Privacy Policy

1. Who we are & what the app is

Overthinkr is a self-help iOS app for managing overthinking. It gives you CBT-style tools, an AI coach called Milo, and a daily recovery plan. This policy is provided by Jakub Radziejewski, Kraków, Poland (“we”, “us”), and covers both the Overthinkr iOS app and this website, overthinkr.me.

We built Overthinkr to be private by design. We collect only what we need to run the service and personalise it for you, and we treat the thoughts and worries you write as sensitive. We do not sell your data, we do not use it for advertising, and we do not share it beyond the processors listed in this policy that we rely on to run the app.

2. Information we collect

Here is everything we collect, grouped by type, along with why we collect it.

Account & sign-in

• You sign in with Sign in with Apple. Apple gives us an anonymous user identifier; your email address may be hidden or relayed by Apple, so we may never see your real address.
• Why: to create your account and sync your data securely across sessions and devices.

Onboarding quiz & profile

• Your answers to the onboarding quiz: overthinking type, frequency, time of day, duration, affected life areas, your goal, and approaches you’ve tried — plus your first name.
• A derived Overthinkr Score, calculated from your quiz answers.
• Why: to personalise your recovery plan and the AI coach. Stored in your account.

Your entries & reflections

• Thought Dumps — free-text notes about what’s on your mind. This text is sent to an AI language model (through our secure backend) to return a category and a reframe, then stored in your account.
• Worry Vault entries — the worry text, a severity rating, and a status (pending, didn’t happen, came true, or still worried). Stored in your account.
• Task reflections — short free-text reflections you write from plan tasks. Stored in your account.
• Milo chat messages — your messages to the AI coach are sent to an AI language model (through our secure backend) to generate replies, and stored so you can see your history.
• Why: to give you the app’s core features and keep your history available to you.

Usage data

• Streaks, activity counts (such as thought dumps and panic-button uses), and plan progress.
• Why: to power your progress tracking and streaks. Stored in your account and on your device.

Product analytics

• Anonymous onboarding funnel events — which onboarding step you reached — tied to a random per-install identifier that is not linked to your identity.
• Why: to understand where people get stuck during onboarding so we can improve it. See Section 6 for our no-tracking-SDK promise.

Subscriptions

• Purchases are processed by Apple and managed via RevenueCat, which processes your subscription and receipt data. We never see or store your payment card details.
• Why: to know whether you’re a paying subscriber and unlock the right features.

Our legal bases (GDPR)

• Contract performance (Art. 6(1)(b)) — for your account, quiz answers and score, your entries and reflections, Milo chat, usage data, and subscription status. Without these we can’t provide the app.
• Legitimate interests (Art. 6(1)(f)) — for the anonymous onboarding funnel analytics described in Section 6, so we can improve onboarding. This data is not linked to your identity.

3. How AI processes your text

Two features rely on an AI language model: Thought Dumps and the Milo coach. We use Anthropic’s Claude (the Haiku model) for both.

• When you write a Thought Dump, the text is sent — through our secure backend — to Anthropic to generate a category and a reframe.
• When you message Milo, your message is sent — through our secure backend — to Anthropic to generate a reply.
• Anthropic processes this content only to generate those responses and return them to us. Under Anthropic’s commercial terms, your content is not used to train their models.

A few important limits

• Milo is not a licensed therapist, psychologist, or medical professional.
• Its responses are AI-generated and may not always be accurate or appropriate.
• Milo is not a substitute for professional mental health care. If you are in crisis, please contact a qualified professional or your local emergency services.

Crisis-content detection

To help keep you safe, the app scans text you type (in Thought Dumps and Milo chat) against a keyword list to detect crisis language and, if it finds any, show crisis-support resources. This check happens on your device — it does not send your text anywhere for that purpose.

4. How we store and protect your data

Where your data is stored

• Your account and content are stored in our Supabase database, hosted on AWS in the eu-central-1 region (Frankfurt, Germany).
• Your data is stored within the European Union.

How we protect it

• Encryption in transit: data moving between the app, our backend, and our processors is protected in transit (HTTPS/TLS).
• Access-controlled backend: your data is protected by authentication and access controls so that you can only access your own data.
• We limit access to your data to what’s needed to run and support the service.

5. Third parties & sub-processors

We rely on a small number of trusted providers to run the service. We share data with them only as needed to operate Overthinkr — never for their own advertising.

6. Analytics & our no-tracking-SDK promise

Our product analytics are first-party and minimal. We record anonymous onboarding funnel events — which onboarding step you reached — tied to a random per-install identifier that is not linked to your identity.

7. Keeping and deleting your data

How long we keep it

• Your account, profile, and content (thought dumps, worry vault, task reflections, Milo chat history) are kept for as long as your account exists.
• The local cache on your device is cleared when you sign out.

Deleting your account — directly in the app

Deleting your account does not automatically cancel an active subscription — subscriptions are billed by Apple, so please cancel it in your Apple ID subscription settings.

Or ask us by email

If you’d rather we do it, email hello@overthinkr.me with the subject line “Data Deletion Request” and we’ll take care of it. You can also request a copy of your data by emailing us with the subject line “Data Export Request”.

8. Children

Overthinkr is not directed at children under 13, and the app is rated for a mature audience.

• We do not knowingly collect personal data from children under 13.
• If you believe a child has provided us with personal data, please contact us at hello@overthinkr.me and we will delete it.

9. Your rights

You have rights over your personal data. If you’re in the EU or UK, these are guaranteed by the GDPR:

10. Where your data is processed

Your account and content are stored in the European Union (Supabase on AWS eu-central-1, Frankfurt).

Some of our providers — Anthropic, RevenueCat, and Apple — process data in the United States. For those transfers we rely on the European Commission’s Standard Contractual Clauses (SCCs) or equivalent safeguards offered by those providers under GDPR Chapter V.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make a material change, we’ll update the “Effective” and “Last updated” dates at the top of this page and, where appropriate, let you know in the app.

Effective date: 16 July 2026.

12. Contact us