Privacy Policy

Who We Are

BFRB Ally is a MindCrafts app operated by Timo Scholz-Fritsch, based in Germany. The app supports people living with body-focused repetitive behaviors (BFRBs) such as skin picking, hair pulling, and nail biting. We are committed to protecting your privacy and the security of your personal health-related information.

Information We Collect

Account Information

• Account information (email address), if you create an account
• Communication preferences
• Subscription and payment information (processed through the app stores)

BFRB & Wellbeing Data

• Episode logs (behavior type, time, and optional context you add)
• Urge-surfing sessions (start, duration, outcome)
• Notes, triggers, and patterns you choose to record
• Anonymous buddy signals ("squeezes") you send and receive
• Your anonymized contribution to the worldwide tide counter

Device Information

• Device identifiers, model, operating system, and version
• App version and build information
• Push notification tokens (when notifications are enabled)
• Crash reports and performance data

Usage & Network Data

• App usage statistics and feature interaction data
• Error logs and diagnostic information
• IP address and approximate geographic region (country level)
• We do not collect precise location data

How We Protect Your Data

Encryption

Sensitive data is encrypted in transit and at rest using industry-standard encryption. Your episode logs and personal notes are treated as sensitive health-related information at all times.

Data Storage

Your data is stored on secure servers with multiple layers of protection, using reputable cloud providers that comply with international security standards.

Access Controls

Access to personal data is strictly limited to what is needed to operate the service. All access is logged and monitored.

The Anonymous Buddy Feature

• Buddy pairing is anonymous by design: no names, no profiles, no chat
• Your buddy never sees your identity, your episode logs, or your notes
• Only the signal itself ("a squeeze") and its timing are transmitted
• You can unpair at any time, which immediately ends the connection

How We Use Your Information

• Provide Services: to deliver BFRB Ally's features and support
• Improve Experience: to personalize and improve the app
• Safety: to keep the crisis path and buddy features working reliably
• Communication: to send important updates about your account or the app
• Research: to improve BFRB support, only ever with anonymized, aggregated data
• Legal Compliance: to comply with legal obligations

Third-Party Services and Data Sharing

Service Providers We Use

• Supabase: secure database hosting and authentication
• Superwall: subscription management and paywall delivery
• PostHog (EU-hosted): anonymized product analytics, so we can see which features help
• Sentry (EU-hosted): crash and error reporting, stripped of personal content
• Resend: delivery of sign-in code emails
• Apple / Google: app store services, payment processing, and push notifications

We Do NOT Share Your Data Except:

• With Your Consent: when you explicitly choose to export or share your data
• Emergency Situations: if we believe disclosure is necessary to prevent serious harm
• Legal Requirements: when required by law or legal process
• Service Providers: with trusted partners who help us operate the app, under strict confidentiality agreements
• Never for Advertising: we do not sell your data to advertisers or marketing companies
• Never Your Logs: your episode logs and notes are never shared with third parties

Your Rights and Choices

• Access: request a copy of your personal data
• Correction: update or correct your information
• Deletion: request deletion of your account and data
• Portability: export your data in a readable format
• Restrict Processing: limit how we use your data
• Push Notifications: control through device settings or app preferences

Account Deletion

• In-App: delete your account directly from the app's settings
• Email: contact hello@bfrbally.app for deletion assistance
• Data Removal: all personal data is deleted within 30 days of your request
• Note: deleting the app from your device does not delete your account data

Data Retention

We retain your data only as long as necessary to provide our services or as required by law. You can request deletion of your account at any time, after which we securely delete your data within 30 days, except where retention is legally required.

App Store Privacy Compliance

• We comply with Apple's App Tracking Transparency (ATT) framework: we do not track you across apps
• Apple privacy nutrition labels and the Google Play data safety section accurately reflect our practices
• No sale of personal or sensitive user data
• BFRB data is treated as sensitive health-related information and is never used for advertising

Children's Privacy

BFRB Ally is not intended for children under 13. If you are between 13 and 17, you must have parental consent to use the app. We do not knowingly collect personal information from children under 13.

International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this privacy policy and German and EU data protection law (GDPR).

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes through the app or by email. Your continued use of BFRB Ally after changes take effect constitutes acceptance of the new policy.

Contact Us

If you have questions about this privacy policy or how we handle your data:

• Email: hello@bfrbally.app
• Data Controller: Timo Scholz-Fritsch
• Address: Kaiserallee 12, 58511 Lüdenscheid, Germany