Privacy Policy

Etappi is operated by Oles Didukh, trading as Etappi ("we"). We are the controller of the personal data described here. Contact: privacy@etappi.app.

Etappi offers self-help tools based on cognitive behavioral therapy. Etappi is not therapy, is not a medical device, and is not a substitute for professional diagnosis, treatment, or advice.

Account data: your email address and the identifier of the sign-in provider you chose (email, Google or Apple).

Health data you enter: mood check-ins, questionnaire answers (GAD-7 and PHQ-9), thought records, worries, plans, exposure practice, journal entries, coping cards and your safety plan.

Purchase data: your plan, its renewal or end date, the amount and currency, and the identifiers Paddle, Apple or Google send us (for web purchases, Paddle's customer, subscription and transaction identifiers). We never receive your full card number. Paddle's payment notifications include a few card details (card type, last four digits, expiry date and cardholder name); we discard them on arrival and never store them.

Technical data: server logs (time, route, error codes) kept to run and secure the service. When our servers hit an error they send a de-identified error report to Sentry: the error type, a shortened message with identifiers and email addresses masked, the code location, the page or API path with identifiers removed, the request method and the name of the server function that failed, without your account identifier, IP address, request content or anything you entered. We do not use advertising identifiers, ad pixels or third-party advertising SDKs.

Usage analytics, only if you opt in: which screens and tools you open and finish, the app version and platform, and a random identifier for your device, linked to your account while you are signed in. It also records account steps such as signing up, finishing onboarding and giving health-data consent, including the dates of a sign-up or onboarding that happened before you opted in. This data is pseudonymous: it is not tied to your name or email address, but it can be linked to your account. We never record what you write, your mood ratings or your questionnaire answers. Our usage analytics is first-party: it is stored in our own database, and no analytics company receives it.

Crash reports from your device, only if you opt in: the error type, a shortened message with identifiers and email addresses masked, the code location, the page you were on and your recent navigation and network steps (page or API paths with identifiers removed, request method and status code), your device's language and time zone setting, and coarse device details (such as device model, operating system and browser), sent to Sentry. Never screenshots, what you typed, or your entries. Your device sends none until you agree.

Page analytics on our public pages, only if you opt in while signed out: which guide and worksheet pages you view, which of their links you follow, which worksheets you print, and which site, campaign or referral link brought you, with a random identifier for your device. If you allow it we also set one first-party cookie, etappi_ft, which stores the first page you landed on, the source that sent you, a referral code if you followed a referral link, and any UTM tags in the link. It lasts 30 days. We use it only to see which pages bring people in, and it is not shared with anyone else or used for advertising. If you then create an account and allow usage analytics there, the first-visit details from the etappi_ft cookie (the first page, source, referral code and UTM tags) are saved on your account; the page analytics events recorded while you were signed out are not stored against your account: signing in gives this device a new identifier, so they cannot be linked to it, and they are deleted after the usual 13 months. If you choose No thanks, no analytics cookie is set and no page analytics are recorded.

Feedback, only if you send it: when you use Send feedback in Settings, we store the area you pick and the text you type, and your device type and app version only if you leave that box ticked. We use it to fix problems and improve the app. We don't attach your entries or check-ins. It is linked to your account, is included in your data export, and is deleted with your account. If you join the private beta, we also record the date you joined. It is cleared when you leave the beta or delete your account.

Referral links: if you open a clinician's referral link (an address starting with /r/), your browser saves that clinician's code on your device so it can be applied when you check out. This is needed for the discount to work, so it is saved whatever you choose about analytics. It stays on your device until checkout sends it to us, and it is removed once it is used or after 30 days. To stop referral codes being guessed, we count visits to referral links from each network for 10 minutes using a hashed form of your IP address, not the address itself, and we delete it within two days.

To provide the app you asked for: saving your entries, showing your history and building your summaries (contract; UK/EU GDPR Art. 6(1)(b)).

Health data is special-category data. We process it only with your explicit consent, given in the app before any is saved (UK/EU GDPR Art. 9(2)(a); Washington My Health My Data Act). You can withdraw consent in Settings at any time.

To keep records of purchases we are legally required to keep (legal obligation; Art. 6(1)(c)).

To email you a reminder before your free trial ends, so you can decide whether to choose a plan (contract; Art. 6(1)(b)). Resend receives your email address and the reminder's text (the trial's end date and our prices), never your entries.

Usage analytics and crash reports from your device: your consent (Art. 6(1)(a)), asked separately after sign-in and off until you say yes. You can turn it off in Settings at any time, and turning it off deletes the usage analytics we hold for you.

Page analytics and the etappi_ft cookie on our public pages: your consent (Art. 6(1)(a)), asked in a prompt on those pages while you are signed out and off until you say yes; the cookie is not set before you allow it. Signing in replaces that choice with your account's choice.

De-identified server error reports: our legitimate interest in keeping the service working and secure (Art. 6(1)(f)).

Supabase (database and sign-in; data stored in the EU, Frankfurt region), Vercel (hosting of the website and API), Apple and Google (in-app purchases and sign-in, when you choose them), Sentry (crash reports; stored in the EU), Resend (transactional email: trial reminders and clinician email confirmations). Each acts on our instructions under a data processing agreement.

Paddle.com Market Limited (UK) sells our web plans as our reseller and Merchant of Record. For the details you enter at checkout (name, email, billing address, payment and tax details) Paddle is an independent controller under its own privacy notice (paddle.com/legal/privacy). We give Paddle your account identifier and the plan you chose so it can link the purchase to your account.

We do not sell personal data and do not share it for advertising.

Some processors are based in the United States. Transfers rely on the EU-US Data Privacy Framework, the UK Extension, or standard contractual clauses with the UK addendum.

Your entries are kept until you delete them or delete your account. Deleting your account in Settings permanently erases your entries immediately. They can remain in our database provider's encrypted backups for up to 7 days, which we use only to recover from a failure. When you delete your account we keep only its random account identifier for 14 days in a separate log, so that if we ever restore a backup we can delete your account again. If you bought a plan we keep a minimal purchase record (no health data) as financial law requires.

Feedback you send is kept until you delete your account.

Sentry deletes crash reports after at most 90 days.

Usage analytics is kept for up to 13 months and then deleted automatically. Turning it off in Settings, withdrawing health-data consent or deleting your account deletes the usage analytics we hold for you.

The etappi_ft cookie expires 30 days after it is set. Page analytics recorded while you were signed out is usage analytics and is kept for up to 13 months.

If you ask for a referral code on our For therapists page, we store your name, email address, professional role and country, your registration number and practice website if you give them, the dates you asked, confirmed your email address and received a code, and the code and referral link we give you. We use them only to answer your request: to confirm the email address is yours (Resend sends that one email), to check that you are a clinician, and to send you your code and keep track of it (taking the steps you asked for; Art. 6(1)(b)). To stop the form being flooded we count requests from each network for an hour using a hashed form of your IP address, not the address itself, and we delete it within two days. If you never confirm your email address, we delete the request 30 days after you last asked. Once you confirm, we keep it while we work with you, and we delete it whenever you ask at privacy@etappi.app. None of this is linked to an Etappi account or to any health data.

You can access and download everything you saved (Settings → Export my data), correct it in the app, delete it (Settings → Delete my account), withdraw consent (Settings → Withdraw health-data consent), turn usage analytics and crash reports on or off (Settings → Usage data and crash reports), and object to or restrict processing by emailing us.

While signed out, you can change your page analytics choice at the bottom of any guide or worksheet page. Choosing No thanks removes the etappi_ft cookie and this device's identifier.

Your export includes the usage analytics linked to your account. Page analytics a device recorded while you were signed out is not stored against your account, so it is not in the export and deleting your account does not find it; it is deleted automatically after 13 months.

In the UK you can complain to the Information Commissioner's Office (ico.org.uk). In the EU, to your local data protection authority.

Etappi is for people aged 18 or older. We do not knowingly collect data from anyone younger.

Data is encrypted in transit and at rest by our hosting providers. Our server only ever reads and writes the signed-in person's own data, and row-level security on every table blocks direct database access by anyone else, so other people using the app cannot see your data. We do not read your entries. Access to stored data is limited to what is strictly needed to keep the service running and secure.

If you use Etappi in Ukraine, the Law of Ukraine "On Personal Data Protection" (No. 2297-VI of 1 June 2010) also applies. Under that Law we are the owner (controller) of the personal data described in this policy, and the processors listed under "Who processes it for us" act on our instructions.

Data about your health is a special category of personal data under Article 7 of that Law. We process it only with your explicit consent, given in the app before any is saved. You can withdraw consent at any time in Settings → Withdraw health-data consent.

Under Article 8 of that Law you have the right to know what data we hold about you, why and who processes it; to access it; to object to its processing; to have inaccurate or unlawfully processed data corrected or deleted; to withdraw consent; and to complain or go to court. You can use these rights in the app as described under "Your rights", or by writing to us at privacy@etappi.app.

Your data is stored in the EU (Frankfurt) and some of our processors are based in the United States (see "International transfers").

You can complain to the Ukrainian Parliament Commissioner for Human Rights, who supervises personal data protection in Ukraine (ombudsman.gov.ua).

If we change this policy materially we will ask you to review it in the app before you continue. Questions: privacy@etappi.app.