Privacy Policy

Section 01Who we are

Cold Streak (“Cold Streak,” “we,” “us”) is operated by [COMPANY NAME], [ENTITY TYPE, e.g. a Delaware LLC], registered at [COMPANY ADDRESS]. We are the data controller for the information described in this policy.

Questions, requests, or complaints: support@coldstreak.app. A real person answers.

Section 02What stays on your phone

Cold Streak is built local-first on purpose. Your recovery data is stored in the app’s private container on your device, and every number the app shows you is calculated there. None of the following is transmitted to us:

• Your quit date and your stated weekly betting spend
• Your streak, best streak, and rewiring progress
• Your money-kept total, milestones and projections
• Relapse logs, including amounts and any notes you add
• Urge / panic-button sessions and their outcomes
• Your “why” note and any voice memo you record for it
• Your onboarding quiz answers and your dependency score
• Your 90-day program progress
• Your Game-Day Shield windows and notification settings
• Which apps or sites you chose to block

Two consequences worth knowing. First, if you have iCloud device backup enabled, a copy of this data may be included in your encrypted Apple backup — that is controlled entirely by your Apple settings, not by us. Second, if you delete the app without exporting first, that data is gone and we cannot restore it, because we never had it.

Screen Time / blocking: app and website blocking uses Apple’s Screen Time (Family Controls) framework. Apple’s design keeps your app-usage data on-device and shields it from us — we can tell that a blocking rule is configured, not what you used or when.

Section 03What we actually receive

Community posts, upvotes, reports and blocks

The feed cannot work without a server. When you post, upvote, report a post, or block a member, we receive the content or the action, the timestamp, and a device-derived identifier (described just below). Posts are visible to anyone using the app. We do not require your real name, and we ask you not to put identifying details — your name, employer, exact location, or anyone else’s information — into a post. Once you publish, other members can see it and may quote it elsewhere.

Being straight about moderation: posts are screened automatically at the moment you publish — length, links, promo codes, sportsbook solicitation, tout services, and abuse aimed at another member. There is no reply feature. There is no full-time moderation team reading the feed. When enough different members report the same post it drops out of the feed automatically, and reporting a post also hides it from you straight away. If something needs a human, email us at support@coldstreak.app.

Device-derived identifiers

There are no accounts here — no email, no password, no phone number. Instead your device sends an anonymous identifier supplied by Apple, which our server immediately turns into a one-way salted hash. We store only that hash, never the original. It is what lets you delete your own post, keeps one upvote to one device, and gives you the same pseudonymous handle each time you post.

Being precise, because it matters: that hash is stable. It links every post, upvote, report and block from your device to each other for as long as those records exist. It is not linked to your name, your email, or your on-device recovery data, and it cannot be reversed into an identifier Apple or a sportsbook could use. But it is a persistent pseudonymous identifier, it is declared as such on our App Store privacy label, and you should read “anonymous” here as “pseudonymous”. Erasing your data (Section 06) removes those records.

AI sponsor chat

When you message the AI corner man, your message is sent to our server and then to our AI provider (Anthropic) so a reply can be generated. Treat it like a text message to a stranger who is trying to help: useful, but not the place for your bank details or anyone’s full name.

We do not keep chat transcripts. Our server holds your messages only for the seconds it takes to get a reply back to you; there is no transcript database and nothing to delete later. The trade-off is honest: it also means we cannot review a conversation after the fact if you report a problem with one, and we cannot produce one if you ask for it. Your side of the conversation stays on your phone.

Subscription status

Purchases go through Apple. Apple bills you; we never see your card number, billing address, or Apple ID password. We receive a subscription state (active, lapsed, which plan) via our purchase infrastructure so the app knows whether to unlock.

Diagnostics and product analytics

We collect aggregate, event-level usage data — screens opened, funnel steps completed, crashes — tied to a random install identifier, not to your name. Recovery content is never sent to analytics: no relapse notes, no why-note, no chat messages, no dollar amounts. You can turn analytics off in Settings → Privacy & Data.

Support email

If you email us, we have your email address and whatever you wrote, for as long as we need it to help you and keep a record of the request.

Section 04Who else touches data

We keep this list short and we keep it current. These are processors acting on our instructions, not partners we sell to.

We may also disclose information if we are legally required to (a valid subpoena, court order, or law), or where we believe in good faith that disclosure is necessary to prevent imminent serious harm to someone. If we are ever acquired, this policy travels with the data and we will tell you before anything changes.

Section 05What we never do

This section is the point of the whole document, so it is deliberately blunt.

• We do not sell or rent personal information. Not now, not as a “partnership,” not in aggregate-with-a-wink.
• We do not share data with sportsbooks, betting operators, affiliates, or their advertisers. A list of people trying to quit gambling is exactly the list a sportsbook would pay most for. They will not get it from us.
• We do not use your recovery data for advertising or targeting, on our own services or anywhere else.
• We do not sell data to brokers or contribute to identity graphs.
• We do not require your real name to use the community.
• We do not read your on-device data. It isn’t a promise about restraint; the architecture doesn’t send it.

Section 06How to delete everything

There are two paths and both work.

1. In the app: Settings → Privacy & Data → Erase my data. This wipes everything stored on your device — your streak, your money-kept figures, your quiz answers, your “why” note and voice memo, and every check-in. It happens immediately, not on a queue, and it cannot be undone. Anything you published to the community feed lives on our server and is not covered by this button; use the email path below for that.
2. By email: write to support@coldstreak.app from the address you contacted us with, or include your in-app handle. We will complete the deletion within [30] days and confirm when it is done.

Three honest caveats. Deleting the app from your phone removes the local data but does not delete community posts you already published — use the in-app erase or email us for that. There is nothing to erase for sponsor chat, because we never stored it. And if another member has blocked you, that block survives your erasure — it is their safety setting, not your data, and wiping your own records must not be a way to clear it.

You can also export your data as a JSON file: Settings → Privacy & Data → Export. It is generated on your device.

Section 07How long we keep things

• On-device data: until you delete it or delete the app. We hold no copy.
• Community posts, upvotes, reports and blocks: until you erase them, you delete them, or we remove them. Nothing expires on a timer today.
• Sponsor-chat messages: not stored. Held in memory only for the length of the request.
• Analytics events: [ANALYTICS RETENTION, e.g. 14 months], in aggregate.
• Support email: [SUPPORT RETENTION, e.g. 24 months].
• Records we must keep by law (tax, accounting, fraud): as long as the law requires.

Section 08Legal bases & your rights

If you are in the UK, EEA, or another region with comparable law, we process personal data on these bases: contract (running the account, community and chat features you asked for), legitimate interests (keeping the service safe, moderating abuse, understanding aggregate product usage), consent (optional analytics, push notifications — withdrawable at any time), and legal obligation where it applies.

You have the right to access, correct, delete, restrict, or object to our processing, and the right to data portability. Ask at support@coldstreak.app and we will respond within the statutory window. You can also complain to your local supervisory authority.

Data may be processed in the United States. Where transfers require a safeguard, we rely on [TRANSFER MECHANISM, e.g. Standard Contractual Clauses].

Section 09US state privacy rights

If you live in California, Colorado, Connecticut, Virginia, or another state with a comprehensive privacy law, you may have rights to know, access, correct, delete, and to opt out of sale, sharing, or targeted advertising.

We do not sell or share personal information as those laws define it, and we do not run targeted advertising, so there is no opt-out to give you — but the access, correction and deletion rights all apply and you can exercise them at support@coldstreak.app. We will not discriminate against you for asking.

Section 10Security

Data in transit is encrypted with TLS. Backend access is limited to people who need it and is logged. The main security control is architectural: your streak, your relapse log, your money figures and your “why” note are never sent to our server, so a breach of it cannot expose them. That was a design decision, not an afterthought.

What a breach would expose is what you chose to publish: your community posts, their timestamps, your handle, and the one-way device hash that links them to each other. That hash cannot be reversed into a device identifier, an email, or a name. We are saying it plainly rather than leaving you to infer it, because a list of people trying to quit gambling is exactly the list that would be worth stealing.

No system is perfectly secure. If we discover a breach affecting your data, we will notify you and any required regulator as the law demands and as fast as we can reasonably confirm what happened.

Section 11Children

Cold Streak is for adults: 18 or older. It is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a minor has used the app, contact support@coldstreak.app and we will delete the account and its data.

Section 12This website

This site sets no cookies, runs no advertising or tracking pixels, and has no analytics on it. The only third-party request the page makes is to Google Fonts for the typefaces, which means Google receives your IP address as part of that request.

Section 13Changes

If we change this policy we will update the “last updated” date at the top. For a change that materially affects your rights, we will tell you in the app before it takes effect — not by quietly editing this page.

Section 14Contact

[COMPANY NAME]
[COMPANY ADDRESS]
support@coldstreak.app

For product help and FAQs, see Support. For the rules of using Cold Streak, see the Terms of Service.