Privacy Policy — CheckUpOnMe

1. Who We Are

CheckUpOnMe.com is operated by Earnest Software Engineering LLC ("Company," "we," "us," or "our"), a Florida limited liability company. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use the CheckUpOnMe wellness check-in service (the "Service").

Questions or concerns about this Policy may be directed to our contact form.

2. Information We Collect

2a. Information You Provide Directly

Account information: your name, email address, and password when you register.
Phone number: your mobile or landline number, used to deliver SMS and voice call check-ins.
Timezone: used to schedule check-ins at appropriate local times.
Emergency contact information: names, email addresses, and phone numbers of the people you designate to be notified if you miss check-ins. You are responsible for obtaining these individuals' consent before adding them.
Check-in schedule preferences: frequency, miss threshold, escalation delay, and preferred notification channels.
Payment information: billing details processed by our payment processor (Stripe). We do not store full card numbers on our servers.

2b. Information Collected Automatically

Check-in event logs: timestamps of sent check-ins, confirmation responses, missed check-ins, and escalation events.
Log data: server logs including IP address, browser type, operating system, referring URLs, and pages visited, retained for up to 90 days.
Session data: session identifiers stored in cookies or browser storage to keep you logged in.
Push notification tokens: device tokens used to deliver browser push notifications, if you enable them.

2c. Information from Third Parties

Telecommunications providers: delivery receipts and status callbacks from our SMS and voice providers confirming whether messages were delivered.
Payment processors: confirmation of payment status and subscription lifecycle events from Stripe.

3. How We Use Your Information

We use the information we collect to:

Create and manage your account and authenticate your identity.
Send wellness check-in messages to you via your chosen channels (email, SMS, voice call, push notification).
Notify your designated emergency contacts when you miss a configurable number of consecutive check-ins.
Process payments and manage your subscription.
Send transactional emails such as email verification, password resets, and account alerts.
Monitor and improve the reliability and performance of the Service.
Detect, investigate, and prevent fraudulent transactions and abuse.
Comply with applicable laws, regulations, and legal obligations.
Respond to your support requests and communications.

We do not sell your personal information. We do not use your data to serve third-party advertising.

4. How We Share Your Information

We share personal information only in the following circumstances:

4a. Service Providers

We share information with third-party vendors who perform services on our behalf, strictly for those purposes:

Twilio — SMS and voice call delivery for toll-free messaging. Phone numbers and message content are transmitted to Twilio to deliver check-in and escalation messages.
Telnyx — additional SMS and voice call delivery. Phone numbers and message content are transmitted to Telnyx to deliver check-in and escalation messages.
Resend — transactional email delivery. Email addresses and message content are transmitted to Resend to deliver emails.
Stripe — payment processing. Billing information is handled by Stripe under their own Privacy Policy.
Hosting and infrastructure providers — cloud servers, databases, and related services that store and process data on our behalf.

4b. Emergency Contacts You Designate

When you miss check-ins and an escalation is triggered, we share limited information with your designated emergency contacts — specifically your name and a message indicating that you have not responded to wellness check-ins. Emergency contacts do not receive your password, payment details, or full account history.

4c. Legal Requirements

We may disclose your information if required by law, subpoena, court order, or other governmental or legal authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of the Company, our users, or the public.

4d. Business Transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice of any such change via email or a prominent notice on the Service.

5. Telephone and SMS Communications

SMS consent is collected separately from this Privacy Policy. Providing a phone number is not by itself consent to receive text messages. Account holders must check an explicit, unchecked-by-default box agreeing to SMS text messages at the time they add a mobile number. The full opt-in language, sample messages, and opt-out instructions are published on our SMS Terms page.

If you opt in, you consent to receive automated text messages and, if you enable voice check-ins, pre-recorded or artificial voice calls from the Company at that number for wellness check-in purposes. Message and data rates may apply.

You may withdraw consent to SMS messages at any time by texting STOP to any message you receive, or by disabling the channel in your account settings. You may withdraw consent to voice calls by disabling the channel in your account settings.

By adding a contact's phone number for SMS alerts, you represent that you have obtained that individual's prior express consent to receive automated text messages from the Company. Contacts may also opt in or opt out on their own preferences page.

6. Cookies and Similar Technologies

We use session cookies to maintain your logged-in state. These cookies are essential for the Service to function and are not used for tracking or advertising purposes. We do not use third-party tracking cookies or analytics scripts that share data with advertising networks.

Browser push notifications use a VAPID public key stored in your browser to authenticate the notification subscription. No personal data is transmitted to third-party push networks; notifications are delivered directly via the Web Push standard.

7. Data Retention

Account data: retained for the duration of your account, plus 30 days following account deletion to allow for recovery requests. After 30 days, account data is permanently deleted.
Check-in event history: retained for up to 365 days from the date of the event, then automatically purged.
Payment records: retained as required by applicable financial and tax regulations (typically 7 years).
Server logs: retained for up to 90 days.
Emergency contact data: deleted when you remove the contact from your account or when your account is deleted.

8. Data Security

We implement industry-standard security measures to protect your personal information, including:

Encryption of data in transit using TLS/HTTPS.
Bcrypt hashing of passwords — we never store plaintext passwords.
Restricted access to production systems on a need-to-know basis.
Signed and validated webhooks for all third-party integrations.

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but will notify affected users of any breach as required by applicable law.

9. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

Access: request a copy of the personal information we hold about you.
Correction: request that we correct inaccurate or incomplete information. You can update most information directly in your account profile.
Deletion: request deletion of your account and associated personal data. You may delete your account from the profile settings page. We will process the request within 30 days.
Portability: request a machine-readable export of your check-in history and account data.
Opt-out of communications: withdraw consent to SMS or voice calls at any time via account settings or by texting STOP.

To exercise these rights, submit a request via our contact form selecting "Privacy Request." We will respond within 30 days.

10. Children's Privacy

The Service is not directed to children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a child, please contact us and we will promptly delete it.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address on your account) and update the "Effective Date" at the top of this page at least 14 days before the changes take effect. Your continued use of the Service after that date constitutes acceptance of the updated Policy.

For minor or non-material changes, we will update the Policy without a separate notification.

13. Governing Law

This Privacy Policy is governed by the laws of the State of Florida. Any disputes arising from this Policy shall be resolved in accordance with the dispute resolution provisions in our Terms of Service.