Sobreasy privacy statement
Last updated: 11 October 2026
This is a translation of the Dutch privacy statement. In case of any difference, the Dutch version prevails.
1. Who we are
Sobreasy is an app that connects people recovering from alcohol addiction with their personal support circle: family and friends. This statement describes which personal data Sobreasy processes, why, for how long, who we share it with and what your rights are.
This statement applies to everyone who uses the app: the user (the person in recovery) and the supporters in the circle. Where it makes a difference, we say so.
Sobreasy is a sole proprietorship registered with the Dutch Chamber of Commerce (KvK) under number 93376219 (hereinafter: "Sobreasy", "we" or "us"). We are responsible for processing your data. Our contact details are at the bottom of every page of sobreasy.nl.
2. What data we process
| Type of data | Examples | From whom |
|---|---|---|
| Account data | Email address, password (stored encrypted), name, role in the circle, language and display settings, notification setting | User and supporters |
| Age confirmation | Your confirmation that you are 18 or older, with the time | User and supporters |
| Profile photo | The photo you add to your profile yourself | User and supporters |
| Recovery data | The date you have been sober since, test videos, test results with your note, your test schedule, hard moments with your note and the kind of support you ask for | User |
| Requests and proposals | Requests for an extra test, proposals for the test schedule | Supporters |
| Responses | Responses to tests and to hard moments | Supporters |
| Group chat | Messages, photos, reactions to messages, read receipts | User and supporters |
| Circle and invitations | Who belongs to which circle, role, invitations and their status | User and supporters |
| Data of invitees | The email address of someone you invite, even if that person does not have an account yet | The person sending the invitation |
| Payment data | At Stripe: what you enter there yourself, such as email address, payment method and billing country. At Sobreasy: only the customer and subscription number at Stripe, the status and end date of the subscription, who took out the subscription, and the time you agreed to immediate delivery (see the terms and conditions) | The person who takes out the subscription |
| Waiting list | Your email address, if you sign up on sobreasy.nl to hear when the app is available | Visitors to sobreasy.nl |
| Technical data | The token used to send push notifications to your phone. IP addresses and technical log data at our hosting providers and in the protection against automated sign-ups | Everyone who uses the app or website |
Test videos, chat photos and profile photos are kept in protected storage. Only members of the same circle can view them, via temporary links.
Recovery data is sensitive data: it says something about your health, namely that you are recovering from alcohol addiction. The GDPR calls this a special category of personal data (Article 9). That is why we ask you, as a user, for explicit consent before your recovery profile is created.
What we don't do: we don't track you across other apps or websites, we don't show ads, we don't use analytics or tracking services in the app, and we don't sell data.
3. Why we use this data
- Account data and age confirmation: to let you sign in, to recognise you within your circle, to show the app in your language, and to make sure the app is only used by adults.
- Recovery data: to make the core of the app work: recording tests, showing milestones and keeping your circle informed of your progress.
- Requests, proposals and responses: so your circle can support you and think along with you.
- Group chat: so you can talk with your circle.
- Circle, invitations and data of invitees: to determine who can see what, and to send invitations.
- Payment data: to run the subscription and to meet the legal bookkeeping obligation.
- Technical data: to send push notifications, to make the app and website work and to prevent misuse, such as automated sign-ups.
- Waiting list: to let you know once that the app is available.
4. Legal basis under the GDPR
| Purpose | Legal basis |
|---|---|
| Account, circle, invitations, group chat, responses | Performance of the contract (Article 6(1)(b) GDPR): needed to make the app work as agreed |
| Recovery data | Explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR) |
| Payment data and invoicing | Performance of the contract and legal obligation (tax record-keeping) |
| Age confirmation, technical data and security | Legitimate interest (Article 6(1)(f) GDPR): a safe app, for adults only, without misuse |
| Waiting list | Consent (Article 6(1)(a) GDPR): you sign up yourself. You can unsubscribe at any time via support@sobreasy.nl |
You can withdraw your consent for recovery data at any time by deleting your account via the settings in the app. Your recovery data will then be deleted. Because the core of the app relies on this data, you cannot use the app as a user without this consent.
5. How long we keep data
- We keep your data for as long as your account exists.
- If the user (the person in recovery) deletes their account, the account, profile, profile photo, test results and test videos, hard moments and the responses to them, test requests and proposals are deleted, as well as the entire group chat of the circle (including the messages and photos of supporters). The circle continues to exist for the supporters. If the user was the last member, the circle is also deleted, together with any open invitations.
- If a supporter deletes their account, that supporter's account, profile, profile photo, responses, requests and proposals are deleted, as well as the photos the supporter shared in the group chat. The circle continues to exist for the other members. Text messages the supporter sent in the group chat remain visible to the other members, without a name and no longer linked to an account. If the supporter was the last member, the circle is also deleted, together with any open invitations.
- We keep payment and transaction data for 7 years, because of the legal tax record-keeping obligation in the Netherlands. This also applies after an account has been deleted. Stripe also keeps the data you entered at Stripe, in line with Stripe's own legal obligations.
- Waiting list: we keep your email address until we have sent the email saying the app is available. After that we delete the whole list. We don't use the waiting list for any other emails.
Deletion is permanent. There is no pause mode and no way to restore.
6. Who we share data with
We don't sell personal data. To provide the app, we work with these service providers (processors):
| Party | What for | Which data |
|---|---|---|
| Supabase | Database, file storage, sign-in | All data from the app and the waiting list |
| Stripe | Payments and subscriptions | Payment data, subscription status |
| Expo | Sending push notifications | The push token and the text of a notification. That text may contain your name and, for a hard moment, that you are asking for support. Expo does not keep the text after sending |
| Apple | Delivering push notifications to your iPhone | The push token and the text of a notification |
| Resend | Sending email: confirmations, password resets and invitations | Email address, name of the person inviting, the invitation link |
| Cloudflare (Turnstile) | Protection against automated sign-ups | IP address, browser and device characteristics |
| Vercel | Hosting the website sobreasy.nl | IP address of visitors, links for invitations and confirmations |
A data processing agreement applies with each processor.
Supabase's database and storage are located in the European Union (Amazon Web Services, Ireland region). Stripe, Expo, Apple, Resend, Cloudflare and Vercel are American companies. As a result, data may also be processed in the United States. This happens on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
7. Security
- Members only see what belongs to their own circle. This is enforced in the database itself.
- Test videos, chat photos and profile photos are kept in protected storage and can only be viewed via temporary links.
- Passwords are stored encrypted. When you sign up or change your password, we check whether it is known from leaked data.
- Signing in and registering are protected against automated attacks (Cloudflare Turnstile).
- Data travels encrypted (TLS) between the app and our servers.
8. Your rights
Under the GDPR you have the right to:
- access the data we hold about you
- have incorrect data corrected
- have your data deleted, or do this yourself via the settings in the app
- object to processing
- withdraw your consent for recovery data
- have your data transferred (data portability)
- lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or the data protection authority in your own EU country
For all of these requests, email support@sobreasy.nl. We will respond within one month.
9. Age
Sobreasy is only intended for people aged 18 and over. When you create an account, we ask you to explicitly confirm that you are 18 or older. We don't verify your age in any other way.
10. Cookies on sobreasy.nl
The website sobreasy.nl does not use tracking or advertising cookies. If we ever start doing so, we will update this statement beforehand and ask for your consent first.
11. Not medical advice
The information in the app about the recovery process, such as the timeline with phases from withdrawal to long-term health effects, is general and intended for information only. This information:
- is not medical advice, diagnosis or treatment
- is not a guarantee: everyone's body reacts differently, and timings can vary widely
- does not replace the advice of a GP or addiction care service
Unsure about withdrawal symptoms, or experiencing serious symptoms such as confusion, hallucinations, a seizure or severe shaking? That can be a medical emergency. Seek professional help immediately.
12. Changes
We may update this statement, for example for a new feature or a change in the law. If there is a significant change, we will let you know in advance via the app or by email. The date at the top shows when the statement was last updated.
13. Contact
Questions about this statement or about your data? Email support@sobreasy.nl.