Privacy Policy

1. Who controls your data

StimuStop is a web and mobile application for tracking addiction recovery, operated as a personal project by Alexandr Rešetňak (Czech Republic), acting as the data controller. For any questions about the processing of your personal data, contact us at support@stimustop.com.

2. What data we process

We process only the data necessary for the app to function:

• Email address and password (stored only as a bcrypt hash)
• Addiction records, quit date and time
• Journal entries and their content
• Relapse records
• Profile settings and preferences (language, reminders)
• Technical data needed for operation and security (IP address, browser and device type) — processed via analytics and error monitoring, see sections 5 and 6

3. How and on what legal basis we use your data

• Providing the service (streaks, milestones, journal, statistics) — performance of a contract, Art. 6(1)(b) GDPR.
• Operation, security and bug fixing — our legitimate interest, Art. 6(1)(f) GDPR.
• Anonymised traffic analytics (Google Analytics) — only with your consent, Art. 6(1)(a) GDPR.

We never sell your data or use it for targeted advertising.

4. Community and public sharing

Your profile and addiction records are private by default. Sharing to the community is explicitly opt-in and can be turned off at any time in the habit settings.

5. Cookies and analytics

Without your consent we use only essential session cookies required for login and core functionality. Once you grant consent in the cookie banner, we measure anonymised traffic using Google Analytics (with IP anonymisation and Consent Mode v2). You can change or withdraw your consent at any time via Cookie settings.

6. Processors and third parties

We rely on the following processors to run the app:

• Google (Google Analytics) — anonymised traffic statistics; data may be transferred to the USA under standard contractual clauses. Active only with your consent.
• Sentry — application error monitoring to keep the service stable (no personal data submitted through forms is sent).
• Email service provider — sending transactional emails (address verification, reminders).
• Hosting provider — running our servers and database.

These processors handle data only to the extent necessary and under a data processing agreement.

7. Data retention

We keep your data for as long as your account exists. When you delete your account, all associated data is permanently removed. Analytics data is retained for the period configured in Google Analytics.

8. Your rights (GDPR)

You have the right to access, rectify, erase, restrict processing of, and port your data, to object to processing, and to withdraw consent at any time. You can delete your account and all associated data at any time in profile settings. For other requests, contact us at support@stimustop.com. You also have the right to lodge a complaint with the supervisory authority — the Czech Data Protection Authority (ÚOOÚ).

9. Security

Data is stored on secured servers. All connections are encrypted via HTTPS. Passwords are stored exclusively as bcrypt hashes.

10. Changes to this policy

We will notify you of any material changes via email or an in-app notice.