REBUILD · PRIVACY
App Privacy Policy
Your recovery is personal. This page explains what REBUILD keeps on your device, what is processed online, and the choices available to you.
Effective date: 4 November 2026
1. Who is responsible
Alan Mc Govern, trading as Rebuild - The Recovery App, is the controller responsible for the personal data described here. Business address: 7 Ardmore Lane, Bettystown, Co. Meath, A92 X9T1, Ireland. Contact: support@rebuildrecoveryapp.com.
This policy covers REBUILD's recovery and life app, including its account, Community and service-funded access features. It also explains support enquiries made through the REBUILD website. It applies to features available in the version you use; an unavailable feature does not collect data simply because it is described here.
2. Account and sign-in information
When you create or use an account, we and our authentication provider, Clerk, process your email address, account identifier, verification and session information, and any account name you provide. Clerk and our hosting providers also process technical information needed to deliver and secure the service, such as IP addresses, browser or device information, request information and authentication events. These are distinct from the optional usage statistics described below.
We use account information to sign you in, protect access, manage memberships, answer account requests and associate your Community profile with your account. Without the required sign-in information, account-dependent features cannot work.
3. Private information stored on your device
The current app stores personal recovery settings and activity in local device/browser storage. This can include your preferred name, recovery start date, a manually entered emergency contact, check-in answers, reflections, personal plans, routine selections, workout progress and consistency records. An account-specific local storage area helps separate saved information between accounts on the same device.
Signing in is not a promise of cloud backup or automatic synchronisation of these records. Optional progress export/import, where available, creates or reads a file you control. Keep exported files private. Clearing app or browser storage, uninstalling the app or losing your device can remove locally saved information. Online Community content and membership records are separate from these private local records.
4. Community and event submissions
If you use Community, we process your account ID, nickname, preset avatar choice, rules acceptance, posts, replies, reactions, notifications, blocks, reports and moderation decisions. Where event submissions are available, we also process the event title, description, organiser name, venue/location, website, contact details and poster image you choose to submit. Provide other people's details or images only when you have permission.
Published posts, replies and event information can be seen by people with access to the relevant Community area. Submitted or held content can be accessed by authorised moderators for review. A nickname hides your legal name from other members only to the extent you avoid revealing it; your contributions remain linked to your account internally. Others may copy content they can see.
Recovery posts can reveal health information. Posts can also reveal other sensitive information, such as religious beliefs or disability. Share only what you intend others to see, avoid identifiable details about other people, and do not use Community as a private clinical record. We use contributions to provide the Community and moderate it, not to build advertising profiles.
5. Optional usage statistics
When you allow optional analytics, REBUILD sends limited usage events, including section/page views, selected tools and links, visible-page time, broad screen-size groups and broad referral categories. Our analytics records use fixed labels, a UTC day and aggregate counts or seconds. They do not contain account IDs, full URLs, journal entries, check-in answers or enquiry contents.
You can change the choice through Analytics choices where shown. Withdrawing consent stops future optional events; it does not identify and remove an individual's contribution from already aggregated totals. Necessary authentication, security and hosting processing continues independently of this choice.
6. Memberships and service-funded places
For a service-funded place, we process your recipient email, any name or reference supplied by the service, invitation and activation dates, access dates, issuing staff information and access status. The funding service can see the information needed to allocate and administer its places. It does not receive your private local journals, check-in answers or recovery activity through that allocation dashboard.
If you purchase a membership through an available checkout, the payment provider processes the payment details under its own terms. REBUILD may receive transaction references, membership status and information needed to grant access, provide support and meet accounting obligations. We do not need your full payment-card number. An iPhone purchase flow is not implied to be available by this policy; the checkout you actually use identifies the relevant provider.
7. Support and enquiries
If you email us or submit a website enquiry, we process your contact details, topic, message and relevant account or service information to respond. Website forms use Resend for email delivery and may store a copy in REBUILD's private owner enquiry dashboard. Please avoid sending unnecessary sensitive recovery or health details. We may ask for proportionate verification before disclosing or deleting account information.
8. Why we process information
Under the GDPR, our legal bases are performance of a contract for requested account and service features; legitimate interests in protecting the service, preventing abuse, moderating Community and handling enquiries; consent for optional analytics; and legal obligations for records we must keep. Our legitimate interests are operating a secure, reliable recovery-support service and protecting its users. You can object to processing based on legitimate interests.
Special-category information needs an additional legal condition. Where required, we must obtain explicit consent before processing it; where applicable, information you deliberately make manifestly public may be processed on that basis. Merely agreeing to this policy is not explicit consent, and sharing within a restricted group does not automatically make information manifestly public. Contact us if a contribution includes sensitive information you want removed.
9. Who receives information and international processing
Authorised REBUILD personnel and moderators access information needed for their roles. Service providers process information needed for authentication (Clerk), hosting/database/file storage (Cloudflare and the hosting platform), email delivery (Resend), and any payment service actually used. Community audiences and a funding service receive the limited information described above. We may disclose necessary information to comply with law, address serious abuse or protect people's rights and safety.
Some providers process information outside Ireland and the European Economic Area, including in the United States. Applicable transfers require a recognised adequacy mechanism, such as an eligible EU–US Data Privacy Framework certification, or appropriate safeguards such as Standard Contractual Clauses. Contact us for information about the safeguards relevant to your data. Provider information is available from Clerk, Cloudflare and Resend.
10. Retention and security
Local information remains until you remove it using available controls or clear the relevant device storage. Online account and Community information is retained while needed to provide the feature, until removed through applicable deletion controls, or while needed to resolve a request. Moderation and security records may be retained for a proportionate period to prevent abuse, investigate incidents or address claims. Support records are kept while needed to resolve the enquiry and related issues; billing records are kept for applicable legal retention periods. Backups can take additional time to expire.
We use access controls, protected connections and moderation controls appropriate to the service. No service or device storage can be guaranteed completely secure. Protect your device and email account, and sign out on shared devices.
11. Your choices, rights and deletion
You can use available profile, post and local-data controls to change or remove information. Community's account-deletion control removes or replaces its profile and contribution data and disables that Community account. This is separate from deleting every authentication, membership or support record. For deletion of your wider REBUILD account, or to clarify what remains, email support@rebuildrecoveryapp.com. Deleting local app data alone does not delete online records, and deleting an account does not necessarily cancel an app-store subscription.
Subject to applicable conditions, you may request access, correction, erasure, restriction, portability or object to processing. You may withdraw consent without affecting prior lawful processing. We normally respond to rights requests within one month; a lawful extension may apply to complex requests. You may complain to Ireland's Data Protection Commission or your local supervisory authority.
12. Age, external services and changes
REBUILD is intended for adults aged 18 and over. We do not knowingly invite children to create accounts. An App Store age rating is not an identity or age-verification system. Contact us if you believe a child has provided account information.
External links open services with their own privacy practices. REBUILD does not make automated decisions with legal or similarly significant effects based on private recovery entries. Automated Community checks can flag content for moderation; contact support to question a moderation decision.
We will update this policy when data practices change and update the effective date. Material changes will be brought to your attention as appropriate. Any new purpose requiring consent will require a separate choice. REBUILD supports recovery and wellbeing; it is not an emergency or clinical monitoring service.
Questions or requests? Contact REBUILD support.