Privacy

Who we are

Sober Oktober is run by SINGULAR IT · tudor@deepbite.io. We are the controller of the personal data described here. Questions or requests: email us.

What we collect

• Account: the email address, name and profile picture link your Google account shares when you sign in (or the equivalent from Sign in with Apple).
• Your habits: the habits you choose (for example alcohol, cigarettes, sugar or exercise), your daily check-ins and amounts, and your goals.
• Optional connections: if you connect Strava we store the access tokens Strava gives us and use your run, ride and walk distances to fill in challenges you chose. If you send Apple Health totals through a Shortcut, we store those totals as check-ins, plus a hashed secret token (we never keep the token itself).
• On your device: a sign-in session cookie, and a small counter for the pre-October “farewell tally” in your browser's local storage. Reminders in the iPhone app are scheduled on your phone and are not sent to us.

Health-related information

What you track can reveal information about your health or habits. We use it only to run the app for you, and we handle it on the basis of your explicit consent, which you give by adding a habit. You can withdraw that consent at any time by removing the habit or deleting your account.

How we use it

To show you your board, streaks and totals, to sync connected services into the challenges you chose, and to keep the service secure. We do not use it for advertising, we do not sell it, and there are no analytics or tracking scripts in the app.

The operator can see account emails, sign-up dates and overall usage numbers (such as how many people track a given habit). The feed of recent check-ins in the operator's view is anonymised.

Who processes it for us

• Supabase — database and sign-in, hosted in the EU (Frankfurt).
• Vercel — hosting of the web app.
• Google and Apple — sign-in, when you use them.
• Strava — only if you connect it.

Some of these providers may process data outside the EEA; where they do, it is under standard contractual clauses or an equivalent safeguard.

How long we keep it

Until you delete your account. Deleting it (Connections page in the web app, or Settings in the iPhone app) immediately removes your account, habits, check-ins and connection tokens. You can also disconnect Strava at any time and revoke access in your Strava settings.

Your rights

You can ask us for access to your data, a copy in a portable format, correction, restriction or erasure, and you can object to processing or withdraw consent. Email tudor@deepbite.io and we'll respond within one month. You can also complain to your local data protection authority.

Children

Sober Oktober is not for anyone under 16, and we do not knowingly collect their data.

Security

Connections are encrypted (HTTPS). Every user's rows are protected by row-level security in the database so accounts cannot read each other's data, and secrets are stored server-side. No system is perfectly secure, but we take reasonable measures and will tell you and the authorities about a breach where the law requires.

Changes

If we change this page in a meaningful way we'll update the date above and, where appropriate, tell you in the app.