Privacy Policy

This Privacy Policy explains how Strong Associations LLC, doing business as FaithGrind ("FaithGrind," "we," "us," or "our"), an Alabama limited liability company, handles your information when you use the FaithGrind mobile app, the website at faithgrind.com, and related services (the "Service"). It is not legal advice. If you have legal questions about your data or privacy rights, talk to a lawyer.

Recovery data like sober time, check-ins, urges, and coach conversations is consumer health data under laws such as Washington's My Health My Data Act. How we handle it, and the rights you have over it, are spelled out in our Consumer Health Privacy Policy.

We only collect what we need to run the Service. Here is the full list:

What we do NOT collect:

We do not collect your location, contacts, photos, browsing or search history, or biometric identifiers. Face ID and other on-device authentication stay on your device. We do not run third-party advertising SDKs and we do not sell or rent your personal information.

We use your information to:

• ▸Run the Service: create and manage your account, deliver lessons, store check-ins, run the AI Coach, send notifications you opted into
• ▸Process subscriptions and purchases through Apple StoreKit (iOS) and Stripe (web)
• ▸Personalize your coaching context using your past check-ins and course progress when you have data sharing enabled
• ▸Send transactional emails (welcome, account, billing, password reset) and, only if you opted in, marketing emails through Brevo
• ▸Detect, debug, and fix problems
• ▸Comply with law, respond to lawful requests, and enforce our Terms of Use

Lawful Basis (for users in the EEA, UK, and Switzerland)

Where the GDPR or UK GDPR applies, we rely on the following lawful bases under Article 6:

• ▸Contract performance (Art. 6(1)(b)) — to provide the Service you signed up for, including running the AI Coach, storing your check-ins, and processing your subscription
• ▸Legitimate interests (Art. 6(1)(f)) — to keep the Service safe, prevent fraud, debug errors, and improve features. We balance this against your rights and you can object
• ▸Consent (Art. 6(1)(a)) — for marketing emails, optional SMS reminders, and any explicit data sharing toggles. You can withdraw consent at any time
• ▸Legal obligation (Art. 6(1)(c)) — to keep tax, accounting, and other records the law requires

Some of the data we process (mental health context, recovery status, religious belief inferred from use) is special category data under Article 9 GDPR. Where applicable, we process it on the basis of your explicit consent (Art. 9(2)(a)) given when you signed up for a faith-based recovery support service.

We use the following third-party processors to run the Service. Each one only gets the data it needs to do its job, and each one is bound by a written data protection agreement or equivalent contractual safeguards.

We do not sell, trade, or rent your personal information. We do not share data with advertising networks. We may disclose information if required by law, to enforce our Terms, to protect users, or in connection with a merger, acquisition, or sale of assets (in which case we will give you notice before your data becomes subject to a different policy).

People you invite. If you invite a mentor or an accountability partner, only the specific information you choose to share is shown to that person at your request. For a mentor that is your current streak, your last check in date, and your clean time. It never includes your coach conversations, your notes, or your urge logs. You can revoke a mentor's access at any time in your settings.

FaithGrind is operated from the United States. If you are in the European Economic Area, the United Kingdom, Switzerland, or anywhere else outside the United States, your data will be transferred to and processed in the United States, where data protection law differs from the law where you live.

Where the GDPR or UK GDPR applies, we rely on the following transfer mechanisms with our processors:

• ▸Standard Contractual Clauses (SCCs) approved by the European Commission, including the UK Addendum where applicable
• ▸EU-US Data Privacy Framework certification, where the recipient is certified
• ▸Your explicit consent for the specific transfer where no other mechanism applies

You can request a copy of the relevant transfer safeguards by emailing info@faithgrind.com.

We keep personal data only as long as we need it for the purposes described in this policy, or as long as the law requires.

We use reasonable technical and organizational measures to protect your data:

• ▸TLS encryption for data in transit between your device and our servers
• ▸Encryption at rest for the database, vault content, and stored files
• ▸Apple StoreKit and Stripe handle all card and Apple Pay details under PCI DSS
• ▸Role-based access control. Only personnel who need access for their job have it
• ▸Logging and monitoring through Sentry and Supabase audit logs
• ▸On-device passkey or Face ID for vault unlock. Biometrics never leave your device

No system is perfectly secure. If we ever discover a breach of your personal health information, we will notify you and the appropriate authorities within the timelines the law requires, including the Federal Trade Commission under the Health Breach Notification Rule, and, where it applies, GDPR Article 34.

You do not need to email us or live in a specific state or country to use these controls. They are built into the app for every user. On the web, go to faithgrind.com/app/privacy. In the mobile app, open Menu, then Privacy.

• ▸See what the coach remembers: view every memory the AI Coach has saved from your conversations
• ▸Forget any of it: delete a single memory, or delete all of them at once. Deletion is immediate and permanent
• ▸Export your data: download a copy of your personal data as a JSON file, including your profile, check-ins, wins, urge logs, AI Coach conversations, and coach memories
• ▸Turn off data sharing: in your vault settings, switch data sharing off and the coach stops reading your saved memories, check-ins, and conversation history
• ▸Delete your account: from in-app settings or by emailing info@faithgrind.com. See Section 8 for deletion timelines

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR and UK GDPR:

• ▸Right of access — get a copy of the personal data we hold about you
• ▸Right to rectification — ask us to correct inaccurate or incomplete data
• ▸Right to erasure ("right to be forgotten") — ask us to delete your personal data
• ▸Right to restriction — ask us to pause processing in certain situations
• ▸Right to data portability — receive your data in a structured, machine-readable format
• ▸Right to object — object to processing based on our legitimate interests, including direct marketing
• ▸Right to withdraw consent — withdraw any consent you previously gave, at any time
• ▸Right not to be subject to automated decisions with legal effect — see Section 4

To exercise any of these rights, email info [at] faithgrind.com. We will respond within 30 days. If we need more time because of the complexity or number of requests, we will tell you within those 30 days.

You also have the right to lodge a complaint with your local data protection supervisory authority. In the EU, you can find your authority at edpb.europa.eu. In the UK, the relevant authority is the Information Commissioner's Office at ico.org.uk. We hope you talk to us first so we can fix things.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you specific rights regarding your personal information.

Categories of Personal Information We Collect

In the past 12 months we have collected the following categories from California consumers, sourced directly from you, your device, and our payment processors:

• ▸Identifiers (name, email, account ID, IP address, push token)
• ▸Customer records (subscription history, support correspondence)
• ▸Commercial information (purchases, plan, billing country)
• ▸Internet/network activity (basic diagnostics, error logs)
• ▸Geolocation (only the coarse country/region implied by your IP and billing — we do not collect precise GPS location)
• ▸Audio data (voice transcripts from AI Coach voice sessions)
• ▸Inferences drawn from check-ins and AI Coach activity to personalize the Service
• ▸Sensitive personal information: account credentials (hashed) and content concerning health and well-being (mental health, recovery context, religious belief inferred from a faith-based service)

How We Use Sensitive Personal Information

We use sensitive personal information only to deliver the Service you signed up for (the AI Coach, check-ins, vault, and course progress) and to keep the Service safe and lawful. We do not use sensitive personal information to infer characteristics about you for purposes other than providing the Service. You have the right to limit our use of sensitive personal information; because our use is already limited to providing the Service, you do not need to take additional action, but you may email info@faithgrind.com to confirm.

Categories of Third Parties We Share Personal Information With

Service providers and processors only, listed in Section 6 (payments, hosting, AI inference, voice, email/SMS, error tracking, file storage, app distribution). We do not share with advertising networks or data brokers.

No Sale or Sharing for Cross-Context Behavioral Advertising

We do not sell your personal information for money or other valuable consideration, and we do not share it for cross-context behavioral advertising as those terms are defined under the CCPA. We also do not knowingly sell or share the personal information of consumers under 16.

Your California Rights

• ▸Right to know what categories of personal information we have collected, used, disclosed, or sold/shared, and the specific pieces of personal information we hold
• ▸Right to delete your personal information
• ▸Right to correct inaccurate personal information
• ▸Right to opt out of sale or sharing for cross-context behavioral advertising — we already do not sell or share
• ▸Right to limit use of sensitive personal information — already limited as described above
• ▸Right to non-discrimination for exercising your rights

To exercise any California right, email info [at] faithgrind.com. We will verify your identity using information already in our records and respond within 45 days. You may use an authorized agent by sending us written, signed permission from you (and we may still need to verify your identity directly).

Notice of Financial Incentive

We do not offer financial incentives or price differences in exchange for personal information.

FaithGrind is built for adults. The Service is not directed to children. Our Terms of Use require users to be at least 18 years old.

United States (COPPA): We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act. If we learn we have collected personal information from a child under 13, we will delete it.

EEA and UK: We do not knowingly process personal data of anyone under 16. If we learn that a person under 16 has given us personal data without verified parental consent, we will delete it.

If you believe a child has signed up, contact info [at] faithgrind.com and we will delete the account.

On faithgrind.com we use a small number of strictly necessary cookies and similar technologies to keep the site working:

• ▸Authentication and session cookies, so you stay logged in
• ▸Security tokens to prevent CSRF and abuse
• ▸Preference storage in localStorage for things like theme and last-visited section

We do not run third-party advertising cookies or cross-site-tracking pixels. The mobile app does not use cookies.

Do Not Track and Global Privacy Control: Because we do not engage in cross-context behavioral advertising and do not sell or share personal information, there is no advertising opt-out for us to honor. We go further with the Global Privacy Control (GPC): when your browser sends a GPC signal, faithgrind.com does not load our analytics tools at all, in addition to our default of never selling or sharing your personal information.

We send two kinds of messages:

• ▸Transactional emails: account confirmation, password reset, billing receipts, important changes to the Service. You cannot opt out of these while you have an account, because they are part of providing the Service
• ▸Marketing emails: tips, devotionals, product updates. We only send these if you opt in. Every marketing email has an unsubscribe link, and you can also email info@faithgrind.com
• ▸SMS reminders: only if you opted in by adding a phone number and confirming. Reply STOP to cancel. Standard message and data rates may apply

If you believe content on FaithGrind infringes your copyright, send a written DMCA notice to our designated agent. The notice must include all elements required by 17 U.S.C. § 512(c)(3), including your signature, identification of the copyrighted work, location of the alleged infringement, your contact information, and the required good-faith and accuracy statements.

DMCA Designated Agent: Thomas Azar, Strong Associations LLC, 2971 Elk Meadows Dr SE, Brownsboro, AL 35741, phone (334) 350-1385, email dmca [at] faithgrind.com. Registered with the U.S. Copyright Office under registration number DMCA-1072220.

For users of the iOS app, the data types declared on our App Store listing align with the categories described in this policy. Linked-to-you data includes: contact info (email, optional phone, name), purchase history, identifiers (account ID, device push token), user content (AI Coach transcripts, check-ins, journal entries, Win Wall posts, course progress), and diagnostics (crashes and basic performance data).

We do not collect data used for tracking across third-party apps or websites, and we do not run the App Tracking Transparency (ATT) prompt because we do not engage in tracking as Apple defines it.

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top. For material changes, we will give you notice by email or in-app before the change takes effect. Continued use of the Service after the effective date means you accept the updated policy.