Privacy Policy

This policy explains what personal data UnLoop (“we”, “us”, the “app”) collects, why, and the choices you have. We built UnLoop to change something that has been stuck — that only works if you trust us with honest, sometimes very personal information, so we try to be equally honest here.

The data controller is [LEGAL ENTITY / YOUR NAME], [ADDRESS], contact [CONTACT EMAIL].

What we collect

• Account data — your email, a display name, and a hashed password (managed by our auth provider; we never see your plaintext password).
• What you tell the Companion — your onboarding answers and every message you send in chat, including free text about your goals, struggles, and feelings.
• Check-ins & tracking — mood, sleep, energy, stress, habit taps, urges, and anything else you choose to log.
• Sensitive information you volunteer — depending on your goals this may include data about mental health, sexual behaviour, or substance use and other addictions. You decide what to share, and you can delete any of it, or your whole account, at any time.
• Derived data — patterns, scores, and a rolling AI-generated summary we compute from the above to personalise the coaching.
• Technical data — your timezone, push-notification subscription (if you enable it), and basic request logs needed to run and secure the service.

Why we use it, and our legal basis

• To provide the service (personalised coaching, check-ins, reminders) — this is performance of our contract with you.
• To send you notifications you've enabled — based on your consent, which you can withdraw in Settings.
• To keep the service safe and working (security, debugging, abuse prevention) — our legitimate interest.
• Where you share special-category data (e.g. health, sexual behaviour), we process it based on your explicit consent (GDPR Art. 9(2)(a)), which you give by ticking the consent box when you create your account. We record when you gave it. You can withdraw it at any time by deleting the data or your account.

AI processing

Your messages and the relevant context (for example your recent check-ins and goals) are sent to our AI providers to generate the Companion's replies, your plan, notifications and insights. We use two: Anthropic (Claude models) for the most important replies, and OpenAI for everyday replies and notifications. We send the minimum needed for each feature. Both process your data as our processors under contract, and under their API terms neither uses it to train their models. We never use your data to train AI models ourselves.

From what you log and write, the app builds a picture of your patterns — for example the hour you tend to slip — to decide what to say and when. This shapes coaching only; it is never used to make decisions with legal or similarly significant effects on you. AI output can be wrong — see our Terms.

Who we share it with

We don't sell your data. We use a small set of processors to run the app:

• Supabase — database, authentication, storage.
• Vercel — hosting and delivery.
• Anthropic and OpenAI — AI model processing (as above).
• Your browser's push service (Google, Apple or Mozilla, depending on your device) — only to deliver the notifications you enable. The notification text passes through it.

Some processors may process data outside your country; where they do, we rely on appropriate safeguards (such as standard contractual clauses).

If the business changes hands

If UnLoop is ever sold, merged, or has its assets acquired — in whole or in part — your account and the data described above may transfer to the new owner as part of that service, along with any due-diligence disclosure reasonably needed to get there (kept confidential and minimised). The new owner would be bound by this policy until they give you notice of a different one, and you would be told before anything material changes. If you would rather not come along, you can delete your account and your data at any point, including after that notice.

We do not sell, rent, or licence your data as a product on its own, and a transfer of the business is the only circumstance in which it moves to anyone other than the processors listed above.

How long we keep it

We keep your data while your account is active. If you delete your account (Settings → Danger zone), we erase your personal data across our systems and delete your account straight away. Backups and legally-required logs may persist for a short, limited period before rotating out.

Your rights

Under the GDPR and similar laws you can: access your data, correct it, delete it, restrict or object to processing, withdraw consent, and request a portable copy. You can delete everything yourself in Settings, or contact us at [CONTACT EMAIL]. You also have the right to complain to your local data-protection authority.

Security

Data is encrypted in transit, access is restricted, and passwords are hashed by our auth provider. No system is perfectly secure, but we take reasonable measures to protect sensitive information.

Children

UnLoop is not intended for anyone under 16 (or the minimum age in your country). We don't knowingly collect data from children.

Cookies & local storage

We use essential cookies for sign-in sessions and local storage on your device to remember drafts and preferences. We don't use advertising trackers.

Changes

We'll update this policy as the app evolves and note the date above. Material changes will be communicated in-app or by email.

Contact

Questions or requests: [CONTACT EMAIL].