Data categories collected
| Category | Examples | Required? | Retention |
|---|---|---|---|
| Account identity | Name, email, hashed password | Required | Duration of account |
| Child profile | First name/nickname, age, diagnosis stage, focus areas | Optional | Duration of account |
| Tracker & journal | Behavior logs, milestones, mood logs, free-text notes | Optional | Duration of account |
| Community content | Posts, comments, reactions in Circles | Optional | Until deleted or account closure |
| Usage analytics | Feature interactions, session durations, screen views | Anonymized | 24 months |
| Diagnostics | Crash reports, error logs, performance traces | Anonymized | 90 days |
| Device & network | OS version, device model, IP address | Automatic | 30 days |
Note on free-text fields: Notes and journal entries are stored encrypted and never used to train models or shared with third parties. They are readable only by you.
Legal framework & compliance
Autica is a US-based service and complies with applicable federal and state privacy laws. The table below maps each processing activity to the purpose it serves.
| Processing activity | Purpose |
|---|---|
| Creating and managing your account | Deliver the service you signed up for |
| Personalizing guidance and tracker | Provide the core functionality of Autica |
| Sending service communications | Keep you informed about your account |
| Marketing communications | Opt-in only — you choose whether to receive these |
| Anonymized product analytics | Understand and improve how the product is used |
| Security and fraud prevention | Protect users and the platform from harm |
| Compliance with legal obligations | Meet requirements under US federal and state law |
Applicable laws include the CCPA/CPRA (California), COPPA (children's data), FTC Act Section 5 (consumer health data), and comparable state privacy laws in Virginia, Colorado, Connecticut, and other states.
Sub-processors & third parties
Autica works with a small, carefully chosen set of service providers. Each is contractually prohibited from using your data for their own purposes.
Google Firebase
Database (Firestore), authentication, cloud functions
Infrastructure
Google Cloud
Hosting and server infrastructure (US region)
Infrastructure
Firebase Analytics
Anonymized in-app usage analytics
Analytics
Firebase Cloud Messaging
Push notifications (device tokens only)
Notifications
Crashlytics
Crash reporting and error diagnostics
Diagnostics
Stripe
Payment processing for paid plans, if applicable
Payments
Data location: All data is stored in US-based data centers on Google Cloud infrastructure.
Children's data — special protections
Because Autica handles information about children with autism, we apply heightened protections to child profile data beyond what's legally required.
| Data type | Protection applied |
|---|---|
| Child name fields | Nickname-only encouraged; full legal name never required |
| Diagnosis information | Stored encrypted; never shared with advertisers or data brokers |
| Milestone / tracker data | Visible only to the account holder; never sold externally |
| Anonymized benchmarking | Future feature — will use k-anonymity (minimum group size 50+) before any aggregate is shown |
| Community references | Parents choose what to share; no requirement to identify a child |
COPPA compliance: Autica is not directed at children under 13. If a child's data is submitted without parental consent, we will delete it on request. Contact info@autica.io.
Security controls
| Control | Implementation |
|---|---|
| Encryption in transit | TLS for all API and web traffic |
| Encryption at rest | Handled by Google Cloud / Firebase default encryption |
| Password storage | Managed by Firebase Authentication using one-way hashing; we cannot read your password |
| Access controls | Access to user data limited to authorized team members |
| Firestore security rules | Users can only read and write their own documents; enforced server-side |
| Auth tokens | Firebase tokens are short-lived and rotated on password change |
| Incident response | Breach notification without unreasonable delay, per applicable state law |
Exercising your rights
| Right | How to exercise | Response time |
|---|---|---|
| Access / export | Settings → Privacy → Download my data | Immediate |
| Correction | Edit directly in Settings or Profile | Immediate |
| Deletion | Settings → Privacy → Delete account, or email us | 30 days |
| Opt out of analytics | Settings → Privacy → Analytics opt-out | Immediate |
| Marketing opt-out | Unsubscribe link in any email, or Settings → Notifications | Immediate |
| CCPA opt-out of sale | Not applicable — we do not sell data | — |
California residents may also contact the California Privacy Protection Agency. For all users, the fastest path to resolving a concern is to contact us directly at info@autica.io.
Questions about this document?
Our team handles all data-related requests and responds within 2 business days.
Email info@autica.io Read Privacy Policy →