Privacy Policy

Who we are

The Unbroken app and keepunbroken.com are run by Unbroken ("we", "us"). We are the data controller for the personal data described here, under the EU/UK GDPR and Turkey's Personal Data Protection Law No. 6698 (KVKK).

Questions or requests: [email protected].

What we collect

• Account: your name, e-mail address and sign-in method. With e-mail sign-up your password is stored only as a secure hash. With Google we receive your name, e-mail and profile photo; with Apple your name (first sign-in only) and your e-mail, which can be a private relay address.
• Profile: profile photo, bio, your device's timezone (so deadlines match your day), app language, notification preferences and your mascot's outfit.
• Snaps and activity: the photos you take or pick as snaps, when you sent them and to which chain; reactions, quick replies and nudges; streaks, streak saves, badges, points and your clan.
• Social: the chains you create or join, invites, join requests, friends and follows.
• Subscription: whether you have Unbroken Pro and until when. Payment is handled by Apple or Google; we never see your card details.
• Device: a push notification token, so we can send you notifications.
• Crash reports and usage events (when enabled): an anonymous user ID, app version, device model and OS version, and events such as "snap sent" or "paywall opened". No names, e-mails or photos.
• Reports and blocks: reports you send about other people or snaps, and the people you blocked.

Some data stays only on your phone: snaps waiting to upload while you're offline, your appearance and language choices, and the data shown in the home screen widget.

We don't collect your location (only the timezone), contacts, advertising ID or audio. The app never records sound; the microphone permission exists only because it's part of the camera component.

How we use it

• to run the app: chains, daily deadlines, streaks, snaps, clans, leaderboards and the weekly recap;
• to show your snaps and progress to the people in your chains;
• to send notifications: reminders before a deadline, when a teammate snaps, nudges, invites and similar (you can turn categories off in Settings → Notifications);
• to provide Pro and apply the free plan limits;
• to keep Unbroken safe: handling reports, limiting spam and abuse;
• to fix crashes and understand which features are used, in aggregate.

We don't show ads, we don't sell your data and we don't build advertising profiles.

Legal bases: performing our contract with you (running the service), our legitimate interests (security, fixing and improving the app), your consent (push notifications, camera and photo access — you can withdraw it any time in your device settings) and legal obligations.

Who can see what

• Private chains (the default): only members, people invited to the chain and people who asked to join can see the chain, its members and its snaps.
• Public chains: any signed-in Unbroken user can see the chain, its members and its snaps. Only Pro members can make a chain public.
• Your profile is visible to signed-in users: name, photo, bio, timezone, clan, badges, streaks and stats, Pro status and follower counts. Profile photos are stored at public web addresses.
• Leaderboards list users with their name, photo, streaks and success rate.
• Search: people can find you by your name or by typing your exact e-mail address. Your e-mail is never shown to other users.
• Notifications we send to others can include your name (for example "Maya snapped").

Snap photos are stored privately and opened through temporary links that expire after 24 hours.

Service providers

We share data only with providers that help us run Unbroken, only as much as they need:

• Our backend servers (Supabase, run by us): database, file storage and sign-in.
• Apple and Google: Sign in with Apple / Google Sign-In, App Store and Google Play payments, and push delivery.
• Expo (push notifications): your push token and the notification text.
• RevenueCat (subscriptions): your anonymous user ID and purchase status; no name or e-mail.
• Sentry (crash reports) and PostHog (product analytics, EU servers): anonymous user ID, device and app info, usage events.
• DiceBear: draws a default avatar from your random user ID if you have no photo.
• Unsplash: chain cover photos; it receives only the category words you search.

We may disclose data if the law requires it, to protect people from harm, or as part of a merger or sale of the service (you would be told first).

International transfers

Some providers above process data outside your country, including in the United States. Where the law requires it, these transfers are covered by appropriate safeguards such as the European Commission's standard contractual clauses or the standard contracts under KVKK.

How long we keep it

• Account, profile, snaps and activity: as long as your account exists, or until you or the chain removes them.
• Chains that ended more than 30 days ago are moved to an archive with their members' names, photos and snaps, so the chain's history stays complete for everyone in it. When you delete your account, you and your snaps are removed from archived chains too.
• Backups: up to 14 days, then overwritten.
• Reports stay after an account is deleted, without the link to that account, so we can handle abuse.
• Notifications you caused in other people's inboxes can keep your name as text.

Deleting your account

You can delete your account in the app any time: Profile → Settings → Delete account. Your profile, snaps, check-ins, reactions, friends, clan membership and notifications are deleted; chains you created that still have members are handed over to the longest-standing member. Details: Delete your account.

Your rights

Depending on where you live (for example under the GDPR or Article 11 of KVKK), you can ask to access your data, get a copy of it, correct it, delete it, restrict or object to its use, and withdraw consent. You can edit your profile and delete your account yourself in the app; for everything else, including a copy of your data, write to us.

E-mail [email protected] from the address of your account. We answer within 30 days. You can also complain to your data protection authority (in Turkey: the Personal Data Protection Authority, KVKK).

Security

Data travels encrypted (HTTPS). Access rules in the database decide who can read each chain and snap, snap files are private, and passwords are hashed. No system is perfectly secure, so please use a strong password and tell us if you notice anything wrong.

Children

Unbroken is not meant for children under 13 (or the higher minimum age for using online services on your own in your country). We don't knowingly collect their data; if we learn a child's account exists, we delete it. Parents can contact us.

Changes to this policy

When we change this policy we update the date above; for important changes we also tell you in the app before they apply.

Contact

Unbroken · [email protected]