Effective September 12, 2025 · Updated 3 June 2026
Privacy Policy
How we collect, use and protect your personal data under UK and EU GDPR.
Data Controller: Bonfire Labs ("we," "our," or "us")
Introduction & Scope
At Bonfire Labs, we respect your privacy and are committed to safeguarding your personal data. This Privacy Policy complies with the European Union’s General Data Protection Regulation (GDPR) and details how we collect, use, and protect your information across our application suite (collectively, the "Apps"), which includes productivity tools, family/child tracking, health tracking utilities, and financial portfolio monitoring. All customer data and disk storage are encrypted automatically using AES-256 encryption
1. Legal Basis for Processing Personal Data
Under the GDPR, we only process your personal data when we have a lawful basis to do so:
Your Consent: Where you have explicitly given us permission (e.g., opting into health data logging or optional analytics).
Contractual Necessity: Where processing is required to deliver the core features of our apps to you.
Legitimate Interests: Where necessary for our business operations, security, and app improvements, without overriding your rights.
2. Special Category Data
Within our health and menstrual tracking applications, we process sensitive data regarding your cycle, symptoms, and health metrics.
Explicit Consent: This data is processed strictly based on your explicit, affirmative consent.
Data Security & Isolation: Health data is heavily encrypted both in transit and at rest. We never sell, rent, or monetize your health data, nor do we share it with third-party advertisers. You maintain the right to export or permanently delete your health records at any time directly through the app settings.
3. Children's Privacy
Our child-focused applications are designed to be used under the supervision of parents or legal guardians.
Parental Management: Accounts for minors must be created, managed, and monitored by a parent or legal guardian.
Data Minimization: We do not knowingly or intentionally collect personal identifying information directly from children under the age of consent without verifiable parental authorization. If you believe a child has provided unauthorized data, please contact us immediately for deletion.
4. General Data We Collect
Account Data: Name, email address, and credentials when you register.
Usage & Technical Data: Device identifiers, operating system, IP address, app interaction logs, and crash reports.
5. Your Rights Under the GDPR
If you are located in the European Economic Area (EEA), you possess the following rights:
Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate data.
Right to Erasure ("Right to be Forgotten"): Request the complete deletion of your data.
Right to Restriction & Portability: Restrict processing or request a machine-readable data export.
Right to Object: Object to our processing based on legitimate interests.
To exercise these rights, email us at the address below. You also have the right to lodge a complaint with your local data protection authority.
