Privacy Policy

Last updated: 22 October 2026

Dopamind is owned and operated by PixelnStack ("we", "us"), and it is built around one principle: your recovery is nobody's business but yours. This policy explains what data the Dopamind app and this website handle, who else touches it, and how to erase it.

1. Data on your device, and what leaves it

Dopamind is offline-first. Your streak history, daily check-ins, journal entries, mood logs, challenge progress and settings are written to your device first and are always readable there, with or without a network connection. Your device is the source of truth. Deleting the app removes everything stored on it.

A backup copy is kept on our servers, and it starts on first launch. The first time you open Dopamind the app creates an anonymous account for you automatically — no email, no name, no sign-up screen, just an identifier — and from then on your progress is backed up to it whenever the device is online. That is what lets you recover your streak on a new phone. We are describing this plainly because it means the honest answer to "does anything leave my device?" is yes: your check-ins, streak history, journal entries and coach conversations reach our servers even if you never sign in. Section 3 sets out how that copy is protected, and section 10 how to erase it.

There is currently no in-app switch to turn the backup off. If you want nothing on our servers at all, delete your account from Profile → Account → Delete my account — that erases the server copy and the copy on your device together.

2. What this website collects

This site has one form, on the contact page, and it is the only place the site asks you for anything. We store the email address, message and (optional) name you submit, so we can reply to you. Contact messages are kept for up to 24 months so we have the history of a conversation, then deleted.

The download buttons on the home page are plain links to the App Store and Google Play. Following one takes you to that store, under its own privacy policy. If you allowed analytics (section 6), Google Analytics records which button you pressed; if you did not, we learn nothing about the click.

3. Your account & cloud backup

Two things are worth separating here, because they are usually the same thing in other apps and are not the same thing in Dopamind.

• The anonymous account is created for you on first launch, as described in section 1. It holds an identifier and your backed-up progress — streak dates, check-ins, relapse events, journal entries, mood logs, XP, badges, challenge and plan progress and coach conversations — plus your device’s time zone, so your days start and end at your own midnight. If you give yourself a nickname in the app, it is stored too, so Kai can use it. It carries no email address, no real name and nothing else you did not put into the app yourself.
• Your onboarding answers stay on your device. The questions you answer when you first open Dopamind — how often, what sets it off, how it affects you — are never sent to us. The one exception is the last, optional question, where did you hear about Dopamind? If you answer it, we store that single choice (TikTok, Instagram, YouTube, Reddit, a friend, the app store, a search or somewhere else) with your account, on its own, so we know which channels bring people. We only ever look at it as totals per channel. Skip the question and nothing is stored.
• Signing in is optional and adds exactly one thing: a way to prove the account is yours from another device. If you sign in with Apple, Google or an emailed code, we additionally store that sign-in identifier (for example, the email address the provider gives us). Signing in does not start the backup — it was already running — it just attaches a way back into it. A signed-in account can be open on up to three devices at once, so we keep a record of each device's sign-in session.

Notifications. If you allow notifications, we store a push token for your device. Your reminders — the evening check-in, milestones and the rest — are all scheduled on your phone itself and never pass through our server; the token is used only for an occasional message about the service itself. You can switch notifications off at any time in your phone's settings.

Email. We only have an email address for you if you signed in with one. We use it for sign-in codes and for things you need to know about your account. Product update emails are off unless you turn on Profile → Email → Product updates, and every one of them carries a one-click unsubscribe link.

Help & Support. If you write to us from inside the app, we store your message, the reply-to address you give us and a link to your account, so we can answer you.

Your trusted contact never leaves your phone. If you choose one, it is kept in your phone's secure storage and is not backed up to us. If you pick them from your contacts, the app opens your phone's own contact picker and keeps only the one person you chose; it never reads or uploads your address book. (Android asks for contacts permission even for that one pick. Saying no only means typing the number yourself.)

How the backup is protected. Everything travels over an encrypted connection. On our servers, the two most sensitive things you can write — your journal entries and your coach conversations — are additionally encrypted inside the database, with the key kept outside it, so a copy of the database on its own does not reveal them. The rest of your backup (streak dates, check-ins, XP, badges and similar progress records) is stored without that extra layer and is protected by our server and account controls. To be clear about the limit: this is not end-to-end encryption. We are able to decrypt your journal and coach messages, because the coach needs the conversation in order to answer you.

4. Purchases

Subscriptions are processed by the Apple App Store or Google Play, together with our subscription-management provider, RevenueCat. We receive the subscription's status (for example, "active" or "in trial"), never your card details. RevenueCat knows your purchase by your anonymous account identifier, not by your name.

One free trial, and one discount offer, per phone. On Android, when a free trial starts, we record a one-way fingerprint of an identifier Android gives only to our app. It lets us offer the trial once per phone rather than once per store account. We record the same fingerprint when we show the one-time discount offer, so that it, too, is shown once per phone. Those are the only things it is used for. The fingerprint cannot be turned back into the identifier, means nothing outside Dopamind, and is not stored with your name, email or account. So that the trial record is kept even if the app loses its connection at that moment, the same fingerprint is also attached to the trial purchase at RevenueCat.

5. Kai, the AI coach

Kai is part of Dopamind Premium. When you send Kai a message, our server forwards it to an AI model provider, through the routing service OpenRouter, to write the reply. Along with your message it sends the recent part of your conversation, your nickname if you set one, a goal if one is saved on your profile, and your local time of day.

It also sends a summary of the numbers your own screens show, so that Kai can answer questions about them:

• your current and best streak, how long since a slip, and whether you are in the three days after one;
• the moods you logged over the last two weeks, and whether you have checked in today;
• how many urges you have logged and outlasted — recently and in total — and the technique that has worked best for you;
• your clean days and slips over the last 30 days, and this week’s totals;
• your tree’s stage and points, your level and XP, how many badges you have earned and the name of the latest, and how many streak freezes you hold;
• a challenge you are running, where you are in the 12-week plan, how many articles you have read and the title of the last one;
• whether Premium is active and until what date — never a price or a payment detail.

These are counts, dates and names from the app’s own catalog. Kai is also sent a guide to how the app works, which contains nothing about you. It never sends your journal, your check-in notes, the note you write when you log a slip, what you tag as having pulled you toward an urge, or anything else you wrote outside the conversation.

Before a message reaches the model, it is checked automatically for signs of a crisis, so that we can show you helplines instead; the reply is checked again before you see it. Those checks run on our own server.

Coach conversations are kept for 180 days and then deleted automatically. You can take a copy at any time with Profile → Export my data, and they are erased at once if you delete your account. They are never used to build an advertising profile and never sold. If you would rather keep identifying details out of them, leave names and places out of what you tell Kai.

6. Analytics, diagnostics & cookies

In the app: there is no product analytics at all. No third-party analytics SDK, no advertising or attribution tracker, no event logging of which screens you open or which features you use. We do not know how many times you opened the panic tool, and there is nothing in the app that could tell us.

The one thing the app sends on its own is a crash report, and only when something actually breaks: the error's type, its message, the JavaScript stack trace, your app version, whether you are on iOS or Android, and whether the crash was fatal. It goes to our own servers rather than to a third-party crash service, it is attached to your account identifier so we can tell one person hitting a bug ten times from ten people hitting it once, and it never contains your journal, your check-ins or your coach conversations. If you are offline when it happens, it is dropped rather than queued.

On our servers: every time the app talks to the backend — a backup, a coach reply, a notification — we record a small amount of operational information against your account, at most once an hour: when you were last seen, a coarse device label such as "iPhone · iOS", a two-letter country code when our network provider adds one to the request, and a one-way salted hash of your IP address that is shortened before it is hashed (IPv4 to the first three blocks, IPv6 to the first three groups). We do not store your IP address, and the hash cannot be turned back into one. This exists so we can run the service and spot abuse — it is never used for advertising, never combined with your journal or streak content, and never sold. All of it is deleted with your account.

We also keep aggregate counters for monitoring — how many requests each endpoint served and how fast it responded. Those are held in memory, contain no personal data, and are not linked to anyone.

On this website: we use Google Analytics, and only if you say yes. Until you press “Allow” on the bar at the bottom of the page, nothing of Google's loads and the site sets no cookies at all. “No thanks” keeps it that way, and so does a browser that sends Global Privacy Control — it is never even asked.

If you allow it, Google Analytics sets two cookies on this site (named _ga and _ga_ plus an ID, kept for at most 13 months) and records which pages you view, the page you came from, which download button you press, how far down the home page you read, and that a contact message was sent — never what it said. It also sees your browser, device type, language and approximate location; Google works the location out from your IP address and does not store the address in Analytics. Every advertising feature is off: no Google signals, no ads personalisation, no advertising cookies, and nothing is shared with any Google advertising product. Google keeps this data for up to 14 months. Change your answer whenever you like with “Cookie settings” at the bottom of every page — saying no stops it immediately and deletes the Analytics cookies. Your choice itself is remembered in your browser's local storage, not in a cookie, and you are asked again after 13 months.

The only other outside service the site loads is Cloudflare Turnstile, and only on the contact page, where it checks that a message comes from a person; Cloudflare receives your IP address and basic browser signals for that check. Our web server keeps ordinary request logs (IP address, timestamp, page requested) for security and troubleshooting, and these are discarded within 30 days.

7. Who processes data for us

We do not sell data to anyone. These are the services that handle some of it on our behalf, each only for the job listed:

• Our hosting provider runs the servers and the database that hold the backup.
• OpenRouter and the AI model provider it routes to write Kai's replies (section 5).
• RevenueCat manages subscriptions and trials (section 4).
• Apple and Google process purchases, the sign-in you choose, and deliver push notifications to your phone.
• Expo relays push notifications from our server to Apple and Google; it receives the push token and the notification's text.
• Resend sends our emails: sign-in codes, replies to support messages, and product updates if you turned them on.
• Google measures visits to this website with Google Analytics — only for visitors who allow it (section 6). For visitors in Europe it is provided by Google Ireland; Google may process the data in the United States under the EU–US Data Privacy Framework. It never receives anything from the app.
• Cloudflare runs our domain and the website's bot check, receives email sent to our addresses before it reaches our mailbox at Google, and stores the sound library's audio files, which contain no personal data.

8. What we never do

• We never sell your personal data.
• We never share your recovery data with advertisers.
• We never require your real name to use the app.
• We never use third-party ad trackers in the app or on this site.

9. Your privacy rights

Wherever you live, you can ask us to show you the personal data we hold about you, correct it, delete it, hand it over in a portable form, or stop using it. Email support@getdopamind.com and we will respond within 30 days. We will never charge you for this, and we will never treat you differently for asking. Much of it you can do yourself, straight away: Profile → Export my data gives you a copy, and section 10 explains deletion.

If you are in the EU or UK: we use what you record in the app to provide the service you asked for — the backup, Kai and your progress — and what you send through the contact form on our legitimate interest in answering you. You also have the right to complain to your local data protection authority. If you are in California, we do not sell or share personal information as those terms are defined by the CCPA/CPRA.

10. Data deletion

Delete everything, from inside the app. Open Profile → Account → Delete my account. This erases your account and everything attached to it (streak history, journal entries, check-ins, progress, coach conversations, subscription records, push tokens and the operational record described in section 6) from our servers, and wipes the copy on your device at the same time. It happens immediately, not on a queue, and it cannot be undone by us or by you. If you want a copy first, use Profile → Export my data before you delete. Deleting your account does not cancel a subscription: that is managed by the App Store or Google Play, so cancel it there.

Delete your account without the app. If you have already removed Dopamind, or cannot open it, email support@getdopamind.com with the subject “Delete my Dopamind account”, from the email address you signed in with. If you signed in with Apple and chose to hide your email, write from the address Apple forwards to you, or tell us the relay address shown in your Apple ID settings. We reply to that address to confirm the request came from you, then erase the account and everything listed above, exactly as the in-app deletion does. You do not need to reinstall anything, and we complete it within 30 days.

If you never signed in. The anonymous backup carries no email address and no name, so an email cannot tell us which backup is yours; only the app on your device can. If you still have the app, use the in-app deletion above. That is the price of the backup being anonymous, and we would rather say so than pretend we can find it.

Three things deliberately outlive a deletion, and none of them identifies you afterwards. If you wrote to Help & Support, the message itself is kept so we still have the record of what was asked, but your email address is erased from it, so it no longer points back to you. And if the app ever crashed, the anonymous crash diagnostics stay in our error log; once your account is gone the identifier attached to them refers to nobody. And the phone fingerprint described in section 4 stays, because its only job is to remember that a phone has already had its trial or its offer; it was never linked to your account in the first place.

Other routes. Deleting the app removes everything stored on your device, but it does not touch the backup on our servers. Use the in-app deletion, or email us as described above. To have a message you sent through this website's contact form deleted, email us and we will remove it right away; it is held separately from any app account, so deleting your account does not remove it.

11. Children

Dopamind is for adults. It is not directed at anyone under 18, and we do not knowingly collect data from anyone under 18, which matters more here than on an ordinary app, because what Dopamind records is health data about sexual behaviour. If we learn that we hold data from a minor, we delete the account and everything attached to it. If you believe a minor is using Dopamind, write to support@getdopamind.com.

12. Changes

If this policy changes materially, we will update this page and note the new date above.

13. Contact

Questions or requests: support@getdopamind.com