Skip to content
STIMU/STOP

Privacy Policy

Effective September 25, 2026

1. Who controls your data

StimuStop is a web and mobile application for tracking addiction recovery, operated as a personal project by Alexandr Rešetňak (Czech Republic), acting as the data controller. For any questions about the processing of your personal data, contact us at support@stimustop.com.

2. What data we process

We process only the data necessary for the app to function:

  • Email address and password (stored only as a bcrypt hash)
  • Addiction records, quit date and time
  • Journal entries and their content
  • Relapse records
  • Profile settings and preferences (language, reminders)
  • Private messages between community members and content reports (including the reason)
  • With Sign in with Apple: the identifier Apple assigns to you, your email (or Apple's relay address if you hide it) and, on the first sign-in, your name if you choose to share it. We also keep a token from Apple whose only use is revoking the Sign in with Apple authorization when you delete your account. It is stored encrypted.
  • With a Premium purchase in the iPhone app (an auto-renewing subscription or a one-time lifetime purchase): the transaction identifier, the product bought and the entitlement status (valid until). We never see payment details; Apple processes them.
  • A device token for push notifications (only if you enable them in the iPhone app)
  • Technical data needed for operation and security (IP address, browser and device type) — processed via analytics and error monitoring, see sections 5 and 6

3. How and on what legal basis we use your data

  • Providing the service (streaks, milestones, journal, statistics) — performance of a contract, Art. 6(1)(b) GDPR.
  • Operation, security and bug fixing — our legitimate interest, Art. 6(1)(f) GDPR.
  • Anonymized traffic analytics (Google Analytics) — only with your consent, Art. 6(1)(a) GDPR.

We never sell your data or use it for targeted advertising.

4. Community and public sharing

Your profile and addiction records are private by default. Sharing to the community is explicitly opt-in and can be turned off at any time in the habit settings.

4a. Apple Health

After a breathing exercise in SOS mode, the iPhone app can write its length to Apple Health as Mindful Minutes. This stays off until you allow it, and you can revoke access at any time in the Health app settings. We never read anything from Apple Health. Health data is not sent to our servers, used for advertising or shared with anyone.

5. Cookies and analytics

Without your consent we use only essential session cookies required for login and core functionality. Once you grant consent in the cookie banner, we measure anonymized traffic using Google Analytics (with IP anonymization and Consent Mode v2). You can change or withdraw your consent at any time via .

6. Processors and third parties

We rely on the following processors to run the app:

  • Google (Google Analytics) — anonymized traffic statistics; data may be transferred to the USA under standard contractual clauses. Active only with your consent.
  • Sentry — application error monitoring to keep the service stable (no personal data submitted through forms is sent).
  • Email service provider — sending transactional emails (address verification, reminders).
  • Hosting provider — running our servers and database.
  • Apple — distributing the iPhone app, Sign in with Apple, processing Premium payments (App Store) and delivering push notifications (APNs). Apple acts as an independent controller under its own privacy policy.

These processors handle data only to the extent necessary and under a data processing agreement.

7. Data retention

We keep your data for as long as your account exists. When you delete your account, all associated data is permanently removed, and if you used Sign in with Apple we also revoke its authorization with Apple. See Delete your account for how it works. Analytics data is retained for the period configured in Google Analytics.

8. Your rights (GDPR)

You have the right to access, rectify, erase, restrict processing of, and port your data, to object to processing, and to withdraw consent at any time. You can delete your account and all associated data at any time in the app, in your profile settings on the web or by email, see Delete your account. For other requests, contact us at support@stimustop.com. You also have the right to lodge a complaint with the supervisory authority — the Czech Data Protection Authority (ÚOOÚ).

9. Security

Data is stored on secured servers. All connections are encrypted via HTTPS. Passwords are stored exclusively as bcrypt hashes.

10. Changes to this policy

We will notify you of any material changes via email or an in-app notice.

Back to home