Privacy Policy

Last updated: 9 July 2026

This Privacy Policy explains how S&C Development GmbH ("Gracen", "we", "us", "our") collects, uses, shares and protects your personal data when you use the Gracen mobile application, the Gracen website and sign-up funnel, the Gracen browser extension, and any related products and services (together, the "Service").

We are the data controller for the personal data described in this Policy.

We are based in Germany, and most of our users are in the United States. Depending on where you live, either the EU General Data Protection Regulation (GDPR) or US state privacy laws (such as the California Consumer Privacy Act) give you specific rights, which are described in the "Your rights" sections below.

Please read the section on sensitive data carefully. Gracen is a recovery app. Some of the data we process — for example your onboarding answers and your relapse and streak history — can reveal information about your sexual behaviour. We treat this as sensitive information and only process it with your explicit consent, as explained below.

1. The data we collect

1.1 Data you give us

• Account data — your name or display name, email address, and the authentication identifier from the method you sign in with (Sign in with Apple, Google, or email). We do not receive or store your Apple/Google password.
• Onboarding and assessment data — the answers you give in the onboarding quiz, including your age or age range, gender, and questions about your pornography use, goals and motivations. Because some of these answers concern your sexual behaviour, we treat them as sensitive data (see Section 3).
• Subscription and purchase data — the plan you buy, purchase and renewal history, and (for website purchases) billing details. Card and bank details are collected and processed directly by our payment processor (Stripe); we do not store your full card number.
• Community content — the posts, comments, reactions and display name you create in the in-app community. This content is visible to other users (see Section 4).
• Accountability Partner data — the partners you invite or accept, the names or nicknames you or they provide, and your notification preferences.
• Support and communications — the content of messages you send us and your contact details.

1.2 Data we collect automatically

• Usage and device data — IP address, device type and identifiers, operating system, app version, in-app activity, dates and times of use, and diagnostic data.
• Session replay and analytics — anonymised or pseudonymised recordings of screens and interactions used to understand and improve the Service, through third-party analytics and session-replay tools.
• Crash and performance data — error and crash reports, through a third-party crash-reporting tool.
• Marketing and attribution data — data about how you found and installed the app and how our campaigns perform, through advertising and attribution partners. See Section 6 on advertising.

1.3 Content Filter data

The Content Filter runs entirely on your device. On iOS it uses Apple's Screen Time (Family Controls) framework; on Android it uses an on-device VPN/DNS filter; and in the browser our extension filters locally. We do not collect, transmit or store the websites you visit, the domains the filter blocks, or your browsing history. Your filter settings stay on your device.

1.4 Accountability Partner data

When you use the Accountability Partner feature, we process:

• the partner connections you create — the name or nickname you or your partner provide, and the account/device identifier needed to link you;
• the streak and progress information you share with a partner (for example your current streak length); and
• the messages you exchange with your partner in the app.

We use this only to operate the accountability features you have chosen to enable.

2. Why we use your data and our legal bases (GDPR)

Where the GDPR applies, we rely on the following legal bases:

You can withdraw any consent at any time (see Section 10). Withdrawing consent does not affect processing that already took place.

3. Sensitive data (special category data)

Some data we process reveals information about your sex life or sexual behaviour — in particular your onboarding answers and your relapse and streak history. Under the GDPR this is "special category" data (Art. 9); under US state laws it is "sensitive personal information".

We process this data only on the basis of your explicit consent, which you give when you complete onboarding and when you choose to share progress with an Accountability Partner. You can withdraw this consent at any time by removing a partner or deleting your account. We apply extra safeguards to this data, including strict access controls and encrypted transmission.

We never sell this sensitive data, and we do not use it for advertising.

4. The community and other users

The Gracen community lets you post and comment. Anything you post can be seen by other users of the Service, and you should assume it may be copied or shared beyond the app. Please do not post information you want to keep private. You can post under a display name rather than your real name. We moderate the community and can remove content and suspend accounts as described in our Terms & Conditions.

5. Accountability Partners

The Accountability Partner feature lets you connect with people who support your progress:

• You can share your streak and progress with a partner and exchange messages with them in the app.
• Partner connections are created only through your invitation, your acceptance, or opt-in matching that you consent to. You control who you connect with.
• You can remove a partner at any time in the app; when you do, or when you delete your account, the connection ends and related data is deleted.

By connecting with a partner you consent to sharing your streak/progress and messages with that person. If you are matched with or invited by another user, we process your name/nickname and the identifier needed to link your accounts, based on our legitimate interest in operating the feature you have joined.

6. Advertising, analytics and cookies

We use analytics and session-replay tools to understand how the Service is used, and advertising and attribution tools to measure and improve our marketing. Some of this activity may qualify as "targeted advertising" or "sharing" of personal data under US state laws.

• In the app: where required, we ask for your permission before tracking (including Apple's App Tracking Transparency prompt on iOS). You can change tracking permissions in your device settings.
• On our website/funnel: we use cookies and similar technologies for essential functions, analytics and advertising. Non-essential cookies and trackers are only set with your consent through our cookie banner, which also lets you withdraw consent.
• Opt out: you can opt out of advertising-related sharing at any time by declining tracking, adjusting your device settings, using the cookie banner on our website, or contacting us at support@gracen.app.

We never use your sensitive data (Section 3) for advertising.

7. Who we share data with

We do not sell your personal data. We share it only with:

• Service providers (processors) who process data on our behalf under contract, in the following categories: cloud hosting and database providers (located in the United States); payment processors; subscription-management and paywall providers; product-analytics and session-replay providers; crash- and error-reporting providers; advertising and attribution partners; email and messaging providers; and the app-store, sign-in and push-notification providers needed to operate the app.
• Your Accountability Partners, as described in Section 5, with your consent.
• Other users, for anything you post in the community (Section 4).
• Acquirers, if we are involved in a merger, acquisition or sale of assets, in which case we will require the recipient to honour this Policy.
• Authorities or advisors, where we are legally required to disclose data, or to establish, exercise or defend legal claims.

A current list of our subprocessors is available on request at support@gracen.app.

8. International data transfers

Our backend and several of our providers are located in the United States, so your data is processed there. If you are in the European Economic Area, the UK or Switzerland, this is an international transfer. We rely on appropriate safeguards for these transfers, principally the European Commission's Standard Contractual Clauses (and the UK Addendum / Swiss equivalents) with the providers concerned, together with additional technical and organisational measures. You can request more information or a copy of the relevant safeguards at support@gracen.app.

9. How long we keep data

• Accountability Partner data (connections and messages): kept for the duration of the connection; deleted when you remove the partner or delete your account.
• Account and profile data: kept while your account is active and deleted after account deletion, except where we must keep it longer.
• Invoices and tax records: kept for the statutory retention periods under German commercial and tax law (generally up to 10 years).
• Analytics, crash and marketing data: kept only as long as needed for the purpose, then deleted or aggregated/anonymised.

We may retain limited data longer where necessary to comply with legal obligations, resolve disputes or enforce our agreements.

10. Your rights (EEA / UK / Switzerland — GDPR)

You have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and to withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), but you may also contact the authority where you live.

To exercise your rights, use the in-app account settings or email support@gracen.app. We will respond within the timeframes required by law.

11. Your rights (United States)

Depending on your state (for example California, Virginia, Colorado, Connecticut, Utah, Texas and others), you may have the right to:

• know/access the personal information we have collected about you;
• delete your personal information;
• correct inaccurate personal information;
• opt out of the "sale" or "sharing" of personal information and of "targeted advertising";
• limit the use of sensitive personal information; and
• be free from discrimination for exercising these rights.

We do not sell your personal information for money. As explained in Section 6, some advertising activity may be considered "sharing" or "targeted advertising" — you can opt out at any time by declining tracking, using our website cookie banner, or emailing support@gracen.app. To make any other request, email support@gracen.app. You may use an authorised agent, and we will verify your request before acting on it.

California "Shine the Light": you may request information about disclosures of personal information to third parties for their direct marketing purposes; we do not make such disclosures.

12. Children and minors

Gracen is intended for users aged 13 and older. It is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has provided us with personal data, contact us at support@gracen.app and we will delete it.

Users aged 13–17. If you are under the age of majority where you live (usually 18), you may use Gracen only with the involvement and permission of a parent or guardian, who should review these terms and this Policy with you. Where the law requires a parent's consent for a minor to use a service like ours — for example users under 16 in the EEA, or as otherwise required by your country or US state — we rely on that parental consent. A parent or guardian may contact us at support@gracen.app to review, correct or delete their child's data.

Advertising and minors. We do not use the data of users we know to be minors for targeted advertising, and we do not "sell" or "share" (as those terms are defined under US state privacy laws) the personal information of users we know to be under 16. We never use minors' sensitive data for advertising.

13. Security

We use commercially reasonable technical and organisational measures to protect your data, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

14. Third-party links

The Service may link to third-party sites and services that we do not control. This Policy does not apply to them, and we encourage you to read their privacy policies.

15. Changes to this Policy

We may update this Policy from time to time. The current version is always posted here with its "Last updated" date, and changes take effect when posted. If we make material changes, we will provide additional notice where required by law (for example, in the app or by email).

16. Contact

For our company details, see our Impressum.