Last updated: 14 August 2026 · Effective: 14 August 2026
Sobella ("Sobella", "we", "our", "us") is a mobile application and website operated by Richard Holmes, trading as Sobella, based in the United Kingdom.
This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Sobella iOS app or the sobella.app website. It applies to all users worldwide, with additional rights described below for users in the UK and European Economic Area (EEA).
Contact: For any privacy enquiries, write to us at support@sobella.app.
| Data | Why we collect it |
|---|---|
| Email address | Account creation and authentication |
| Display name / first name | To personalise your experience (e.g. "Good morning, [name]") |
| Sobriety start date | To calculate your streak and milestone notifications |
| Daily check-in responses | To personalise AI companion messages and track your progress |
| Journal entries | Stored privately so you can reflect over time |
| AI conversation messages | Sent to our AI service to generate a response; not used for advertising or model training |
| Mood and craving ratings | Recorded with your journal entries so you can track patterns over time |
| Event plans and reflections | Event details, preparation checklists, and any notes you write about how an event went, so you can prepare beforehand and look back afterwards |
| Toolkit and custom tools | Stored so your coping strategies persist between sessions |
The table below sets out each purpose for which we process personal data, the lawful basis we rely on, and how long we keep that data. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
| Purpose | Data involved | Legal basis (UK/EEA) | Retention period |
|---|---|---|---|
| Creating and managing your account | Email address, password (hashed), display name | Performance of contract (Art 6(1)(b)) | Until account deleted, then purged within 30 days |
| Processing your health-related data to provide the app's core features (sobriety tracking, mood logs, journal entries, event planning, check-in responses) | Sobriety start date, mood and craving ratings, journal entries, sober-day logs, event plans and reflections, daily check-in responses | Explicit consent (Art 9(2)(a)) — given at sign-up. You may withdraw this consent at any time by deleting your account or contacting us. | Until you delete the data or your account, then purged within 30 days |
| AI companion responses | Text of your messages and AI responses | Performance of contract (Art 6(1)(b)) | Stored in Supabase, where no other user can access them. Retained until you delete your account, then purged within 30 days. Anthropic's API data retention policy also applies (see Section 5). |
| Personalising your experience (greetings, streak count, toolkit tools) | Display name, sobriety start date, toolkit content | Performance of contract (Art 6(1)(b)) | Until account deleted, then purged within 30 days |
| Sending reminders, event check-in alerts, and occasional messages about new or updated features | Push notification token, device information | Consent (Art 6(1)(a)), given when you allow notifications — withdraw at any time in your device's Settings app | Until you disable notifications or delete your account |
| Subscription and purchase management | Your account ID and whether your account is currently free or premium. Purchase receipts and payment records are handled entirely by Apple and RevenueCat — we do not store them. | Performance of contract (Art 6(1)(b)) | Your plan status is deleted with your account. Apple and RevenueCat retain their own transaction records under their respective policies, including to meet tax and accounting obligations. |
| Detecting and preventing fraud or abuse | Authentication logs, device information, session data | Legitimate interests (Art 6(1)(f)) | 90 days rolling |
| Understanding how the app is used, so we can improve it | Counts and dates of your feature usage (journal entries, sober-day logs, check-in sessions, meditation and pep talk plays, events created), analysed against your account ID and sign-up date. We do not read the content of your journal entries or conversations for this purpose. | Explicit consent (Art 9(2)(a)) where the analysis involves health data; legitimate interests (Art 6(1)(f)) otherwise | Derived from the records described above — deleted when your account is deleted |
| Complying with legal obligations | Data as required by applicable law | Legal obligation (Art 6(1)(c)) | As required by the applicable law |
Where we rely on legitimate interests, you have the right to object. We have assessed that our interests do not override your rights and freedoms in each case — we do not use legitimate interests as a basis for processing sensitive health data.
We use a small number of carefully selected third-party services to operate Sobella. Each acts as a data processor on our behalf and is bound by data processing agreements.
| Service | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Authentication, database, and serverless functions | Account data, journal entries, check-ins, sobriety data | EU (AWS eu-west-1) |
| Anthropic (Claude API) | AI companion responses | The text of your AI messages only (no account details). Sent via our server-side Edge Function — never directly from your device. | USA (AWS) |
| RevenueCat | Subscription and in-app purchase management | Your account ID, purchase receipt data, country, device model, and app version. No payment card details are shared — Apple handles all payment processing directly. | USA |
| Vercel | Website hosting (sobella.app) | IP address, browser type (standard server logs) | Global CDN |
| OneSignal | Push notification delivery | Device push token, device model, operating system version, country, and when you last opened the app | USA |
| Resend | Data export emails | Your email address and exported data when you request a data download | USA |
| Apple | App distribution, in-app purchases, push notifications | Governed by Apple's Privacy Policy | USA |
We do not sell, rent, or trade your personal data to any third party, and we do not use your data for advertising purposes. We never share your journal entries with anyone. Your AI conversations are shared only with Anthropic, solely to generate a reply to you (see Section 5).
Your conversations with the AI companion are private. They are never used for advertising, never sold, never shared with anyone beyond what is described below, and never used to train AI models.
How your message reaches the AI. When you send a message it travels over an encrypted connection to our own server, which passes it to Anthropic's Claude API to generate a reply. Your message never goes from your device to Anthropic directly, and no account details travel with it — not your name, your email, or your account ID. Anthropic's API terms apply, and your messages are not used to train their models.
How it is stored. Your messages and the AI's replies are stored in our database, encrypted in transit and at rest. Row-Level Security means no other user can ever read them. Our own access is limited to what is strictly necessary to operate, secure, and support the service.
Staying in control. You can download your conversation history at any time from within the app (Settings → Download My Data), and deleting your account permanently deletes every message.
Important: The AI companion is not a medical professional, counsellor, or therapist. It is a supportive tool only. If you are in crisis, please contact a qualified professional or a crisis line (see Section 11).
Specific retention periods for each category of data are set out in Section 3. In summary:
You can delete your account at any time from within the app (Settings → Delete Account). You may also request deletion of specific data without closing your account by contacting support@sobella.app.
Withdrawing health data consent: If you withdraw your explicit consent for health data processing (given at sign-up), we will stop processing that data and delete it. Note that withdrawing this consent will prevent us from providing the app's core features, as they depend on this data. You can do this by deleting your account or contacting us.
All users may:
If you are located in the UK or EEA, you additionally have the right to:
We will respond to all rights requests within 30 days.
You may designate an authorized agent to submit a rights request on your behalf. We may ask for proof of authorization and may also verify your identity directly before processing the request.
If we decline your request, you may appeal our decision by emailing support@sobella.app with the subject line "Rights Request Appeal." We will respond within 30 days. If you are in the US and remain unsatisfied after the appeal, you may contact the attorney general in your state.
Sobella is not intended for children under 17 years of age. We do not knowingly collect personal information from anyone under 17. If we become aware that we have collected personal information from a child under 17 without parental consent, we will delete it promptly. If you believe we may have information about a child, please contact us at support@sobella.app.
We take security seriously. We implement the following measures to protect your data:
No system is perfectly secure. If you discover a security vulnerability, please disclose it responsibly to support@sobella.app.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, as required by UK GDPR Article 33. Where the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay, describing the nature of the breach, its likely consequences, and the steps we are taking to address it.
Your data may be processed in countries outside the UK and EEA, including the United States (Anthropic, RevenueCat, OneSignal, Resend, Vercel). Where we transfer data internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses (SCCs), or adequacy decisions.
Sobella is a wellness companion, not a crisis service. If you are experiencing a mental health emergency or are in crisis, please contact:
The sobella.app website does not use advertising or tracking cookies. We do not run any third-party analytics scripts on this website. The only cookies that may be set are strictly necessary session cookies used by our hosting infrastructure (Vercel) for performance and security.
We may update this Privacy Policy from time to time. We will notify you of material changes via a notice in the app or by email. The "Last updated" date at the top of this page will always reflect the most recent version. Continued use of Sobella after a change constitutes acceptance of the updated policy.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you additional privacy rights.
In the past 12 months we have collected the following categories of personal information from California residents:
To exercise these rights, email support@sobella.app. We will verify your identity before processing the request. You may designate an authorized agent to submit a request on your behalf.
Sobella does not sell your personal information and has not done so in the past 12 months. We do not share your personal information with third parties for targeted or behavioural advertising.
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:
Sobella Privacy
support@sobella.app
UK & EEA representative: Richard Holmes, Sobella — support@sobella.app
We aim to respond to all enquiries within 5 business days.