Privacy Policy

1. Who we are

Soberio is a personal habit-tracking application. The service is operated as a private project. For questions about your data, contact us at privacy@soberio.app.

2. What data we collect

We collect and store the following data when you use Soberio:

• Account data: username, email address, and a hashed (bcrypt) password. Your plain-text password is never stored.
• Habit logs: dates, amounts, and optional notes for alcohol, nicotine, and gambling habits that you choose to log.
• Preferences: currency, weekly spend estimate, tracked habits, achievement IDs, and notification preferences.
• Technical data: hashed refresh tokens (for keeping you logged in) and hashed one-time tokens (for password reset and email verification). These are automatically deleted when expired.
• Support Circle: if you invite someone as a supporter, their email address and the status of the invite are stored.

3. How we use your data

Your data is used exclusively to provide the Soberio service to you:

• Displaying your habit logs, streaks, and progress.
• Sending transactional emails (welcome, password reset, email verification, achievement notifications) — only if you have not opted out.
• Sharing selected progress data with supporters you have explicitly invited.

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as strictly necessary to provide the service (e.g. the transactional email provider Resend).

4. Legal basis (GDPR)

For users in the EU/EEA, we process your personal data on the basis of contract (Art. 6(1)(b) GDPR) — processing is necessary to provide you with the service you have signed up for. Transactional emails are sent on the same basis.

5. Data storage and retention

Data is stored in a MongoDB database. Your account data and habit logs are retained for as long as your account is active. Expired tokens (refresh, password reset, email verification) are automatically deleted by database TTL indexes.

When you delete your account (Settings → Danger Zone), all your data — including your profile, all habit logs, and all tokens — is permanently and immediately deleted.

6. Your rights (GDPR)

As a data subject you have the following rights:

• Right of access (Art. 15): You can view all your data in Settings and export a full copy using the "Download my data" button.
• Right to rectification (Art. 16): You can update your username, email, and other account details in Settings.
• Right to erasure (Art. 17): You can permanently delete your account and all associated data in Settings → Danger Zone.
• Right to data portability (Art. 20): Use the "Download my data" button in Settings to receive a JSON copy of your data.
• Right to object / restrict processing (Art. 18, 21): Contact us at privacy@soberio.app.

7. Cookies and local storage

Soberio does not use tracking cookies, advertising cookies, or analytics cookies. We do not use Google Analytics or similar third-party tracking services.

The application uses browser localStorage (not cookies) to store your authentication tokens (access token and refresh token) on your device. These are necessary for you to remain logged in and are not used for tracking.

Your theme preference (light/dark) and language preference may also be stored in localStorage. These never leave your device.

8. Security

Passwords are hashed with bcrypt before storage. Authentication tokens are rotated on each use. All API traffic is served over HTTPS. Security headers (via Helmet.js) are applied to all responses.

9. Contact and complaints

For any privacy-related question, please contact privacy@soberio.app. You also have the right to lodge a complaint with your national data protection authority (in Sweden: Integritetsskyddsmyndigheten, imy.se).