Privacy Policy

Last updated: July 17, 2026.

1. Introduction

Sukr ("we," "us") is a mobile app and website built to help you cut back on sugar, without shame. Privacy is central to how we build: we practice data minimization (we collect only what we need), we host in the European Union, and you can delete everything from the app. This policy explains what data we handle and why.

2. Data we collect

• Anonymous account: a technical identifier is created when you first open the app, with no email or name. If you choose to sign in with Apple, Google, or email, we store that sign-in identifier so your progress can follow you across devices.
• Profile derived from onboarding: a score and a few markers (severity, triggers, a sugar reference point, an estimate of what you spend). Your raw questionnaire answers stay on your device and are never sent to us.
• Progress: your streak, your daily check-ins, and your cravings journal, synced so we can carry your progress from one session to the next.
• Support circle (if you turn it on): your nickname, your streak, your status for the day, and the encouragements you exchange. The people in your circle never see your journal or a slip.
• Notifications (if you turn them on): a device token so we can send reminders and encouragements.
• Waitlist (on this website): if you leave your email (and, for the Android beta, your first name and phone model) to hear about the launch.

3. How we use your data

We use this information only to:

• give you a personalized plan and power your streak and daily check-in;
• send you reminders and your circle's encouragements, if you allow them;
• reach out about the launch if you are on the waitlist;
• improve the app (in aggregate, without re-identifying you).

4. Sharing and service providers

We never sell your personal information. We rely on a small number of technical providers:

• Supabase: database and authentication, hosted in the European Union.
• Expo Push (and Apple / APNs): delivering notifications, if you turn them on.
• Vercel: hosting for this website.
• RevenueCat: subscription management; the payment itself is handled by the App Store or Google Play.
• PostHog: product analytics, hosted in the European Union, to understand app usage in aggregate. This is a first-party tool with no advertising identifier; it helps us make the app better and is not used to track you across other apps or websites.
• Meta (Facebook): measurement and optimization of our advertising (install attribution). This runs only if you allow tracking in the App Tracking Transparency prompt (see §9). If you decline, no data is shared for advertising purposes and Apple's privacy-preserving SKAdNetwork is used instead.
• Google (Gemini): image analysis for the SukrLens feature (estimating the sugar in a food you choose to photograph). The photo is sent resized and stripped of metadata (no GPS location, no date), processed ephemerally and then deleted: we never store it, on our servers or Google's. No other account data travels with the photo.

This list will evolve with the app; any new measurement would use an EU-hosted tool and would be documented here.

5. Your choices

• turn notifications on or off from the app or your phone settings;
• join or leave a support circle at any time;
• unsubscribe from the waitlist in one click from any email;
• delete your account and all of your data from the app.

6. Your U.S. privacy rights

Depending on where you live in the United States (for example, California under the CCPA/CPRA, and states with similar laws), you may have the right to:

• know what personal information we hold about you and access it;
• delete your personal information;
• correct inaccurate personal information;
• opt out of any "sale" or "sharing" of your personal information. We do not sell your data. We only share advertising-measurement data with Meta if you opt in through the App Tracking Transparency prompt, and you can decline or change your mind at any time.

You can exercise the deletion right directly in the app (Profile → Delete my account), or contact us at contact@stopsukr.com. We will not discriminate against you for exercising any of these rights.

7. Data retention

Your data is kept while you use the app, then deleted at your request. Waitlist emails are kept until the launch, then to let you know about new features until you unsubscribe.

8. Security

Access to your data is protected row by row: on our database, security rules (Row Level Security) ensure you can only reach your own data. Traffic is encrypted in transit (HTTPS) and we apply the principle of least privilege on the server side.

9. Tracking & advertising (App Tracking Transparency)

To measure how well our ads work, Sukr can use the Meta SDK and your device's advertising identifier. In line with Apple's rules, we ask through the App Tracking Transparency (ATT) prompt. If you allow it, we turn on advertising measurement. If you decline, no cross-app tracking is enabled. You can change your mind anytime in iOS Settings → Privacy & Security → Tracking. Product analytics (PostHog, described in §4) is first-party and EU-hosted, and runs to improve the app regardless of this choice.

10. Children

Sukr is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us data, contact us and we will delete it.

11. Cookies

This website does not use advertising cookies or third-party trackers. Only elements strictly necessary for the site to work may be used.

12. Contact

Questions about your data? Email us at contact@stopsukr.com.

13. Changes

We may update this policy. If something material changes, we will let you know in the app or by email. The last-updated date appears at the top of this page.