Privacy policy
Draft. This text has not yet been reviewed by a lawyer and may change.
1. Who are we?
Samen Clean is offered by: Zoutmanstraat 15, 2202 LK Noordwijk · KvK 42022140: name, legal form, address, Chamber of Commerce number, email address for privacy questions.
2. In short
- Your data is stored on your own phone, encrypted. We can't read it.
- Messages to your group are encrypted on your phone. Only your group can open them. Our server only passes them on.
- You don't need an email address, phone number or real name.
- What you track says something about your health. That's why we ask for your explicit consent, recorded on your own device.
- Lost means lost: without your recovery code nobody can get your data back, including us.
- We use no advertising or tracking SDKs and never sell data.
- In the app you can download all your data and delete everything in one go.
3. What is stored where?
Only on your phone, encrypted: nickname, habits, start date, your "why", costs, check-ins, mood, triggers, XP, levels, badges, settings, names you give to group members, your consent and your recovery code. Your birth year is used once on your phone for the 18+ check. We only keep the fact that the check passed.
On the server, readable by us:
| Data | Purpose | Legal basis |
|---|---|---|
| Random account ID, device ID and hashed device secret | Signing in without email | Contract (Art. 6(1)(b) GDPR) |
| Which group an account is in, and each member's public key | Getting packets to the right people | Contract |
| Time and size of packets, and whether a packet should trigger a notification | Passing on packets and sending notifications | Contract |
| Your device's push token | Sending notifications | Contract |
| Plus status and end date | Unlocking Plus | Contract |
| Last activity | Removing inactive accounts | Legitimate interest (Art. 6(1)(f)) |
| Abuse reports: account IDs, group ID and reason | Safety in groups | Legitimate interest |
| Technical logs (time, endpoint, status code), without IP address or content | Fixing faults | Legitimate interest |
On the server, but encrypted so we can't read it: group messages (such as nickname, type of habit, streak, emergency alerts and reactions), group name and goal, group keys and your backup.
Encrypted data can still be personal data, so your rights and the retention periods below apply to it too. Something can also be inferred from an account being in a group and from when packets are sent, even though we don't know the content.
4. What does your group see?
Group members see your nickname, avatar colour, level, the category of your habit, your current streak, whether you checked in today, and your emergency alerts and reactions. They don't see your "why", mood, triggers, costs or the custom name of your habit.
A relapse isn't shown by default. If you turn on "Share relapse with your group", your group sees "starting over" that day.
Group members can give you a different name on their own phone. That name is never sent.
Please note: group members can record what they see themselves, for example with a screenshot. Encryption doesn't prevent that.
5. Who do we share data with? (processors)
| Processor | What | Where | Transfer outside the EEA |
|---|---|---|---|
| Worldstream B.V. (hosting) | The server data above and backups | Netherlands | No |
| Cloudflare, Inc. (network) | IP address and traffic to the server; the content is encrypted | Worldwide | Yes |
| Expo / 650 Industries, Inc. (push) | Push token and the fixed text "SC: Nieuw bericht" (new message) | USA | Yes |
| Apple (APNs) and Google (FCM) | Delivering notifications | USA/worldwide | Yes |
| RevenueCat, Inc. (subscriptions) | Your account ID and purchase status, via Apple/Google | USA | Yes |
| Apple App Store / Google Play | Payment for Plus; they are responsible for payment data | — | — |
We only share data with others when the law requires it. We can then only provide what we have: the server data above and encrypted packets.
6. How long do we keep data?
| Data | Retention |
|---|---|
| Data on your phone | Until you delete it or the app |
| Encrypted group messages | 30 days, then deleted automatically |
| Account, membership and encrypted backup | As long as your account exists |
| Account unused for 24 months | Deleted automatically, without warning: we have no email address and notifications contain no content |
| Abuse reports | 12 months |
| Invitations | Valid for up to 7 days, then removed |
| Server backups | 14 days (rolling) |
| Technical logs | In practice a few days to weeks |
If you delete your account, we immediately delete your account, memberships, keys and backup. Encrypted messages you already sent to a group are stored without a sender, so we can't identify them. They disappear within 30 days. Group members may still have on their phones what they saw from you earlier.
7. Security
- Data on your phone is encrypted with a key from your device's secure storage.
- Group messages are encrypted with XChaCha20-Poly1305 and signed with Ed25519. The keys exist only on devices.
- When a member leaves, the group changes keys and the old invitation expires.
- The invite code sits after the # in the link and isn't sent to the server.
- Connections use HTTPS/TLS. The database can't be reached from the internet.
- Logs contain no IP addresses, tokens or content.
- No system is completely secure. We can't stop a hacked phone or a group member passing something on.
8. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection, and you can withdraw your consent.
- Access and portability: in the app under Profile → Privacy → Export my data.
- Rectification: change your data yourself in the app.
- Erasure: Profile → Privacy → Delete everything. See also Delete your account, including if you no longer have the app.
- Withdraw consent: Profile → Consents → Health data → Withdraw.
- Other requests: email Zoutmanstraat 15, 2202 LK Noordwijk · KvK 42022140 with your account ID, which is in your data download. As we can't read the content, we can only help with what's on the server. We respond within one month.
You can file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9. Age
Samen Clean is only for people aged 18 and over. The check happens on your phone. We don't keep your birth year.
10. Not a medical device
Samen Clean is a peer-support tool and not a medical device. The app doesn't diagnose or give treatment advice. Stopping some substances, such as alcohol, can be medically risky, so talk to your doctor. In an emergency, call 112 in Europe or your local emergency number.
11. Changes
If we materially change this policy, we'll tell you in the app.
12. Contact
Zoutmanstraat 15, 2202 LK Noordwijk · KvK 42022140: name, address, email for privacy questions.