Privacy Policy

This Privacy Policy explains how UpliftBuddy (“we”, “us”) collects, uses, shares and protects information when you use the UpliftBuddy Android app, the web app and the website at upliftbuddy.com (together, the “Service”). We collect the minimum we need, we never sell your data, and we show no ads in the app. Contact: support@upliftbuddy.com.

Adults only (18+): UpliftBuddy is designed for adults and isn’t intended for anyone under 18. We don’t knowingly collect data from minors; if we find that an account belongs to someone under 18, we close it and delete its data.

1. Information we collect

• Account and profile: name, email, password hash (or Google sign-in information where used), age range or age-confirmation information, optional profile details, account-verification status and one-time sign-in codes.
• Recovery assessment: answers you submit about pornography-use habits, frequency, session duration, self-reported effects on daily life, triggers, motivation, goals and other onboarding questions. These answers are used to generate your Personal Recovery Assessment and establish your starting point.
• Recovery activity: your selected Ladder or Desert approach, daily check-ins, urge and mood information, habits, EARN activities, journal entries and optional notes, points, streaks and progress records.
• Membership and billing: whether your membership is active, its plan, renewal and cancellation dates, the reference IDs our payment providers give us (for example a Dodo Payments subscription ID), and any cancellation reason you choose to give. We do not receive your card or bank details. While UpliftBuddy is free of charge, no payment information is collected.
• Iro (AI coach): a daily message count (no message content), and, only if you report an Iro reply, that reply and your optional reason. See Section 4.
• Technical and security information: IP addresses, device/browser information, login and request timestamps, diagnostic and security logs where generated.
• Website analytics: Google Analytics may use cookies and similar technologies on our website, including pages displaying these policies. See Section 5.
• Approved test accounts: the email addresses of verified accounts we approve for testing or store-review access.

Some assessment and journal information is sensitive. Please share only what you’re comfortable with, and feel free to skip any field marked optional. We never ask for access to your contacts, camera, microphone, photo library or precise location.

2. App permissions (Android)

• Internet — to sync your account with our servers.
• Notifications (optional) — for the daily check-in reminder you can switch on or off in Settings. Reminders are scheduled on your device and use neutral wording.
• Run at startup — only so your reminder still fires after the phone restarts.

3. How we use information

• Generate your Personal Recovery Assessment from the answers you provide. The report is a self-reflection summary, not an addiction diagnosis or clinically validated severity score. Your assessment, recovery plan, insights and progress score are calculated by our own rule-based logic, not by AI.
• Provide your chosen Ladder or Desert approach, daily check-ins, private journal, habits, progress tracking, points and streaks, and Iro.
• Manage your membership: confirm your purchase with Dodo Payments, apply renewals and cancellations, and answer billing questions.
• Maintain your account, authenticate sign-ins, respond to support requests, prevent abuse and troubleshoot the Service.
• Send essential account messages, including verification codes, password resets, purchase and cancellation confirmations, and inactivity notices.
• Understand website usage through website analytics.

We do not sell personal recovery entries or use them to build advertising profiles.

4. Iro, the AI coach

Iro is not yet available. It will be introduced in a future release. At present, no content that you enter in UpliftBuddy is sent to OpenAI or any other AI service. This section describes how Iro will handle your chats once it is released.

Once released, Iro will be available to members, with a planned limit of up to 30 messages a day. It will be powered by OpenAI, which will act as our service provider.

• What is sent: when you send a message, the text of your current chat (your recent messages and Iro’s replies, limited in length) is sent to OpenAI through its API, along with our fixed instructions for the coach, so a reply can be generated.
• What is not sent: Iro does not receive your name, email, check-ins, journal, habits, assessment answers or recovery plan. It only knows what you type in the chat. Please avoid including names or identifying details in your messages.
• What we store: your conversation is kept on your device while the chat is open and is not stored on our servers. We keep only a daily message count (without content) to apply the daily limit.
• Safety: if a message appears to show you may be in crisis, our safety check replies with a pre-written supportive message and help-line guidance, and that message is not sent to the AI. This check is not perfect, and Iro is not a crisis service.
• Reporting a reply: if you tap Report on an Iro reply, we keep only that reply (encrypted) and your optional reason so we can review it — never the rest of the conversation.
• Provider handling: OpenAI processes this data under its API terms, and we do not permit its use for advertising. See OpenAI’s own policies for how it handles API data, including any limited retention for safety and abuse monitoring.

5. Who we share information with

To operate UpliftBuddy, information is processed by service providers acting on our behalf:

• cloud hosting and database providers (including Railway for our servers) and Google Firebase Hosting for the website;
• OpenAI for Iro (see Section 4);
• Resend for sending account and billing emails;
• Dodo Payments for payments, on the website and in the Android app — it handles your payment details; we do not;
• Google when you choose Google sign-in or visit pages that use Google Analytics.

Provider processing is subject to the applicable provider terms and our configurations. If you deliberately share a journal entry, it may be visible to other members (see Section 6). We may also disclose information where legally required or necessary to protect users and the Service. We do not sell your recovery information to advertisers.

6. Sharing journal entries (optional)

Journal entries are private to your account unless you deliberately choose to share one. If you do, the entry may appear in a community feed under an anonymous alias — never your name or email — and may be viewed, reacted to or reported by other members, who can also block each other. We apply automatic checks (for example, we block @handles and entries that suggest a crisis), and shared entries may be removed by us or hidden after reports. Avoid including your name, contact details or information about other people. Turning sharing off stops future display but cannot retract copies someone else may already have made.

7. Security

• We use HTTPS for communication with our servers.
• Your journal entries, check-in notes and urge notes (and any reported Iro reply) are encrypted at the application level before they are stored.
• Passwords are stored only as one-way hashes, and access to our administrative tools requires authentication.
• No security measure is infallible. Please avoid sharing sensitive screenshots or public journal entries containing identifying details.

8. Data retention

• Active accounts: account and recovery records are kept while needed to operate your account, unless you delete them or retention obligations apply.
• Inactive accounts: accounts with no activity for 120 days are deleted automatically together with their data (active subscribers excepted). We email you 7 days beforehand so you can keep your account by signing in.
• Logs and backups: operational logs and backup copies may remain for a limited period set by our hosting providers before they are rotated out.
• Billing records: Dodo Payments keeps transaction records as required for accounting, disputes or law.

9. Deleting your account and data

In the app, go to Settings → Account deletion → Delete account. You can also email support@upliftbuddy.com from your registered address. Deleting your account removes your profile and associated recovery records from our active systems, subject to legal retention requirements, provider records and normal backup rotation. If you give a reason for leaving, we keep it anonymously, not linked to you. If you have a membership, it is removed with your account — any time left in the period you paid for is lost and is not refunded — and we cancel your renewal so you are not billed again. If you only want to stop paying, cancel your membership instead.

10. Your rights and choices

• Access and correction: view and edit your information in the app, or ask us.
• Deletion: see Section 9.
• Marketing emails: we send essential account emails; unsubscribe from any update email, or tell us.
• Notifications: switch reminders off in the app or in your phone’s settings.
• Complaints: contact us first; you may also complain to your local data-protection authority.

We aim to handle personal information in accordance with applicable data-protection requirements. You may contact us about access, correction, deletion or privacy concerns.

11. International processing

Our service providers may process information in countries other than your own. Wherever it is processed, this policy and our providers’ contractual commitments continue to apply.

12. Changes to this policy

We will post any changes on this page and update the date above. For material changes we will also notify you by email or in the app before they take effect.

13. Contact

UpliftBuddy · support@upliftbuddy.com