Privacy Policy

1. Who is responsible for the data

The operator (controller) is the sole proprietor [FULL NAME OF THE SOLE PROPRIETOR], UNP [УНП], address: [RESIDENTIAL ADDRESS]. Contact email: [ПОЧТА ДЛЯ ОБРАЩЕНИЙ].

This policy covers the @drip_water_bot bot, the Mini App inside Telegram and the dripwater.app website, together the Service.

2. What data, why, and on what basis

The basis for everything below is your consent (Article 5 of Law No. 99-Z). You give it with the checkbox in the Mini App. Website data is covered in the Cookie Policy.

• To run your account: Telegram id, first name, username, language code, language, time zone, service dates (bot start, setup finished, first entry, last visit, bot blocked).
• To work out your daily amount: sex, height, weight.
• To keep your water log: drink, volume, time, workout marks, the daily goal and the day total.
• To send reminders: schedule, message tone, reminder log (when a message was sent or skipped and why, its Telegram message id).
• To prove consent: the version of the documents you accepted and when.
• To improve the Service: analytics events (app opened, drink logged, reminder sent) and the source tag you arrived at the bot with.
• To keep the Service running and safe: the IP address and request details in the server logs and at Cloudflare.

3. Height and weight

Height and weight can say something about health, so we treat them as special personal data: we process them only with your consent, only to work out your daily amount, and pass them to no one outside the running of the Service. The Service does not collect diagnoses, medication or other medical details. Please do not enter them.

4. What we do with the data

We collect, organise, store, change, use, anonymise, block, provide and delete data. Processing is automated. The Service makes no automated decisions with legal effects for you.

5. How long consent and data last

Consent lasts 3 years from your last visit to the Mini App, or until you withdraw it, if that is sooner. We keep the data for the same period.

When you delete your account, the data leaves the database at once and the daily backups within 14 days. Analytics events stay, with the link to the account removed. Server logs are kept for a limited time needed for operation and security.

6. Who receives the data

We do not sell data or pass it to advertisers. It is processed by the providers the Service cannot run without:

• Telegram, which runs the bot and the Mini App and delivers messages;
• Cloudflare, the network that carries requests to the website and the API;
• the provider of the server the Service runs on.

7. Transfers abroad and their risks

The Service runs on a server in the Republic of Belarus. Telegram and Cloudflare may process your Telegram data, messages, IP address and request details in other countries, including countries without an adequate level of personal data protection.

The risk is that those countries may have weaker data laws and fewer ways to enforce your rights, and that local authorities may gain access to the data. By ticking the box, you agree to this transfer knowing these risks.

8. Your rights

You can withdraw consent at any time, find out what data we process and who received it, correct it, demand that we stop processing and delete it, and complain. The Your Rights document explains how.

9. How we protect data

Connections use HTTPS. Every Mini App request is checked against Telegram's signature. The database cannot be reached from the internet, and only the operator can access the server and the admin panel.

10. If you are in the EU, the UK or Switzerland

The GDPR and its equivalents apply to you. Our bases are consent (Articles 6(1)(a) and 9(2)(a) GDPR), performance of the Terms of Use (Article 6(1)(b)), and our legitimate interest in security for server logs (Article 6(1)(f)).

Data is transferred to Belarus and to other countries that may have no European Commission adequacy decision. The basis is your explicit consent after being told the risks (Article 49(1)(a) GDPR).

On top of the rights in Your Rights, you can get your data in a machine-readable form, restrict processing, object to processing based on legitimate interest, and complain to the supervisory authority in your country. We answer within one month.

11. If you are anywhere else

We do not sell data or use it for targeted advertising. The rights described here belong to every user, wherever they live. If the law of your country gives you more, you keep it. Users in Russia can also turn to Roskomnadzor.

12. Age

The Service is meant for people aged 16 and over. If you are younger, do not use it: a legal representative must consent for you. If we learn that an account belongs to a child without that consent, we will delete it.

13. Changes

A new edition gets a new date. If the document changes, the Mini App will ask you to accept it again.