Privacy Policy

1. Data We Collect & Why

Account data (provided by you)

• Email address — used to create and sign in to your account via Supabase Authentication (or, if you choose, via Sign in with Apple, in which case Apple relays only what you approve).
• First name (optional) — used to personalise your experience (e.g. “Good morning, Alex”).
• Whether your subscription is active — copied from the App Store so we can help if something goes wrong with your access.

Your plan (from onboarding)

The overthinking pattern your onboarding answers point to, a score per pattern, and when your mind tends to be loudest — used to tailor your plan and suggestions. Stored in Supabase under your account. The answers themselves stay on your phone.

Your progress

Which journey or short programme you’re on, which days you’ve completed and when, and a streak count — so your progress comes back if you reinstall the app or change phones. Stored in Supabase under your account.

Usage events

Which screens you view and which options you tap — for example, the answer you picked in onboarding, a tool you finished, or whether you marked a challenge as done. Never anything you type. Each event carries a random install ID and, when you’re signed in, your account ID. We use them to understand what helps and to improve the app. Stored in Supabase.

What is never stored on our servers

Legal basis (GDPR)

Processing is based on performance of contract (Art. 6(1)(b)) — we need this data to deliver the service you signed up for — and legitimate interests (Art. 6(1)(f)) for service reliability and app improvement, which never override your rights.

2. What Stays on Your Phone

Most of Overthinkr works on your device and never uploads what you do. Kept only on your phone:

• Your onboarding answers.
• Your activity history — what kind of thing you did and when (for example “a tool” or “a daily reset”), never any text.
• Each day’s three things and which ones you ticked, the habits you keep, and the challenges you finish.
• Your “How’s your mind?” check-ins, your Calm Kit, milestones and weekly check-in answers.
• Thought Dumps you choose to save with “Save” — nothing is kept unless you do.
• What your widgets show — today’s day and its three things, shared with the widget on your phone only. The lock-screen widget never shows what the things are.

This data is deleted when you sign out or delete your account, and your widgets are cleared. Saved thoughts can be removed one by one or all at once (Settings → Privacy). Because it lives on your device, it moves with your own iPhone backups (iCloud or Quick Start), but we don’t sync it — a new phone set up without a backup starts fresh, apart from your progress (Section 1).

Safety check on your device

Before anything you write is saved or sent, your phone checks it for signs of crisis. If it finds any, nothing is saved or sent, and you’re shown support options instead. This check happens entirely on your device.

3. How We Use Your Data

We use your data only to operate and improve Overthinkr:

• Personalisation — your name, your plan, and suggestions that fit when your mind gets loudest.
• Restoring progress — keeping your journey days if you reinstall or change phones.
• Untangle — processing the one text you choose to send (see Section 4).
• Improving the app — understanding, from usage events, which parts help people.
• Subscription management — verifying your premium access via RevenueCat.
• Ad campaign measurement — the Meta (Facebook) SDK reports anonymous app events (install, app open, in-app purchase) so we can tell whether our ads on Meta platforms work. This is based on our legitimate interest (Art. 6(1)(f)) in measuring our advertising. See Sections 5 and 12 for exactly what Meta receives — and what it never receives.

4. AI Disclosure — Untangle

Overthinkr uses Anthropic’s Claude AI model for one feature: Untangle. Daily resets, challenges, tools and Thought Dump work without any AI.

What happens when you use Untangle

• When you tap “Untangle it”, the text you typed (up to 400 characters), the topic you picked and, as background, the kinds of loop your onboarding answers pointed to (labels such as “replaying” — never your answers themselves) are sent through our server to Anthropic’s API, which returns a structured page for you.
• This means that text leaves your device for that one request.
• We do not store your text or the response on our servers. The only thing kept — on your phone — is which kind of loop it was (for example “replaying”), as a count.
• Anthropic does not use API data to train its models. It may retain request data for a limited period for trust-and-safety monitoring, under its own policies.
• Before anything is sent, your phone runs the safety check described in Section 2. If it finds signs of crisis, nothing is sent.
• To prevent abuse, our server counts how many Untangle requests an account makes — the count, never the content.

5. Third-Party Services

We use the following services. Each has its own privacy policy:

Apart from the Meta SDK, we don’t use third-party analytics SDKs — our own usage events stay in our Supabase database — and we never share data with data brokers.

6. Data Storage & Security

On our servers

Server-side data (account, plan, progress, usage events) is stored in Supabase (PostgreSQL) on AWS in Frankfurt, EU (eu-central-1), so it stays within the European Union.

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256.
• Row-Level Security means your records are only accessible by your own signed-in account.
• We collect only what the app needs.
• Access to production systems is restricted to authorised personnel.

On your phone

Data kept on your device (Section 2) stays inside the app’s own storage, protected by iOS. It’s included in your device backups and removed when you delete the app, sign out or delete your account.

7. Your GDPR Rights

As a user based in or protected by EU law, you have the following rights under the General Data Protection Regulation (GDPR):

8. Data Retention & Deletion

Active accounts

We keep your account data for as long as your account is active.

Account deletion

You can delete your account at any time in the app — You → Settings → Delete account — or by emailing hello@yakobeen.com. When you do:

• Your Supabase account is permanently deleted immediately, together with everything linked to it: your profile and plan, your progress and streak — and, if you used an earlier version of Overthinkr, any entries saved from it (such as thought dumps, worries, check-ins or coach messages).
• Everything kept on your phone (Section 2) is erased at the same time, and your widgets are cleared.
• Usage events lose their link to your account; only the random install ID stays with them.
• Backups may retain data for up to 90 days after deletion for disaster recovery, after which they are purged.
• Deleting your account doesn’t cancel your App Store subscription — Apple bills it, so cancel it in Settings → Apple ID → Subscriptions (or Manage subscription in the app).

Inactive accounts

If your account has been inactive for 24 consecutive months, we may send a notice and then delete the account if we receive no response.

Data export

You can request an export of the data we hold about you by emailing hello@yakobeen.com. We will deliver it within 30 days in JSON format.

9. Children’s Privacy

Overthinkr is not intended for children under the age of 13, and we do not knowingly collect personal information from anyone under 13.

If you are a parent or guardian and believe your child under 13 has created an account or provided personal information, please contact us immediately at hello@yakobeen.com. We will promptly investigate and delete the account and all associated data.

Users between 13 and 18 should use Overthinkr with parental awareness. The app contains content related to anxiety and stress, which may not be appropriate for all young users.

10. International Data Transfers

Overthinkr is operated from Poland (EU). Your server-side data is stored in the EU (Supabase, Frankfurt).

Some third-party services (Anthropic — for Untangle requests only — RevenueCat, Apple and Meta) are US-based. Where data is transferred outside the EU, we rely on:

• Standard Contractual Clauses (SCCs) — the EU Commission’s approved legal mechanism for international data transfers.
• The EU-US Data Privacy Framework, where the provider is certified.

We only use services that provide adequate data protection guarantees for EU personal data.

11. Notifications

Reminders are scheduled on your phone as local notifications — at most one a day, at the time you choose. Their content never includes anything you wrote. You can turn them off in Settings or in iOS Settings at any time.

12. Cookies & Tracking

Overthinkr is a native iOS application and does not use browser cookies.

The app uses:

• App user ID — a pseudonymous identifier passed to RevenueCat solely to verify and manage your subscription.
• Install ID — a random identifier attached to our own usage events (Section 1), which resets if you reinstall the app.
• Meta SDK app events — anonymous events (install, app open, purchase) with basic device information, sent to Meta only to measure our own ad campaigns (see Section 5). Never your content or identity.

We do not use the iOS advertising identifier (IDFA) and do not show the App Tracking Transparency prompt — we do not track you across other apps or websites. Ad measurement relies on Apple’s privacy-preserving SKAdNetwork framework instead.

13. Changes to This Policy

We may update this Privacy Policy as the app evolves, as we add new features, or as legal requirements change.

When we make significant changes, we will:

• Update the “Effective date” at the top of this policy.
• Tell you in the app if the changes materially affect how we use your data.

Continued use of Overthinkr after the effective date of a revised policy means you accept the changes.

The current version is always available in the app, in You → Settings → Privacy Policy.