Privacy Policy

Every App uses Firebase Crashlytics and Google Analytics for Firebase (GoSober also uses Mixpanel; see its section) to find bugs and see which features are used.

• Crash reports contain the technical details of the error (where in the code it happened), your device’s model and operating system, the App version and a random installation ID.
• Usage statistics record which screens are opened and which actions are taken (for example, that a counter was tapped or a calculation was run), with your device’s model, operating system, App version, language, an approximate country or region (worked out from your connection, never GPS) and a random installation ID.
• They never include what you type or enter: no amounts, notes, names, journal entries or medicines. Apps that have an account don’t send your email address with them.
• No advertising ID is collected for them, and they are never used for advertising.

Crash reports are always on, for everyone, everywhere (including the EU, EEA and UK), from the first time an App opens: they are how we find and fix crashes, and they carry nothing you enter. Usage statistics are on by default too; some Apps let you turn them off in their settings (for example under Settings › Privacy), and in the others there is no switch. If you object to either, email us (see “Your choices and rights”).

Paid features (such as “Pro”) are sold by the App Store and Google Play. We never see your card or payment details. RevenueCat, our subscription service, receives the purchase from the store with basic technical details of your device (such as its model, operating system and country), and tells the App what you have unlocked and when it renews or ends. It knows you by a random ID, or, in Subtotal and TipCup, by your account ID.

Most Apps have a board where you can suggest features, vote and comment. Reading it needs nothing from you. To post, vote or comment you sign in (for example with an email link, Google or Sign in with Apple), and we keep:

• your email address and how you sign in (with Sign in with Apple’s “Hide My Email” we only see Apple’s relay address), and an account ID;
• the display name you choose, and your posts, comments and votes.

The board is public to other users of that App: your posts, comments, votes and display name are visible to them. Before anything is posted, its text may be checked automatically for abuse by Google’s Gemini AI (Vertex AI); the check doesn’t keep the text. We may email you about your posts (for example, when an idea you posted is built) and send sign-in links.

Apps that talk to our servers use Firebase App Check, which asks Apple or Google to confirm that a request comes from a genuine copy of the App on a real device. It doesn’t identify you.

If you email us, we keep the conversation to help you, and delete it when it is no longer needed. Some Apps start the email with a few technical details (such as the App version and your device’s model); you see them before you send and can delete them.

Like any online service, our servers log technical details of each request they answer, such as the time, your IP address and what the App asked for, to keep the Apps secure and find faults. They aren’t used to profile you and are kept for 30 days.

Some Apps need an account and keep what you create in it, on our servers, so it is safe and synced across your phones. That is the only reason we keep it. For your account we keep:

• your email address and how you sign in (an email link, Google or Sign in with Apple; with “Hide My Email” we only see Apple’s relay address), and an account ID that Firebase creates for you;
• a name or nickname, only if you give one, and settings such as your country, language, time zone and currency, so dates, reminders and amounts are right for you;
• when you accepted the terms and this policy, and which versions;
• for notifications, a push token for each phone you sign in on, with its platform, App version, language, time zone and when it was last used.

We use what you create only to run the App for you: to show it to you, sync it, back it up and send the reminders and notifications you choose. It is stored in Google Cloud’s europe-west1 region in Belgium, in the EU, and our server code runs there too. Security rules mean only your signed-in account can read your private data. App lock and home-screen widgets work on your phone only; we never receive your face, fingerprint or passcode.

Emails. We send emails you can’t turn off: sign-in links and messages about your account (for example that its deletion is scheduled, cancelled or done, or a warning before an inactive account is deleted). Any other email is optional and can be turned off in the App or from the email itself. If an email bounces or is marked as spam, we note that and stop sending to that address.

Deleting your account. When you delete your account in the App, it is deleted within 30 days; signing back in before then cancels the deletion. Then we delete your account and everything in it, delete your RevenueCat record and, if you use Sign in with Apple, revoke the App’s access to your Apple ID. Deleting an account doesn’t cancel the subscription: cancel it in the App Store or Google Play. Where an App deletes inactive accounts, it does so only after 24 months without you opening the App or signing in, and warns you 30 days and 7 days before, by email and, if you allow notifications, by a push notification; opening the App or signing in cancels it.

Some Apps let you keep records that can say something about your health, such as a habit you are stopping or cutting back on, daily check-ins, moods, cravings, a private journal or the reasons you write down. Where such an App keeps them in your account on our servers:

• we use them only to run the App for you, and never for advertising, profiling or to train AI models;
• they are never shown to other users, unless you choose to share something yourself;
• we process them because you gave your explicit consent when you agreed to this policy at sign-in (GDPR Art. 9(2)(a)), and to provide the service you asked for. You can withdraw that consent at any time by deleting those records or your account; that doesn’t affect what we did before;
• crash reports and usage statistics never include them.

Consumer health data (US). Some of these records are consumer health data under laws such as Washington’s My Health My Data Act. We collect them only to provide the App to you, with your consent, and use them for nothing else. We don’t sell them or share them with anyone except the processors in section 5, who act for us. You can see them (export), delete them and withdraw your consent at any time.

Some Apps have a community where you post, comment and react. There, you appear under a handle (an anonymous one the App generates, which you can change) rather than your name or email. Your posts, comments, reactions, the topics and threads you follow or mute, and your reports, blocks and appeals are stored with your account. Posts, comments and reactions are visible to other signed-in users of that App, together with any profile details you choose to show.

Automated screening. Before a post or comment appears, its text is checked automatically by Google’s Gemini AI (through Google Cloud Vertex AI) for content the App’s Community Guidelines don’t allow, and for signs that someone may be in crisis. The result decides whether it is published, held or rejected. Rejections, warnings and temporary restrictions can be decided automatically; you always see why, and you can appeal from the App. Every permanent ban is reviewed by a person before it takes effect. These decisions only ever affect the community, never the rest of the App, your own data, its export or deleting your account. We rely on your explicit consent and on our contract with you for this (GDPR Art. 22(2)(a) and (c), 22(4)); you can ask for a person to review any decision about you.

Translation. Where an App translates posts, their text is translated by Google’s Gemini AI, and the translation is kept so the next reader doesn’t need a new one. Translations are deleted with the post.

When you delete your account, your posts and comments are deleted with it (replies others wrote stay, with “[deleted]” in place of yours). Moderation records (decisions, strikes, reports and appeals) keep no text, are kept under a keyed hash instead of your account ID after deletion, and are deleted after their normal time (decisions: 1 year), as records required by the EU Digital Services Act.

To stop people from creating many accounts to get around a ban or to spam a community, an App with a community may keep a few limited signals. They are used only for this, and never for advertising or profiling:

• on Android, a keyed one-way hash of your phone’s Android ID for that App (we can’t turn it back into the ID), so that new accounts on a phone that many accounts or a banned account used start with limited community access for a while;
• when you sign up, a keyed hash of the network your connection comes from (the first part of your IP address), counted per hour and deleted after 2 days;
• if an account that was restricted or banned is deleted, a keyed hash of its email address, kept for as long as the restriction would have lasted and at most 12 months, so a new account with the same address gets the same restriction.

We rely on our legitimate interest in keeping the community safe (GDPR Art. 6(1)(f), and Art. 17(3) for the kept hash).