Privacy Policy

Last updated: 11 November 2026

Deloop is an app that supports people recovering from addiction. We know how sensitive the information you keep in it is, so we collect only what the app needs to work. We show no ads, use no analytics or tracking tools, and never sell anyone's data.

This policy covers the Deloop mobile app and the deloop.me website. If the Polish and English versions differ, the Polish version prevails.

1. Data controller

The controller of your personal data is [NAZWA FIRMY], [ADRES SIEDZIBY], tax ID [NIP]. For any privacy matter, contact us at [email protected].

2. What data we process

Account

• email address and password (stored only as a secure hash),
• username, optional “About me” text, avatar (generated or a photo you upload),
• your chosen app language.

Your username doesn't have to be your real name — we encourage you to stay anonymous.

Your progress (health data)

• what you are quitting (e.g. “alcohol”), your start date, history of periods and relapses,
• gratitude journal entries,
• average spending used to calculate your savings,
• tasks and suggestions, and which of them you complete.

Information about addiction and sobriety is health data, a special category of personal data. We process it only on the basis of your explicit consent, which you give by creating an account and saving this information in the app.

Contacts, connections and chat

• your contacts and invitations,
• your connections with other users and what you choose to share with them (counter, history, gratitude, tasks),
• chat messages and groups,
• phone number — only if you provide it; visible only to your accepted contacts and only once you turn sharing on.

Content you submit

• meetings and library materials you submit — after review they may become visible to other users (without showing who submitted them).

Notifications

• your device's push notification identifier (token) and notification settings,
• in-app notification history.

Location

If you allow it, the app reads your phone's approximate location once to sort meetings by distance. The location is sent only to calculate distances — we do not store it and we do not track where you are. You can revoke this permission at any time in your phone settings.

Technical data

Our infrastructure providers automatically keep basic technical logs (e.g. IP address, request time) needed for security and troubleshooting. They are kept for a short time and are not used for profiling.

3. Purposes and legal bases

• Running your account and the app (counter, journal, chat, connections) — performance of a contract (Art. 6(1)(b) GDPR).
• Health data — your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time by deleting this data or your whole account.
• Location and push notifications — your consent given in your phone's system settings (Art. 6(1)(a) GDPR).
• Security, abuse prevention and moderation of submissions — our legitimate interest (Art. 6(1)(f) GDPR).

4. Who can see your data

• By default, only you. Your progress, journal and spending are private.
• Other users can find you by username and see your avatar.
• Accepted contacts can see your profile and — if you turn it on — your phone number.
• A person you connect with sees only what you select when connecting. You can change this or disconnect.
• Chat messages are visible to the participants of that conversation.

We do not sell data and do not share it with advertisers.

5. Service providers

We use trusted providers who process data only on our instructions:

• Supabase — database, sign-in and file storage (avatars). Data is stored on servers in the European Union (Frankfurt).
• Expo (650 Industries, Inc.) — push notification delivery. We share only the device token and the notification content.
• Google (Firebase Cloud Messaging) — delivering push notifications to Android devices.
• DiceBear — generating a default avatar from a random string (no personal data).

Where data is transferred outside the European Economic Area (e.g. to the USA), this is based on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

Library materials (e.g. YouTube videos, websites of support organisations) and navigation to meetings in Google Maps open external services that follow their own privacy policies.

6. How long we keep data

We keep your data for as long as you have an account. After you delete your account, we erase your data within 30 days, including backups. Messages you sent to others are deleted together with your account. Meetings and materials you submitted that were approved may remain in the app as anonymous content.

7. Your rights

You have the right to:

• access your data and receive a copy,
• rectify your data,
• erasure (“the right to be forgotten”),
• restrict processing and object to it,
• data portability,
• withdraw consent at any time — without affecting the lawfulness of processing before withdrawal,
• lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw), or the authority in your country of residence.

To exercise these rights, write to [email protected]. We will reply within 30 days.

8. Deleting your account

You can delete your account and all related data. See Delete your account for instructions.

9. Security

Connections to the app are encrypted (TLS). Database access rules allow each user to read only their own data and what others have deliberately shared with them. Passwords are stored only as hashes.

10. Minors

The app is intended for people aged 18 and over.

11. The deloop.me website

The website uses no cookies, analytics or third-party scripts. Fonts and media are served from our own server.

12. Changes to this policy

If we change this policy, we will publish the new version on this page and let you know about significant changes in the app.

Deloop is an independent app and does not replace medical help or therapy. If you are in crisis, contact a professional or call your local emergency number (112 in the EU).