Privacy Policy
Effective June 24, 2026
1. Who controls your data
StimuStop is a web and mobile application for tracking addiction recovery, operated as a personal project by Alexandr Rešetňak (Czech Republic), acting as the data controller. For any questions about the processing of your personal data, contact us at support@stimustop.com.
2. What data we process
We process only the data necessary for the app to function:
- Email address and password (stored only as a bcrypt hash)
- Addiction records, quit date and time
- Journal entries and their content
- Relapse records
- Profile settings and preferences (language, reminders)
- Private messages between community members and content reports (including the reason)
- With Sign in with Apple: the identifier assigned by Apple and your email (or Apple's private relay address)
- With a Premium purchase in the iPhone app: the transaction identifier and subscription status (valid until). We never see payment details; Apple processes them.
- A device token for push notifications (only if you enable them in the iPhone app)
- Technical data needed for operation and security (IP address, browser and device type) — processed via analytics and error monitoring, see sections 5 and 6
3. How and on what legal basis we use your data
- Providing the service (streaks, milestones, journal, statistics) — performance of a contract, Art. 6(1)(b) GDPR.
- Operation, security and bug fixing — our legitimate interest, Art. 6(1)(f) GDPR.
- Anonymized traffic analytics (Google Analytics) — only with your consent, Art. 6(1)(a) GDPR.
We never sell your data or use it for targeted advertising.
4. Community and public sharing
Your profile and addiction records are private by default. Sharing to the community is explicitly opt-in and can be turned off at any time in the habit settings.
5. Cookies and analytics
Without your consent we use only essential session cookies required for login and core functionality. Once you grant consent in the cookie banner, we measure anonymized traffic using Google Analytics (with IP anonymization and Consent Mode v2). You can change or withdraw your consent at any time via .
6. Processors and third parties
We rely on the following processors to run the app:
- Google (Google Analytics) — anonymized traffic statistics; data may be transferred to the USA under standard contractual clauses. Active only with your consent.
- Sentry — application error monitoring to keep the service stable (no personal data submitted through forms is sent).
- Email service provider — sending transactional emails (address verification, reminders).
- Hosting provider — running our servers and database.
- Apple — distributing the iPhone app, processing Premium payments (App Store) and delivering push notifications (APNs). Apple acts as an independent controller under its own privacy policy.
These processors handle data only to the extent necessary and under a data processing agreement.
7. Data retention
We keep your data for as long as your account exists. When you delete your account, all associated data is permanently removed. Analytics data is retained for the period configured in Google Analytics.
8. Your rights (GDPR)
You have the right to access, rectify, erase, restrict processing of, and port your data, to object to processing, and to withdraw consent at any time. You can delete your account and all associated data at any time in profile settings. For other requests, contact us at support@stimustop.com. You also have the right to lodge a complaint with the supervisory authority — the Czech Data Protection Authority (ÚOOÚ).
9. Security
Data is stored on secured servers. All connections are encrypted via HTTPS. Passwords are stored exclusively as bcrypt hashes.
10. Changes to this policy
We will notify you of any material changes via email or an in-app notice.