Sosober
Privacy policy
Draft pending review by a data protection specialist before launch.
1. Who processes your data
Sosober acts as data controller for the data described here. You can reach us at privacy@sosober.app.
2. Data minimisation
We store the minimum needed for the app to work. The only personal detail we ask for is a name, which can be a short name or a nickname. We do not ask for an email address, phone number, postal address or any identity document.
3. What we process
- The name you give, an internal account identifier, language and currency.
- The role you choose (person quitting alcohol, or support person).
- Account status needed to run the app.
- Approximate weekly spend on alcohol, if you provide it, and the start of your streak.
- The risk zones you mark, stored encrypted.
- Support network links and invitation codes.
- Messages exchanged with your support network and the SOS alert log.
We never store a real-time location trail, advertising data or behavioural profiles.
4. Health data and explicit consent
Using the app as someone quitting alcohol reveals health related information, a special category under Article 9 GDPR. That is why we ask for your explicit consent on a separate screen during sign-up, with an unchecked box. You can withdraw that consent at any time by deleting your account from the app.
5. Location and risk zones
The zones you mark are stored encrypted and decrypted only on your device. The comparison between your position and those zones happens locally on your phone. Your real-time location is never sent to our servers or stored. If you deny the location permission the app keeps working without zone alerts.
6. Your support network
When you invite someone, a temporary and revocable invitation code is generated. The link is created only if that person enters the code and explicitly accepts to support you. That person will know your name and that you are quitting alcohol; links are never created automatically.
7. Legal bases
- Explicit consent, for processing health related data.
- Performance of a contract, to run your account and support network.
- Legitimate interest, for service security and abuse prevention.
8. Processors
We use Supabase for database and authentication, hosted in the European Union, and the Apple and Google platforms for distribution. We do not share your data with third parties for commercial purposes.
9. Retention
We keep your data while your account exists. Deleting your account removes your profile, risk zones, links, alerts and the messages attached to those links from our servers.
10. Your rights
- Access and portability: export your data from Profile.
- Rectification: edit your name from Profile.
- Erasure: deleting the account really deletes the data.
- Withdraw consent at any time.
- Complain to your local supervisory authority.
11. California residents (CCPA/CPRA)
You have the right to know which categories of data we collect and why, to request deletion, and not to be discriminated against for exercising your rights. We do not sell your personal information and we do not share it for cross-context behavioural advertising.
12. Minors
The app is intended for people aged 18 or over. It is not directed at children and we do not knowingly collect data from them.