Privacy Policy for We Do Recover

Last Updated: September 23, 2026 · Version 1.2

1. Introduction

We Do Recover is committed to protecting your privacy and maintaining your anonymity in accordance with 12-step principles. This Privacy Policy explains what data we collect, what data the third-party services we integrate collect, and how to exercise the rights you have under GDPR, UK-GDPR, CCPA/CPRA, and similar laws.

The fundamental principle: Your recovery content—every journal entry, voice memo, contact, and check-in—stays on your device, always. We never collect, read, or transmit the content you create. The only data that ever leaves your device is opt-in, anonymous usage analytics and the device signals that Google AdMob requires to serve ads. None of it touches the content you write.

2. Data Collection and Storage

We Do Recover is designed as an offline-first application. This means:

• No Personal Data Collection: We do not collect any personal information from users. Your name, contact information, or any identifying details are never requested or transmitted to us.
• Local-Only Storage: All data you create in the app—including daily inventory entries, voice memos, emotional check-ins, contacts, service logs, and lessons—is stored exclusively on your device using local databases (SQLite and Hive). This content never leaves your device.
• No Cloud Sync for Your Data: Your recovery data is never backed up to or synced through any remote server, cloud storage service, or third-party backup system.
• No User Accounts: The app does not require sign-up, email, or any identifying account. Authentication is a local PIN or biometric (Face ID / Touch ID / fingerprint) stored in iOS Keychain or Android KeyStore.
• Opt-In Usage Analytics: We collect anonymous analytics about which features you use (e.g., "an inventory was saved," "a check-in was submitted") so we can understand what's helpful and improve the app. This is strictly opt-in—you choose whether to share it during onboarding, and you can change your mind anytime in Settings. We never collect the content of your entries, voice memos, contacts, or any identifying information. See §7 Firebase Analytics below for full details.

3. Premium Subscriptions and In-App Purchases

The free version of We Do Recover is supported by ads. You can remove ads in any of three ways:

Tier	Type	Price (USD)	Notes
Weekly Premium	Auto-renewable subscription	$4.99 / week	Impulse-buy tier; cancel anytime
Monthly Premium	Auto-renewable subscription	$9.99 / month	Best for most users; cancel anytime
Lifetime Premium	Non-consumable (one-time)	$49.99	Permanent; no renewal

Prices shown above are defaults. App stores may display prices in your local currency and may charge VAT / GST / sales tax in your jurisdiction. The actual price you pay is the price shown on your store's purchase confirmation sheet.

3.1 How auto-renewable subscriptions work

• Billing: Your Apple ID or Google Play account is charged at confirmation of purchase and at the start of each renewal period, unless you cancel at least 24 hours before the end of the current period.
• Auto-renewal: Subscriptions automatically renew at the same price and duration unless auto-renew is turned off in your store account settings at least one day before the end of the current period.
• Managing / cancelling:
  • iOS: Settings → [your name] → Subscriptions → We Do Recover
  • Android: Google Play → Payments & subscriptions → Subscriptions → We Do Recover
• Free trial: If a free trial is offered, your store charges you when the trial ends unless you cancel during the trial. Trials convert to the listed subscription price.
• Promo offers: Promotional pricing (e.g., launch discounts) follows the same auto-renew terms; the price reverts to the standard rate after the promo period unless you cancel.

3.2 Lifetime (non-consumable)

The Lifetime tier is a one-time purchase. It does not auto-renew. Once purchased, premium status is permanently associated with the Apple ID / Google account used at purchase and is restored on any device that signs in with the same store account. Lifetime purchases are non-consumable in the sense that they do not expire, but they remain tied to the original purchaser and the original store account family.

3.3 Family Sharing

Apple Family Sharing and Google Play Family Library, where enabled by the store, may share your subscription with up to five additional family members on the same payment plan. Lifetime purchases made by a family organizer may also be shared with family members, subject to store policies. We do not control who the "family" includes—that is configured in your store account.

3.4 Refunds

All purchase transactions are between you and Apple or Google. Refund requests must be submitted to the relevant store:

• iOS: reportaproblem.apple.com
• Android: Google Play refund help

We do not have the ability to issue refunds directly, but we are happy to help you write a refund request — contact amit@wedorecover.in.

3.5 What purchase data we receive

• From the store: an anonymous receipt token and the product ID of what you bought.
• From RevenueCat (see §4): an anonymous user identifier tied to your purchase so we can restore your premium status across reinstalls.
• We do not receive your name, email, billing address, phone number, card number, or any payment instrument details. Apple and Google handle all of that inside their stores.

4. RevenueCat (Subscription Management)

• What it does: RevenueCat (revenuecat.com) is our third-party subscription-management partner. The app uses the RevenueCat SDK to verify which products you've purchased and to unlock premium features. RevenueCat also powers the in-app purchase flow, receipt validation, and customer-info sync across devices.
• What data it collects: An anonymous RevenueCat app-user identifier (a randomly-generated UUID, not tied to your name or email), the product IDs you purchased, the receipt token from Apple/Google, your subscription status (active / expired / in billing retry), and your country (derived from your store account locale). RevenueCat does not see your recovery content.
• Where data is processed: RevenueCat servers (US / EU regions, depending on configuration). See revenuecat.com/privacy.
• Data retention: RevenueCat retains subscription records for as long as the subscription or purchase is active, plus a reasonable period for tax / accounting purposes (typically 7 years for non-consumable purchases).
• Your control: You can request deletion of your RevenueCat record by emailing us at amit@wedorecover.in from the email address associated with your store purchase. Deletion does not cancel an active subscription—you must cancel via your store first.

5. Apple & Google (Stores and Payment)

• What they do: Apple (App Store) and Google (Google Play) sell and bill the subscriptions and the lifetime purchase, then notify us via a receipt token that a purchase occurred.
• What data they collect: Apple and Google collect the information their own privacy policies describe, including your store account, payment method, billing address, and tax identifiers. We do not have access to any of that.
• Policies:
  • Apple: apple.com/legal/privacy
  • Google: policies.google.com/privacy

6. Google AdMob (Advertising)

The free version of We Do Recover displays ads through Google AdMob. AdMob serves ads on the seven dedicated banner slots listed below plus an interstitial shown only at result moments (after you save a check-in, finish a reading, complete a meditation, etc.) and a rewarded video that grants a 24-hour ad-free day-pass when you watch it through.

6.1 Ad unit inventory

Slot	Type	When shown
Dashboard	Banner	Bottom of the home dashboard
Literature library / bookmarks	Banner	Bottom of each list
Settings	Banner	Bottom of the settings scroll
Check-in list	Banner	Bottom of the check-in history list
Gratitude library	Banner	Bottom of the gratitude library
Meditation history	Banner	Bottom of the meditation history list
Inventory list	Banner	Bottom of the inventory list
Result interstitial	Interstitial	Only at result moments, gated by AdPolicy
Day-pass rewarded	Rewarded video	Opt-in from Settings / paywall; grants 24h ad-free

6.2 What AdMob collects

• Device-level identifiers (IDFA on iOS, Advertising ID on Android). On iOS, the IDFA is only accessed after you grant permission through Apple's App Tracking Transparency prompt.
• Coarse device signals: device model, operating system version, screen size, language, IP-derived approximate location (typically country / region level).
• Ad interaction data: impressions, clicks, video views, completion events.
• App identifier (the app's bundle ID), not user identifier.

6.3 What AdMob does NOT have access to

• The content of any inventory entry, gratitude entry, voice memo, contact, emotional check-in, or meditation reflection you create in the app. Recovery content is stored in a private local database that AdMob has no read access to.
• Your PIN or biometric data.
• Your location history or contacts.

6.4 AdMob Privacy & opt-out

• Privacy: policies.google.com/privacy
• Personalised ads: You can opt out of personalised advertising in Settings → Privacy & ads on iOS or Settings → Google → Ads on Android. Opting out serves contextual (non-personalised) ads instead.
• Remove ads entirely: Subscribe (weekly / monthly) or buy the lifetime tier. Any of those instantly disables every AdMob banner and interstitial on every screen.
• Day-pass: Watching the rewarded video sets a 24-hour ad-free window on your device. After 24 hours, ads resume if you're not premium.

7. User Messaging Platform (UMP) Consent

On iOS, AdMob integrates Google's User Messaging Platform (UMP) SDK to surface a "Your privacy choices" consent form to users in regions where it is required (EEA, UK, and any other jurisdiction where the store mandates a consent gate before personalised ads may be served). On Android, the equivalent consent is collected through Google's UMP and the device-level ad-controls.

• What UMP collects: Your consent choice (accept / decline / manage), the package version of the SDK, and a randomly-generated identifier used to record your decision. UMP does not collect advertising identifiers.
• Why we use it: AdMob and Google require this consent before serving personalised ads in EEA / UK. Without consent, only contextual (non-personalised) ads are shown.
• How to change your mind: On iOS, go to Settings → Privacy & Security → Tracking and toggle the "Allow Apps to Request to Track" switch, then re-open the app. On Android, reset your Advertising ID from Settings → Google → Ads. On both platforms, uninstalling and reinstalling the app resets the consent form.
• UMP Privacy: policies.google.com/privacy

8. Firebase Analytics (Optional Usage Analytics)

• What it does: Firebase Analytics helps us understand which features are most used so we can focus our development effort on what genuinely helps the recovery community. It is off by default and only activated if you choose "Allow analytics" during onboarding (or later in Settings → Privacy & analytics).
• What data it collects: Non-identifying event signals such as "inventory saved," "check-in submitted," "clean time set," "reading scrolled past 70%," or "screen viewed." It also records a few coarse user properties—your app language, theme preference, premium status, and a broad clean-time bucket (e.g., "31–90 days"). No event ever contains the text, audio, or details of what you wrote or recorded.
• What it does NOT collect: No names, no email addresses, no inventory content, no voice memo audio or transcriptions, no contact details, no precise clean-time dates—only coarse, aggregated signals.
• Where data is processed: Analytics events are sent to Google's servers for processing and reporting. Google's privacy policy applies: policies.google.com/privacy
• Your control: You can turn analytics off at any time in Settings → Privacy & analytics. When off, no events are sent—period. If you never enable it, nothing is ever transmitted.

9. Device Permissions

We Do Recover requests the following device permissions to provide app functionality. All permissions are optional and used only for local features:

• Microphone (RECORD_AUDIO): Used for two purposes:
  • Voice Memos: Record audio notes for your daily inventory, gratitude lists, or personal reflections. All recordings are saved locally on your device only and never transmitted anywhere.
  • Speech-to-Text: Convert your spoken words into text for journal entries and inventory work. Voice recognition processing happens on your device using system APIs. No audio data is sent to our servers (we don't have any servers). Speech recognition may use your device's built-in speech services (Google Speech on Android, Apple Speech on iOS), which have their own privacy policies.
• Contacts (READ_CONTACTS): Used to import sponsor or core group contacts from your device's contact list for quick access in the app. This is read-only access, and no contact data is transmitted anywhere or stored outside the app's local database.
• Storage (WRITE_EXTERNAL_STORAGE - Android only): Used to export encrypted backup files of your recovery data to your device's storage, allowing you to save or share backups via email, cloud storage, or other methods. You control where exported files go.
• Notifications: Used to send local reminders for daily inventory, Just For Today readings, and service commitments. These are local notifications generated on your device—not push notifications from a server.
• Biometric Authentication: Used for Face ID (iOS), Touch ID (iOS), or Fingerprint (Android) to unlock the app. Biometric credentials are stored in your device's secure enclave and never leave your device.
• App Tracking Transparency (iOS only): Used to ask whether AdMob may use your IDFA for personalised advertising. If you decline, only contextual (non-personalised) ads are shown. You can change this in iOS Settings.

Important: You can deny any permission and the app will still function, though specific features requiring that permission will be unavailable. You can change permission settings at any time in your device's system settings.

10. Data Retention and Deletion

• On-device data: Your recovery data is kept on your device indefinitely until you manually delete it or uninstall the app.
• Subscription receipts: Retained by RevenueCat and the stores for tax / accounting purposes. Lifetime receipts are typically retained for 7 years (non-consumable purchases) per applicable tax law.
• Firebase Analytics: Retained for up to 14 months in aggregated form; older data is automatically deleted or anonymised per Firebase retention settings.
• AdMob: Ad interaction data is retained per Google's ad-data retention policy (typically 13 months for personalisation, then aggregated).
• How to delete your data:
  • To delete all on-device data, use the "Forgot PIN" feature in the app's login screen, which erases all local data.
  • Alternatively, uninstalling the app removes all local data permanently.
  • To delete your RevenueCat subscription record, email amit@wedorecover.in from the email associated with your store purchase.
  • To delete analytics data, turn off analytics in Settings and contact us to request deletion of historical events.
• Data Backup and Export: You can export your data as an encrypted backup file (password-protected) for safekeeping. This export is stored locally or shared via your device's share sheet (email, cloud storage, etc.). We do not have access to exported backups.

11. Data Security

We take your data security seriously:

• Encryption: Sensitive data (PIN, settings) is stored using iOS Keychain or Android KeyStore, which are hardware-encrypted.
• Local Database Protection: SQLite databases are stored in the app's private directory, inaccessible to other apps.
• No Network Transmission of Your Content: Since your recovery data never leaves your device, it is not exposed to network security risks (man-in-the-middle attacks, server breaches, etc.). The only data transmitted is opt-in analytics (see §8 above), which is encrypted in transit by Firebase.
• In-app purchase receipts: Verifying premium status requires a round-trip to RevenueCat. The request contains an anonymous app-user identifier and a short-lived receipt token, never your name or payment details.

12. Children's Privacy

We Do Recover is intended for users aged 12 and older, given the mature themes of recovery from substance use. We do not knowingly collect personal data from children under 12. If a parent or guardian believes a child under 12 has used the app, please contact us, though note that we do not have access to any user data.

13. International Users & Data Transfers

We Do Recover is available worldwide and supports 20+ languages. Your recovery data stays on your device and does not cross international borders. The third-party services we use (RevenueCat, Google AdMob, Google Analytics, Apple, Google) may transfer and process data across borders. Each of these companies complies with applicable data-transfer frameworks:

• EU / UK: Google LLC and RevenueCat, Inc. participate in the EU-US Data Privacy Framework and the UK Extension.
• California (CCPA / CPRA): "Sale" and "sharing" of personal information is limited to what the AdMob personalised-ads system requires; you can opt out at any time via your device's ad-controls (see §6.4 and §7).
• Other jurisdictions: Google and RevenueCat maintain regional data centres and apply regional processing where required by law.

You can stop all cross-border data transmission by:

1. Turning off analytics in Settings → Privacy & analytics.
2. Opting out of personalised ads in your device settings (see §6.4).
3. Subscribing to premium (which disables AdMob entirely).

14. Your Rights

You have full control over your data:

• Access: You can access all your recovery data within the app at any time.
• Export: You can export your data as an encrypted backup.
• Delete: You can delete all local data using the "Forgot PIN" feature or by uninstalling the app.
• Cancel subscription: Via your store's subscription settings (iOS / Android).
• Restore purchase: Use "Restore purchases" inside the paywall or Settings.
• Withdraw consent: Reset your advertising identifier or revoke App Tracking Transparency permission at any time.
• Analytics opt-out: If you enabled usage analytics, you can turn it off anytime in Settings → Privacy & analytics. This immediately stops all analytics data collection from your device.
• Request a copy of our records: Email amit@wedorecover.in with the store receipt ID (visible in your store's purchase history) and we will export the anonymous subscription record RevenueCat holds for you.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the app or legal requirements. We will notify users of significant changes via an in-app announcement. Continued use of the app after changes constitutes acceptance of the updated policy.

Current Version: 1.2 (September 23, 2026) — added details on weekly / monthly / lifetime subscriptions, RevenueCat subscription processing, expanded AdMob inventory (7 banner slots + interstitial + rewarded video), UMP consent, and the day-pass ad-free mechanism.

16. Compliance with 12-Step Traditions

We Do Recover respects the anonymity principle of 12-step programs (Tradition 12). We do not collect names, require accounts, or track personal identities. Your recovery journey is private and remains yours alone.

---

© 2026 We Do Recover. All rights reserved.