Who we are
Three Buckets is operated by Michael Hendzel, an individual sole proprietor, of 232 Indian Rocks Rd N, Suite B, Belleair Bluffs, FL 33770, United States ("we", "us"). I am the data controller for the information described here. Contact: [email protected].
What we collect
| Data | Where it comes from | Why we hold it |
|---|---|---|
| User ID | Apple, Google, or the email account you create | To connect you to your own data and nobody else's |
| Name and email address | Apple or Google, only if you choose to share them | To address you in the app and reach you about your account. Apple's Hide My Email relay is fully supported, in which case we never receive a real address. |
| Email address and password | You, if you create an account with an email rather than signing in with Apple or Google | So you can sign back in, and reset the password if you forget it. We never see the password — it is hashed by Supabase and is not readable by us. We send no marketing email and keep no mailing list; the only mail that ever goes to this address is a confirmation link or a password reset you asked for. |
| Audit answers | You, in the app | Your 1–10 ratings across the three buckets, and the scores calculated from them. This is the product. |
| Household and work context | You, in the app, once after the audit | Whether you have a partner, how many children or pets, the sector your career is in, your employment type, a broad annual income band, and roughly what your investments pay you monthly. Used to write your personal memo and to stop the app giving advice that does not apply to you. All optional — skip any question and the app still works. |
| Streak and activity | You, in the app | Which days you completed your daily move, so the streak is accurate |
| Exercise log | You, in the Exercise Tracker | Which days you trained and which muscle groups you tapped. No reps, no weights, no health data, and nothing read from Apple Health. Synced as of version 1.0.1 so it survives a new phone; it was device-only before that. |
| What you tick off on the calendar | You, in the app | Which days you marked, and what you marked — a rock, a goal, the daily move, or something you typed yourself. Shown back to you as your calendar and your streak. Never read, analysed or sent anywhere. |
| Goals and commitments | You, in the app | To show them back to you |
| What you write in your own words | You, in the app, in the three open questions | Stored exactly as typed and quoted back to you later. We do not read, analyse, categorise, or process this text, and it is never sent to any AI system. Optional — skip any of them. |
| Your journal | You, in the app, whenever you choose to write | Kept exactly as typed, with the date and time it was written, and shown back only to you. We do not read, analyse, categorise, or process your journal, and it is never sent to any AI system. Entirely optional, and you can delete any entry, or all of them, at any time. |
| Quarterly rocks | You, in the app | Up to three commitments you set for each bucket this quarter, and the status of each, so the app can ask you about them later |
| Your weekly boards | You, in the app, whenever you tick something off a board | Which actions you ticked and on which day. It is what draws your weekly total, tells you whether you cleared the week, and lets a run survive a new phone. It is the most detailed record here of what you actually did — that a Tuesday had a long walk and a call to your mother on it — and it stays in your own row. We do not read, analyse or categorise it, and it is never sent to any AI system. Tick nothing and there is nothing to hold. |
| Your weight | You, in Personal, if you choose to track it | The numbers you type in and the goal you set, each with the date it was logged, so the app can draw your line and move the figure on your home screen. Not analysed, not compared to anybody, and never sent to any AI system. Track nothing and there is nothing to hold. |
| Feedback you send us | You, when the app asks how it is going | A rating out of five and an optional comment. It comes to us, it is never published, and it is not an App Store review — those are written on the App Store, by you, if you choose to. Ignore the prompt and nothing is recorded. |
| Town name and its approximate coordinates, if you turn on real weather | You, typed into the app | So the sky behind your figure matches the real one where you live. We look the town up once and keep its name and the rough coordinates of the town itself — a town centre, accurate to a few miles at best — stored with your account so the setting follows you to a new phone. Optional, and off until you type it. We never ask your phone for its location and the app requests no location permission — this is a place you chose to name, not one we detected. Clear the field and the stored place is deleted and nothing further is sent. |
| Reminder time | You, in Settings | To schedule your daily notification on your own device |
That is the complete list.
What never leaves your phone
Some things are stored only on your device and are never sent to us, even when you are signed in: your Get Sober tracker, meaning the days you marked sober or not and the goal you set; whether you have the app set to light or dark; and a first audit you have started but not finished, which is kept for a week so you can pick up where you left off rather than answer thirty-four questions twice. None of it reaches our database at all. It lives in the app's own storage, and deleting the app removes it.
The sobriety record is the most sensitive thing this app could hold, and keeping it off our servers is a deliberate choice rather than an oversight. Nobody but you ever sees it — which also means it does not follow you to a new phone, and we accept that trade.
Changed in version 1.0.1: your exercise log — which days you trained and which muscle groups you tapped — used to be listed here. It now syncs with the rest of your account, so it survives a reinstall or a new phone. If you would rather it did not leave your device, do not log anything in the Exercise Tracker; nothing else in the app depends on it.
A note on what you write yourself
Three questions in the app ask for free text: the thing you know you should stop doing, what you dislike about your job, and what kind of investing you want to learn. These are for you, not for us. The app has no ability to interpret them — it stores the words and shows them to you again later, and that is the whole feature.
They are written to be about your choices rather than other people, and we would ask you to keep them that way. If you name someone else in that box, that information about them ends up in our database without them ever agreeing to it. The app will never prompt you for details about another person, and if you delete your account it goes with everything else.
A note on the income question
We ask for an income band, never an exact figure, and never an account number, employer, or any document. It exists so the memo can talk about your money in monthly terms instead of guessing. If you would rather not answer it, do not — nothing in the app depends on it.
What we do not collect
No contacts. No device location — we never ask your phone where you are, and the app requests no location permission. No photos or camera. No microphone. No health or fitness data from HealthKit or Google Fit. No advertising identifier (IDFA or GAID). No third-party analytics or attribution SDK — there is not one in the app. No bank, brokerage, calendar, or email connection. We run no advertising and have no advertising partners.
Real weather is the one place a location is involved, and it is optional. The scene behind your figure can follow the real sky where you live. To turn that on you type a town name yourself. The app sends that name to Open-Meteo to look up where the town is, and then sends those coordinates back to Open-Meteo — at most about once an hour, and only while the app is open — to ask what the sky is doing there. That is coarse location by any reading of the word, so we would rather name it than leave it implied: it is the position of a town, not of you or your phone, it is a place you chose to type rather than one we detected, and it is accurate to a few miles at best.
No account, answer, or identifier of yours goes to Open-Meteo with it, and no reading is kept beyond the last one. The town and its coordinates are stored with your account so the setting survives a new phone. Leave the field empty and the request is never made; clear it later and the stored place is deleted and it stops.
Links out of the app
The app links to things that live elsewhere: the podcast on Apple Podcasts and Spotify, the community on Discord, videos on YouTube, books on this website, and a small number of third-party guides and apps we think are worth your time. Following one opens your browser or that app, and once you are there you are subject to their terms and their privacy policy, not ours. We are not told that you followed a link, we receive nothing back, and we have no account or relationship with you on those services. We carry no affiliate tags and earn nothing from any of these links.
There is one exception, and it is worth stating plainly. The Life Left to Live calculator in Resources is a third-party web tool, and the app puts your age into the web address so the tool fills itself in rather than asking you to type it again. Your age — a single number, not your birth date — is therefore visible to that service and in your browser history. Nothing else about you goes with it: no name, no identifier, no answers, no scores. If you skipped the birth-year question, the app sends nothing and the tool simply asks you for an age.
Exporting your journal
You can share or export your journal from inside the app at any time, either one entry or all of them, as plain text or as a PDF that puts your quarterly rocks above your entries. The file is handed to whichever app you choose — Notes, Mail, Messages, Files, a cloud drive — by your own device. It does not pass through us, we do not see where it goes, and we keep no record that you exported it. Once it leaves the app it is outside this policy and subject to whatever terms that other app has.
How your data is stored
If you sign in with Apple or Google, your data is stored in our database hosted by Supabase, Inc. on servers located in the United States, encrypted in transit (TLS) and at rest. Row-level security is enforced at the database level, meaning your rows can only be read or written by your own authenticated account.
Three Buckets requires an account. That is what makes your audit, your rocks, your journal and your streak survive a reinstall or a new phone rather than disappearing with the handset. Some data is still never sent to us at all — see what never leaves your phone.
Notifications
Your daily reminder is a local notification scheduled on your own device. This version of the app sends no remote push, so we do not hold a push token.
Who we share it with
We do not sell, rent, trade, or share your personal information for advertising or cross-context behavioural advertising. Under the CCPA/CPRA we have not sold or shared personal information in the preceding twelve months.
The only third parties that process your data are:
- Supabase, Inc. — database and authentication hosting, acting as our processor under contract.
- Apple and Google — solely to authenticate you, under their own privacy policies.
- Open-Meteo — the weather lookup, and only if you turn real weather on. It receives the town you typed and that town’s approximate coordinates, and nothing that identifies you: no account, no key, no identifier, and nothing it could tie back to a person.
We may disclose information if compelled by valid legal process, or to protect our rights or someone's safety. We will tell you unless legally prohibited.
Legal bases (UK/EU users)
- Contract — to give you the app you asked for: your account, answers, scores, streak and goals.
- Legitimate interests — keeping the service secure and working.
- Consent — device notifications, which you can withdraw at any time in Settings or in iOS/Android system settings.
How long we keep it
Until you delete it. We hold your data while your account exists. Delete your account and it is removed immediately — see below. Our hosting provider keeps encrypted database backups for operational recovery; any residual copy of deleted data in those backups is purged within 30 days.
Deleting your account and data
Open the app, go to Profile → Account → Delete account and data, and confirm once. This permanently deletes your profile, your audit answers, your score snapshots, your goals, your quarterly rocks, your calendar, everything you wrote in your journal, and your activity history from our database, deletes your authentication record, deletes the town you typed for weather, and clears the copy stored on your phone, including the training log that never left it.
It is a hard delete. There is no grace period, no archive, and no way for us to restore it afterwards. You do not need to contact support, and we will not ask you why.
Your rights
Wherever you live, you can access, correct, export, or delete your data. Most of that is immediate inside the app; for anything else, email [email protected] and we will respond within 30 days.
If you are in the UK or EU you also have the right to object to or restrict processing, to data portability, and to lodge a complaint with your supervisory authority. If you are in California you have the rights to know, delete, correct, and to opt out of sale or sharing — though as stated above, we do neither. We will not discriminate against you for exercising any of these rights.
International transfers
Three Buckets is operated from the United States and your data is processed there. If you use the app from the United Kingdom or the European Economic Area, your personal data is transferred to the United States. That transfer relies on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), which form part of our data processing agreement with Supabase, Inc., supported by encryption in transit and at rest and by the fact that we collect no special-category data.
Children
Three Buckets is not directed at children under 13 (or under 16 in the UK/EU) and we do not knowingly collect their data. If you believe a child has given us information, email us and we will delete it.
Security
TLS in transit, encryption at rest, row-level security scoped to your own account, and no collection of data we do not need. No system is perfectly secure, and we will notify you and the relevant authority of a breach affecting your data as required by law.
Changes
If we change this policy we will update the effective date above and notify you in the app before the change takes effect. Material changes will ask for your acknowledgement.
Contact
[email protected]
Michael Hendzel
232 Indian Rocks Rd N, Suite B
Belleair Bluffs, FL 33770
United States