Privacy Policy

Personal information you disclose to us

"We collect personal information that you provide to us"

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• Names: Full names provided during registration or profile setup.
• Phone numbers: Contact numbers for communication and verification.
• Email addresses: Used for account login, notifications, and support.
• Mailing addresses: Physical addresses for billing or correspondence.
• Usernames & passwords: Credentials for account access and security.
• Contact preferences: User choices on how and when to be contacted.
• Contact or authentication data: Data used to verify identity or authenticate access.
• Billing addresses: Addresses used for payment processing.
• Debit/credit card numbers: Payment details securely processed and stored.
• Self-reported addiction-related data: Examples include last relapse date, triggers, and habit goals.
• Daily journal entries or reflections: Personal logs users may keep to track progress.
• Location data: Optional data users log to record where cravings or relapses occurred.

Sensitive Information. When necessary, with your consent or as permitted by law, we process certain categories of sensitive information such as:

• Health data
• Financial data
• Self-reported addiction triggers or relapse events

Payment Data. If you make purchases, we may collect information necessary to process your payment, including your payment instrument number and security code. All payment data is securely handled and stored by Google Play In-App Billing and Apple In-App Purchases. You can review their privacy policies here: Google Privacy Policy and Apple Privacy Policy.

Tobby uses these platforms to securely process payments within the app. We do not store full payment details ourselves. For details on data handling during purchases, please refer to the above privacy policies.

Social Media Login Data. You can register using your social media accounts such as Facebook or X. If you do, we collect certain profile information from those providers. See the section "How We Handle Your Social Logins" for more details.

Application Data. If you grant us permission, we may collect:

• Geolocation Information: Location data from your device to provide location-based services. You can change this permission anytime in your device settings.
• Mobile Device Access: Access to features like Bluetooth, calendar, camera, contacts, reminders, SMS, social media accounts, storage, etc., subject to your permission.
• Mobile Device Data: Device info like ID, model, OS version, system config, browser type, IP address, mobile network, and app usage details.
• Push Notifications: Notifications about your account or app features, which you can opt out from in settings.

This data helps us maintain app security, troubleshoot issues, and perform analytics and reporting.

Please ensure all personal information you provide is accurate and up-to-date.

Information Automatically Collected

"Some information — such as your IP address and device characteristics — is collected automatically when you use our services."

We collect device and usage information such as your IP address, browser type, operating system, language preferences, referring URLs, device name, country, location, and how you use our services. This information helps us maintain security, ensure proper operation, and perform analytics and reporting.

Like many businesses, we also use cookies and similar technologies to collect data. This information we collect includes:

• Log and Usage Data: : Diagnostic, usage, and performance data related to our services

"We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent."

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication: We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user: We may process your information to provide you with the requested service.
• To respond to user inquiries and offer support: We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information: We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To fulfill and manage orders: We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.
• To enable user-to-user communications: We may process your information if you choose to use any of our offerings that allow for communication with another user.
• To request feedback: We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To send marketing and promotional communications: We may process the personal information you send to us for our marketing purposes, in accordance with your preferences. You can opt out of our marketing emails at any time.
• To deliver targeted advertising: We may process your information to develop and display personalized content and advertising tailored to your interests, location, and more.
• To protect our Services: We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To identify usage trends: We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To determine the effectiveness of our marketing campaigns: We may process your information to better understand how to provide marketing and promotional campaigns that are most relevant to you.
• To save or protect an individual's vital interest: We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.
• To personalize user experience and content: For example, tailoring daily challenges or motivational messages based on user behavior.
• To monitor progress and provide insights: Helping users with habit-building and recovery by analyzing activity trends.
• To maintain security and detect suspicious activity: Ensuring the safety and integrity of user accounts and our Services.
• To support users' recovery journeys: Use personalized data to provide tailored guidance, encouragement, and detect relapse patterns.

"We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests."

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases:

• Consent: We may process your information if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time. However, withdrawing consent may affect our ability to provide certain services.
• Performance of a Contract: We may process your personal information when necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Legal Obligations: We may process your information when required to comply with applicable laws, including lawful requests and legal processes from government authorities or courts.
• Vital Interests: We may process your information when necessary to protect your vital interests or the vital interests of another individual, such as in emergency situations or to prevent harm.
• Legitimate Interests: We may process your information when it is reasonably necessary to achieve our legitimate business interests and those interests do not override your fundamental rights and freedoms.

In Short: We may share information in specific situations described in this section and/or with the following categories of third parties.

Vendors, Consultants, and Other Third-Party Service Providers: We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. These third parties are contractually bound to safeguard your personal information, act only on our instructions, and not share the information with others.

The categories of third parties we may share personal information with are as follows:

• Data Analytics Services
• Cloud Computing Services
• AI Platforms
• Payment Processors
• Social Networks
• Sales & Marketing Tools
• Performance Monitoring Tools
• Testing Tools
• Communication & Collaboration Tools
• Finance & Accounting Tools
• Website Hosting Service Providers

We also may need to share your personal information in the following situations:

• Business Transfers: We may share or transfer your information during negotiations or in connection with a merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• When We Use Google Maps Platform APIs: We may share your information with certain Google Maps Platform APIs (e.g., Google Maps API, Places API), including location data, timestamp, map interaction data, and IP address. See the section How Do We Process Your Information? for more details.
• Affiliates: We may share your information with our affiliates, including our parent company and subsidiaries. These entities are required to comply with this Privacy Notice.
• Business Partners: We may share your information with our business partners to offer you certain products, services, or promotions.
• Other Users: When you share information publicly through our Services, it may be visible to all users and potentially accessible outside our Services permanently.

In Short: We are not responsible for the safety of any information that you share with third parties that we may link to or who advertise on our Services, but are not affiliated with our Services.

The Services may contain links to third-party websites, online services, or mobile applications, and/or display advertisements from third parties that are not affiliated with us. These links or advertisements may lead to other websites, services, or applications.

We do not guarantee the content, security, or privacy practices of any third parties, and we are not liable for any damage or loss resulting from your use of such third-party platforms. The inclusion of a link or advertisement does not imply our endorsement of the third party or their practices.

We cannot guarantee the safety and privacy of data you provide to any third-party websites. Any data collected by such third parties is not covered by this Privacy Notice. We encourage you to review their privacy policies and contact them directly with any concerns.

You are solely responsible for your interactions with third-party websites, services, or applications, and we recommend exercising caution when leaving our Services.

In Short: We may use cookies and other tracking technologies to collect and store your information.

We use cookies and similar technologies (like web beacons and pixels) to collect data when you interact with our Services. These tools help ensure security, prevent bugs, remember your preferences, and support essential site features.

We may also allow third parties and service providers to use these technologies on our Services for analytics and advertising purposes. These may include managing ads, tailoring content to your interests, and sending reminders such as abandoned cart messages, depending on your communication settings.

When required under applicable US laws, the use of these technologies may be considered a “sale” or “sharing” of personal data. You can opt out by following the instructions in the section titled "Do United States Residents Have Specific Privacy Rights?"

Detailed information about how we use cookies and how you can control or disable them is provided in our Cookie Notice.

Google Analytics: We may use Google Analytics for insights on how our Services are used. This may include features such as:

• Remarketing with Google Analytics
• Google Analytics Demographics and Interests Reporting
• Google Display Network Impression Reporting

To opt out of Google Analytics tracking, visit this page. For ad preferences, see Ads Settings or use NAI’s opt-out tool.

For more about Google's privacy practices, see the Google Privacy & Terms page.

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we provide products and tools powered by artificial intelligence, machine learning, or related technologies (collectively, “AI Products”). These are designed to enhance user experience and deliver innovative solutions. Use of these AI Products is governed by this Privacy Notice.

Use of AI Technologies

We partner with third-party service providers ("AI Service Providers") such as OpenAI, ClaudeAI, and Cohere to deliver our AI Products. Your input, output, and relevant personal information may be shared with and processed by these providers as part of your use of our Services. You must not use AI Products in violation of the terms or policies of these AI Service Providers.

Our AI Products May Include:

• AI applications
• Machine learning models
• Text analysis
• Natural language processing
• AI predictive analytics
• AI research
• AI insights
• AI bots

How We Process Your Data Using AI?

Personal data processed through our AI Products is handled with strict security measures, and in accordance with this Privacy Notice and our contracts with AI Service Providers. This ensures your data remains safe and protected.

How to Opt Out?

You are in control of your data. To opt out of AI data processing, please contact us using the contact information provided in this Privacy Notice.

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services allow you to register and log in using third-party social media account details (like Facebook or X logins). When you do so, we receive certain profile information from your social media provider. The information we receive varies by provider but typically includes your name, email address, friends list, profile picture, and any other data you have made public on that platform.

For example, if you log in using Facebook, we may request additional permissions related to your account, such as access to your friends, check-ins, and likes. You have the choice to grant or deny access to each permission individually.

We only use this information for purposes described in this Privacy Notice or clearly communicated on our Services. Please note, we do not control nor are responsible for how your social media provider uses your personal information. We recommend reviewing their privacy policies to understand their data collection, usage, sharing practices, and how to adjust your privacy settings.

In Short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States, Indonesia and Singapore. If you are accessing our Services from outside the United States, Indonesia and Singapore, please be aware that your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of the third parties with whom we may share your personal information (see "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" above), in Indonesia, United States, Singapore, and other countries.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

In Short: We keep your information as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than twelve (12) months past the termination of the user's account.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

In Short: We aim to protect your personal information through organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process.

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

In Short: We do not knowingly collect data from or market to minors.

Tobby is intended for use by individuals aged 18 and older. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that a minor has registered or provided personal data, we will take steps to remove that information from our systems. Parents or guardians who believe their child has used Tobby without consent are encouraged to contact us immediately.

In Short: Depending on your location, you have rights to access, control, and manage your personal information.

Depending on your region (e.g., US states, EEA, UK, Switzerland, Canada), you may have rights to:

• Request access to and copies of your personal information
• Request correction or deletion
• Restrict processing
• Data portability (where applicable)
• Object to automated decision-making

You can make requests by contacting us using the details below. We will respond in accordance with applicable laws.

If you believe we process your data unlawfully, you may lodge a complaint with your local data protection authority.

You may withdraw your consent at any time by contacting us or updating your preferences. This will not affect processing done before withdrawal.

To opt out of marketing communications, use the unsubscribe links or contact us. We may still send necessary service messages. For account changes or termination:

• Log in to your account settings to update or delete your account
• Contact us directly

Upon termination, we will delete or deactivate your account, but may retain some data to comply with legal requirements or prevent fraud.

For questions about your privacy rights, email us at [email protected].

Most web browsers and some mobile operating systems and applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected.

At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to:

• Request access to and receive details about the personal information we maintain about you and how we have processed it.
• Correct inaccuracies in your personal information.
• Obtain a copy of or delete your personal information.
• Withdraw your consent to our processing of your personal information.

These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of Personal Information We Collect

We have collected various categories of personal information in the past twelve (12) months. This includes sensitive personal information as defined by law or collected with your consent, which may be used or disclosed for specified purposes. For a full list, please see the section "WHAT INFORMATION DO WE COLLECT?"

How We Use and Share Personal Information

We may disclose your personal information to our service providers under contract. We do not sell your personal information and use it primarily to provide and improve our services. For detailed information, see the section "HOW DO WE PROCESS YOUR INFORMATION?" and "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

Your Rights

You have rights under certain U.S. state data protection laws, including but not limited to:

• Right to know if we are processing your data.
• Right to access, correct, delete, or obtain a copy of your data.
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling") .
• Right to limit use of sensitive personal information.

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
• Right to review, understand, question, and correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to Exercise Your Rights

To exercise your rights, please contact us at https://tobby.life/contact or via email at [email protected].

Request Verification & Appeals

We will verify your identity before processing requests to protect your information. If we deny a request, you may appeal by emailing [email protected].

California "Shine The Light" Law

California residents may request information about disclosures of personal data to third parties for direct marketing purposes once per year free of charge. Submit such requests using the contact details above.

In Short: You may have additional rights based on the country you reside in.

Australia and New Zealand

We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020 (Privacy Act).

This Privacy Notice satisfies the notice requirements defined in both Privacy Acts, in particular: what personal information we collect from you, from which sources, for which purposes, and other recipients of your personal information.

If you do not wish to provide the personal information necessary to fulfill their applicable purpose, it may affect our ability to provide our services, in particular:

• offer you the products or services that you want
• respond to or help with your requests
• manage your account with us
• confirm your identity and protect your account

At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?"

If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner and a breach of New Zealand's Privacy Principles to the Office of New Zealand Privacy Commissioner.

Republic of South Africa

At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?"

If you are unsatisfied with the manner in which we address any complaint with regard to our processing of personal information, you can contact the office of the regulator, the details of which are:

The Information Regulator (South Africa)
General enquiries: [email protected]
Complaints (complete POPIA/PAIA form 5): [email protected] & [email protected]

Users may submit personal notes, logs, or other sensitive information related to their addiction recovery journey. We are not responsible for the accuracy or confidentiality of such content shared by users.

Our services are not intended for children under the age of 13 (or relevant age in your region). We do not knowingly collect personal information from children. If we learn that we have collected personal data from a child under this age, we will delete it promptly.

Due to the nature of our app, which supports addiction recovery, users may voluntarily provide sensitive health-related information. We treat this data with enhanced security and confidentiality measures as required by applicable laws.

We use third-party services (e.g., Google Analytics, Apple, Google Play) to provide and improve our services. These providers may collect data on your behalf. Please review their privacy policies for more details.

By using our services, you may receive promotional emails, notifications, or other marketing communications from us about new features, special offers, or other products and services. You have the option to opt-out of receiving these communications at any time by following the unsubscribe instructions included in the messages or by contacting us directly. We may also use your information to personalize marketing content and deliver targeted promotions that we believe are relevant and valuable to you. Your information will never be sold to third-party advertisers without your explicit consent.

We may update this Privacy Policy from time to time. We encourage users to review this policy periodically for any changes. Continued use of our services after changes indicates acceptance of the updated policy.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

If you have questions or comments about this notice, you may contact our Data Protection Officer (DPO) by email at [email protected], by phone at +1 (915) 277 4600, or contact us by post at:

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please visit: https://tobby.life/contact.