Introduction
Welcome to My Tenth Step ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a positive experience using our mobile application and services (collectively, the "Service").
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We understand that your recovery journey is deeply personal, and we take the protection of your data extremely seriously.
By using My Tenth Step, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.
How We Use Your Information
We use the information we collect to:
- Provide the Service: Enable core features like check-ins, inventory management, and squad chat
- Personalize Your Experience: Display your progress, streaks, and milestones
- Enable AI Features: Process your inputs to provide AI-powered insights and suggestions (with your consent)
- Send Notifications: Remind you of check-ins and important updates (you can disable these)
- Improve Our Service: Analyze usage patterns to enhance features and fix bugs
- Ensure Security: Detect and prevent fraud, abuse, or security issues
- Provide Support: Respond to your questions and assist with technical issues
Data Storage & Security
Where Your Data is Stored
Your data is stored in the following ways:
- On your device: Your check-ins, inventory items, journal entries, and spot checks are stored on your phone in an encrypted local database. This content is not uploaded to our servers.
- In the cloud: Only what squads require — your display name, handle, avatar, and notification token — is stored in our infrastructure (Supabase). Squad messages are end-to-end encrypted on your device before they are sent, so we cannot read them.
- Authentication: Accounts are managed through Supabase Auth using industry-standard security.
Security Measures
We implement robust security measures to protect your data:
- End-to-End Encryption: All squad chat messages are encrypted end-to-end, meaning only you and your squad members can read them
- Biometric Authentication: Support for Face ID and Touch ID to protect app access
- Secure Transmission: All data transmitted between your device and our servers uses TLS/SSL encryption
- Access Controls: Strict internal access controls limit who can access user data
- Regular Security Audits: We conduct regular security assessments and updates
Data Retention
We retain your personal information for as long as your account is active or as needed to provide you with our Service. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal purposes. You can delete your account in the app or request deletion on our delete account page.
Information Sharing
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances:
Service Providers
We work with trusted third-party service providers who help us operate our Service:
- Supabase: Authentication, profile data, and the transport layer for squad messages (which are encrypted on your device before sending)
- Firebase (Google): Crash reporting, analytics, and push notification delivery
- RevenueCat: Subscription management (no personal data shared)
These providers are contractually obligated to protect your data and may only use it to provide services to us.
Legal Requirements
We may disclose your information if required by law, such as in response to a subpoena, court order, or other legal process.
With Your Consent
We may share information with your explicit consent, such as when you choose to share your progress publicly.
Our Promise
We will NEVER sell your personal data or recovery information to advertisers, data brokers, or any third party. Your journey is private, and we intend to keep it that way.
Your Rights
You have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request that we correct any inaccurate or incomplete data
- Deletion: Request that we delete your personal data (subject to legal requirements)
- Data Portability: Request a copy of your data in a machine-readable format
- Opt-Out: Disable notifications, analytics, and optional data collection features
- Withdraw Consent: Withdraw your consent for data processing at any time
To delete your account, use Settings in the app or our delete account page. To exercise any of these rights, you can also contact us using the information provided below.
California Residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to opt-out of the sale of personal information (note: we do not sell personal information).
European Residents (GDPR)
If you are a resident of the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with a supervisory authority.
Children's Privacy
My Tenth Step is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we discover that a child under 18 has provided us with personal information, we will delete it immediately.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, technical, or regulatory reasons. When we make changes, we will:
- Update the "Last updated" date at the top of this policy
- Notify you through the app or via email for significant changes
- Provide a summary of key changes
Your continued use of the Service after changes become effective constitutes your acceptance of the revised policy.