Delete my account. Deletion is permanent and immediate, there is no soft delete and no recovery. What expires later rather than at once is listed under “Deleting your account”.

For anything else, write to triunity66@gmail.com and we will act within one month.

How long we keep it

Your account and sign-in details (your email address, display name, sign-in record and the language of an email sign-up): until you delete the account.

Your backed-up records (daily records, challenges, medallions, settings, onboarding answers and training log): until you turn backup off or delete the account.

Your profile photo: only while backup is on, until you turn it off or delete the account. A copy already held by the storage network’s cache can be shown for up to about a minute afterwards.

Your written reflections: never on our servers. They stay on your phone until you sign out or delete the app.

The record of your consent: for as long as your account exists, including the date you withdrew it, if you did. It is deleted with the account.

Emails in our Gmail mailbox, as described under “Who else is involved”: the copies of the automatic code emails, for signing up and for resetting your password, for 30 days after they were sent, and then they are deleted automatically. Emails you write to us, and our replies: as long as we need them to answer you; we delete them when you ask us to, or when we carry out a request you made by email to delete your account or erase your data. Nothing else in the mailbox is deleted automatically. A complaint about TriUnity or a purchase, and our answer to it: three years, as the law requires; we cannot delete them sooner on request.

Technical and security logs: Supabase (the database, sign-in, photo storage and server functions), Netlify (this website) and Cloudflare (the invitation page) log each request, and the log can include your IP address. Each keeps its logs for a limited time under its own retention rules, which we do not control and which depend on the provider’s service plan, and they are not removed when you delete your account.

The record of the palettes your account bought, held by RevenueCat: until you delete your account. A RevenueCat record left by a test version from before 30 September 2026 that is tied to the installation rather than to your account: until you ask us to delete it. Google Play keeps its own record of each order under its own privacy policy.

A deleted account: once you delete your account we keep nothing that identifies you, apart from the copies and logs listed above as expiring later and the backups described next.

Infrastructure backups: after you delete your account, your data is removed from the live database. If our hosting provider keeps temporary security or recovery backups, copies may remain in those backups until that provider’s retention period for them ends. They are used only to recover or secure the service.

Deleting your account

In the app: Settings ▸ Account ▸ Delete my account, then confirm.

Without the app, or if you cannot sign in: email triunity66@gmail.com from the address on the account and we will delete it within one month, usually the same week.

What is deleted at once: your account, your email address and display name, your uploaded photo, your settings, your daily records and prayer minutes, your onboarding answers and the verse chosen from them, your challenge list, your medallions, your training log, the record of your consent, and RevenueCat’s record of the palettes the account bought. We send nothing to the address afterwards.

What expires later: our Gmail mailbox keeps a copy of each automatic code email we sent you, for signing up or for resetting your password, and that copy is deleted automatically 30 days after it was sent. Supabase’s technical and security logs, which can include your IP address, expire under Supabase’s own retention rules. If Supabase keeps temporary security or recovery backups, copies of your data may remain in them until their retention period ends (see “How long we keep it”). Google Play’s record of a purchase is Google’s, kept under Google’s own privacy policy.

What is deleted only on request: emails you wrote to us, and our replies, are not deleted automatically, not even when you delete your account in the app; we delete them when you ask us to. If you used a test version of TriUnity released before 30 September 2026, RevenueCat may also hold a record from that version tied to the installation rather than to your account, and deleting your account does not reach it. Ask by email and we will delete it within one month; if you ask us by email to delete your account, we delete those emails and that record as part of the same request. A complaint about TriUnity or a purchase and our answer to it are the exception: the law requires us to keep those for three years.

Your reflections were never on the server to begin with, so deleting the app from your phone is what removes those. There is no soft delete and no grace period, and nothing is kept for restoring your account.

Age: adults only

TriUnity is for adults. You must be at least 18 to use it.

We do not knowingly keep the data of anyone under 18. If we learn that an account belongs to someone under 18, we delete it, and a parent or guardian can ask us to at triunity66@gmail.com.

Changes to this policy

If this policy changes in a way that affects what we keep or why, the app tells you before the change applies, and asks for your consent again where the change needs it.

Contact

Lossos Balázs, individual entrepreneur (egyéni vállalkozó), Hadvezér utca 28/b, 4225 Debrecen, Hungary. triunity66@gmail.com.