Privacy Notice

X21 Challenge is operated by Hoàng Xuân Bách ("we", "us", "our"). Hoàng Xuân Bách is the data controller for personal data processed through the Service and is responsible for how it is handled.

• Account data — first name, last name, email, phone number, hashed password, chosen role (Coach or Challenger), and, for challengers, the coach you selected.
• Profile data — display name and any other profile details you add.
• Subscription and order data — plan, status, renewal dates, and Paddle identifiers linking your account to your order. Card details are handled by Paddle and never reach us.
• Product content — habits, habit completions, course progress, and chat messages you send in the app (including images you attach).
• Support and communications — messages you send us and our replies.
• Technical data — IP address, device and browser information, and basic usage logs generated when you interact with the Service.

• Providing the Service — creating your account, authenticating you, running your challenges, storing habits and chat, and enabling coach–challenger interaction (performance of a contract).
• Payments and subscription management — verifying purchases and keeping your subscription in sync with Paddle (performance of a contract).
• Security and fraud prevention — protecting the Service and its users against abuse (legitimate interests).
• Product improvement and analytics — understanding how the Service is used so we can improve it (legitimate interests).
• Customer support — responding to your questions (legitimate interests, and performance of a contract).
• Legal obligations — record-keeping and responding to lawful requests (legal obligation).
• Marketing — only where you have opted in (consent). You can withdraw consent at any time.

• Merchant of Record — Paddle. Paddle.com Market Limited acts as the Merchant of Record for all our orders and handles payment processing, tax compliance, invoicing, subscription management, and refund requests. See Paddle's Privacy Notice.
• Hosting and infrastructure providers — including our application platform and database provider used to run the Service.
• Email delivery — providers we use to send transactional emails (e.g. welcome and account emails).
• Professional advisers — legal, accounting, and similar advisers where reasonably necessary.
• Authorities — where required by law or to protect rights, property, or safety.

We do not sell your personal data.

Our providers may process data outside your country. Where personal data is transferred out of the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

We keep personal data for as long as your account is active and for a reasonable period afterwards to meet legal, accounting, and security obligations. When data is no longer needed we delete or anonymise it.

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your personal data; to data portability; and to withdraw consent where processing is based on consent. If you are in the UK or EEA, you also have the right to lodge a complaint with your local supervisory authority.

To exercise these rights, contact us using the details in your account or on our website. We aim to respond within one month.

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and row-level access policies in our database. No system is 100% secure, but we work to keep your data safe.

We use cookies and similar technologies that are strictly necessary to run the Service — for example, to keep you signed in. If we introduce analytics or marketing cookies in the future, we will ask for your consent where required and provide controls to manage them.

We may update this Privacy Notice from time to time. Material changes will be communicated in-app or by email before they take effect.

For privacy questions, contact Hoàng Xuân Bách using the email address on our website. For payment- or invoice-related privacy questions, please also see Paddle's Privacy Notice linked above.

See also our Terms & Conditions and Refund Policy.