Plain-language summary: Your logs, notes, check-ins, and streak stay on your own device by default — we cannot see them. Three kinds of features send data off your device, and each is clearly disclosed and opt-in: AI features (Coach chat, daily lessons, and daily affirmations, powered by Anthropic's Claude), Ally (a private link with one accountability partner), and Community (an anonymous peer feed). You choose whether to turn AI features on, and Ally/Community only activate if you open them. We have no email or real identity for you, and we never sell or share your data.
UrgeAnchor ("we", "us") provides this application. For privacy questions, contact: urgeanchor@outlook.com.
The following is stored only in your device's local storage. It is never transmitted to us or any third party:
Your private journal is private. These entries are not part of Ally or Community and never leave your device. We do not collect your name (unless you type a nickname), email, phone number, contacts, precise location, IP-based location, device identifiers, photos, video, audio, or any explicit content.
Your on-device data is used only on your device to power the app's features — your streak, momentum, patterns, and personalised plan. Because processing happens locally, no one, including us, can access these entries.
UrgeAnchor's AI Coach ("Melius"), daily lessons, and daily affirmations are generated using Anthropic's Claude API. These are off by default — the app asks for your explicit consent during onboarding, and you can turn them on or off anytime in Settings → Privacy & data → AI features. Until you turn them on, these features run on a local, non-AI fallback and nothing is sent anywhere.
What is sent, and to whom, when AI features are on:
Where it goes: our backend server (hosted on Render) receives the request and calls the Anthropic API; Anthropic processes the text to generate a response and does not retain it for model training. We do not use this data for advertising or profiling.
Turning it off: if you decline or turn AI features off, the Coach becomes unavailable, and lessons/affirmations fall back to a fixed, non-personalised local set — no data leaves your device for these features.
Ally and Community are the only parts of UrgeAnchor that send anything to a server, and only if you choose to use them. If you never open them, nothing about you leaves your device.
To make them work we create an anonymous account for you with our backend provider, Supabase. This account has no email, no password, and no name — just a random identifier. We never ask who you are, and we assign you a random pseudonym (for example, "Quiet River") that cannot be traced back to you.
What is stored on the server when you use these features:
Who can see it: Ally messages are visible only to you and the one partner you linked with. Community posts are visible to other signed-in members of the community. Access is enforced by database row-level security, so people can only read what they are allowed to.
Because Community posts are visible to other people, please do not include your real name, contact details, links, or anything that identifies you. Treat it like a public, anonymous forum. Content is moderated (see our Community Guidelines): links, slurs, and solicitation are blocked automatically, you can report or block others, and heavily-reported posts are hidden.
Where it is stored: on Supabase's servers in the European Union (Frankfurt region). Supabase acts as our data processor. We do not use this data for advertising or profiling, and we do not sell it.
The Safety section shows helpline numbers based on the country you select. Selecting a country only changes which numbers display; it is stored locally. Tapping a helpline hands off to your device's phone or browser and that third party's own terms.
UrgeAnchor is for adults 18 and over. An age check is required, and selecting "under 18" ends onboarding — no further quiz answers, AI features, Ally, or Community access are offered. We do not knowingly collect data from anyone under 18. If you are under 18 and need support, please contact a trusted adult or a local helpline.
Some features are part of a paid subscription. Billing is handled by the platform's official app store, and Apple (Apple Distribution International Ltd.) is the seller and merchant of record for App Store purchases — your payment contract is with Apple, not with us. We never see or store your card details, and we receive no payment information from Apple beyond whether your subscription is active.
We use RevenueCat to tell the app whether your subscription is active. RevenueCat receives an anonymous identifier and your purchase status from the store; it does not receive your name, email, or anything you write in the app. RevenueCat acts as our data processor.
Refunds and cancellations are handled by Apple, not by us — see reportaproblem.apple.com and Section 6 of our Terms of Service.
Depending on where you live (e.g. the EU/UK under GDPR, or California under CCPA) you may have additional rights, including access, correction, and erasure of the pseudonymous data held for Community/Ally. Contact us to exercise them.
Sensitive data. Some of what you may write in this app — Coach messages, Ally messages, Community posts, and the recovery context sent for lessons and affirmations — can reveal information about your health or your sex life. Under the GDPR that is “special category” data and gets extra protection.
Our legal basis is your explicit consent (Articles 6(1)(a) and 9(2)(a)). Nothing sensitive leaves your device unless you choose it:
Everything else — your journal, urge logs, check-ins, quiz answers, values — never leaves your device at all, so we are not processing it.
You can withdraw consent at any time by turning AI features off, by leaving Ally or Community, or by using “Delete all my data” in Settings. Withdrawing does not affect the lawfulness of processing that already happened.
How long we keep it. Server-side data (your anonymous account, pseudonym, streak count, Ally messages, Community posts) is kept until you delete it or your account becomes inactive. “Delete all my data” removes it immediately. Coach messages are sent to generate a reply and are not stored by us as a conversation history on the server. On-device data stays until you delete it or remove the app.
Complaints. If you think we have handled your data wrongly, please tell us first and we will try to put it right. You also have the right to complain to your data protection authority. In Finland, where we are based, that is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi. If you are elsewhere in the EU or UK, you can complain to your own national authority.
On-device data is stored in your operating system's local storage, protected by your device's own security; the app does not add its own encryption, so consider a device lock. AI, Community, and Ally data is transmitted over encrypted connections (HTTPS); Community/Ally data is protected on the server by row-level security so users can only access what belongs to them or has been shared with them.
If this policy changes, the "Last updated" date changes. Material changes (new data collection, analytics, or changes to how AI, Community, or Ally data is handled) will be highlighted in the app.