Privacy Policy

Introduction

Welcome to My Tenth Step ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a positive experience using our mobile application and services (collectively, the "Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We understand that your recovery journey is deeply personal, and we take the protection of your data extremely seriously.

By using My Tenth Step, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

Information We Collect

Information You Provide to Us

We collect information that you voluntarily provide when using our Service, including:

• Account Information: Email address, username, and password when you create an account
• Profile Information: Recovery date, display name, and optional profile photo
• Check-in Data: Mood entries, gratitude notes, daily goals, and completion status
• Personal Inventory: Items you add to your personal inventory, including fears, resentments, categories, and notes
• Squad Communications: Messages sent within squad chats (encrypted end-to-end)
• AI Conversations: Messages exchanged with our AI Guide feature
• Support Communications: Information you provide when contacting our support team

Information Collected Automatically

When you use our Service, we may automatically collect certain information, including:

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: App features used, session duration, crash reports
• Analytics Data: Aggregated usage patterns to improve our Service

Information We Do NOT Collect

We respect your privacy and explicitly do not collect:

• Location data or GPS coordinates
• Contact lists or address books
• Photos or media (unless you choose to add a profile photo)
• Browser history or external app usage

How We Use Your Information

We use the information we collect to:

• Provide the Service: Enable core features like check-ins, inventory management, and squad chat
• Personalize Your Experience: Display your progress, streaks, and milestones
• Enable AI Features: Process your inputs to provide AI-powered insights and suggestions (with your consent)
• Send Notifications: Remind you of check-ins and important updates (you can disable these)
• Improve Our Service: Analyze usage patterns to enhance features and fix bugs
• Ensure Security: Detect and prevent fraud, abuse, or security issues
• Provide Support: Respond to your questions and assist with technical issues

Data Storage & Security

Where Your Data is Stored

Your data is stored in the following ways:

• Local Storage: Core app data is stored securely on your device using encrypted local databases
• Cloud Backup: If enabled, your data is synced to our secure cloud infrastructure (Supabase) for backup and cross-device access
• Authentication: Account credentials are managed through Firebase Authentication with industry-standard security

Security Measures

We implement robust security measures to protect your data:

• End-to-End Encryption: All squad chat messages are encrypted end-to-end, meaning only you and your squad members can read them
• Biometric Authentication: Support for Face ID and Touch ID to protect app access
• Secure Transmission: All data transmitted between your device and our servers uses TLS/SSL encryption
• Access Controls: Strict internal access controls limit who can access user data
• Regular Security Audits: We conduct regular security assessments and updates

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our Service. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal purposes.

Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances:

Service Providers

We work with trusted third-party service providers who help us operate our Service:

• Firebase (Google): Authentication and crash reporting
• Supabase: Cloud database and user authentication
• Stream: Real-time chat infrastructure (messages are encrypted)
• RevenueCat: Subscription management (no personal data shared)
• OneSignal: Push notifications

These providers are contractually obligated to protect your data and may only use it to provide services to us.

Legal Requirements

We may disclose your information if required by law, such as in response to a subpoena, court order, or other legal process.

With Your Consent

We may share information with your explicit consent, such as when you choose to share your progress publicly.

Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct any inaccurate or incomplete data
• Deletion: Request that we delete your personal data (subject to legal requirements)
• Data Portability: Request a copy of your data in a machine-readable format
• Opt-Out: Disable notifications, analytics, and optional data collection features
• Withdraw Consent: Withdraw your consent for data processing at any time

To exercise any of these rights, please contact us using the information provided below.

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to opt-out of the sale of personal information (note: we do not sell personal information).

European Residents (GDPR)

If you are a resident of the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with a supervisory authority.

Children's Privacy

My Tenth Step is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we discover that a child under 18 has provided us with personal information, we will delete it immediately.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, technical, or regulatory reasons. When we make changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you through the app or via email for significant changes
• Provide a summary of key changes

Your continued use of the Service after changes become effective constitutes your acceptance of the revised policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to your inquiry within 30 days.