Privacy Policy

Last updated: 2026-05-28

Operator: Jen Built It LLC, a US limited liability company.
Mailing address: 10800 S Lloyd Drive, Worth, IL 60482, USA.
Privacy contact: privacy@jenbuiltit.com
General support: support@jenbuiltit.com

This policy explains what data we collect when you use Dopamine Dealer (the "Service"), why we collect it, who we share it with, and what choices you have. Throughout this policy, "we," "us," and "our" refer to Jen Built It LLC. Dopamine Dealer is a gamified habit tracker.

1. What we collect

Account data. Your email address and a salted hash of your password (PBKDF2-SHA256, 100,000 iterations). We never store your password in plain text.
Habit data. The habits you create (emoji, label, optional subtitle, sort order) and the dates you check them off. This is the core feature of the Service.
Profile data. Your timezone (used to determine when your day rolls over) and your newsletter preference.
Security data. A hashed or truncated IP address and login attempt counts for rate-limiting and abuse prevention. Email-verification and password-reset tokens are stored as SHA-256 hashes only.
Newsletter consent. If you check the newsletter box during signup or in your profile, we store the consent state and a timestamp.

2. Why we collect it

To create and secure your account (legal basis: contract).
To save and display your habits and streaks across devices (legal basis: contract).
To verify Pro status when Jen's App Hub passes a signed verification token (legal basis: contract).
To prevent fraud, abuse, and credential stuffing (legal basis: legitimate interest).
To send you product updates only if you opt in (legal basis: consent).

3. Who we share it with

We use a small set of vendors to operate the Service. Each vendor only receives the minimum data they need.

Cloudflare hosts the Service and our database (D1, Workers).
Resend sends transactional emails (email verification, password reset).
Kit stores newsletter subscribers, only if you opt in. If you do not opt in, your email is not shared with Kit.
n8n / Hostinger VPS receives a signup notification with your email only if you explicitly opted in to the newsletter. Without consent, no signup notification is sent.

We do not sell your personal data. We do not share your data with advertisers. We do not transfer your data to third parties for their own marketing.

4. Cross-app Pro verification

If you have a Pro subscription on Jen's App Hub, Dopamine Dealer can unlock Pro features (unlimited habits, habit packs) for you. The App Hub mints a short-lived signed JWT containing only your email and Pro expiry date. We verify that JWT locally to grant Pro access. We do not receive your payment details, only the entitlement.

5. Cookies and local storage

We use a token in browser localStorage to keep you logged in (30-day session). We do not use advertising cookies, third-party tracking pixels, or cross-site analytics.

6. How long we keep your data

Account, habit, and check data: as long as your account exists. Use the "Delete account" button in the Service to delete it all at once.
Password-reset tokens and email-verification tokens: until they expire (1 hour and 24 hours respectively) or are used, then deleted.
Rate-limit records (failed-login counters, request counters): up to 90 days.
Newsletter consent: until you unsubscribe.

7. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Delete your account and your data
Export a copy of your data in a portable format
Withdraw newsletter consent at any time
Lodge a complaint with your local data protection authority

To delete your account, use the Delete account button in the Service header (current password required). To export your data, an authenticated GET to /api/account/export returns a JSON file with everything we have about you. For all other requests, email privacy@jenbuiltit.com. We respond within 30 days.

8. Do Not Sell or Share My Personal Information

We do not sell your personal information and we do not share it with third parties for cross-context behavioral advertising. If you are a California resident and want to formally exercise your right to opt out of sale or sharing, email privacy@jenbuiltit.com with the subject "Do Not Sell Request" and we will record your request.

9. Children

The Service is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has created an account, email privacy@jenbuiltit.com and we will delete it.

10. International users

The Service is operated from the United States. By using the Service from outside the US, you consent to the transfer of your data to the US.

11. Security

We protect your data using TLS in transit, salted hashes (PBKDF2-SHA256, 100,000 iterations) for passwords, SHA-256 hashes for reset and verification tokens, parameterized database queries, per-account login lockout, per-user write rate limits, and least-privilege secrets management. No system is perfectly secure, but if we detect a breach affecting your data, we will notify you and the appropriate authorities as required by law.

12. Changes to this policy

If we update this policy in a way that materially changes how we handle your data, we will notify you by email (for account holders) or post a notice on the Service. The "Last updated" date at the top will always reflect the current version.

13. Contact

Questions about this policy or your data:

Jen Built It LLC
10800 S Lloyd Drive
Worth, IL 60482
USA
privacy@jenbuiltit.com