REFORGED
Get the app

Privacy Policy

Effective November 15, 2026.

This policy covers the Reforged app for iPhone and Android and the getreforged.app website.

The short version

  • You can use Reforged without an account. Then your journal, answers, slips, triggers and progress stay on your phone. We can't see them.
  • If you choose Save your progress and sign in, we store only your streak start, level, best streak, urges resisted and your why, on servers in the EU, so they come back after a reinstall.
  • The community is for subscribers who sign in. Before a post, reply or nickname is published, its text is checked by OpenAI's moderation service.
  • We never sell your data, never use it for ads, and never track you across other apps or websites. The app has no advertising or analytics tools.
  • You can delete your data and your account in the app at any time.

1. Who we are

Reforged is made by Dominik Wojtucki, Dačická 137, 109 00 Praha, Czech Republic, company ID (IČO) 30160413 ("we", "us"). We are the controller of your personal data. Contact: [email protected].

2. What we collect, why, and on what legal basis

Reforged helps you quit porn, so some of your data can reveal something about your health or sex life. We treat it as sensitive data under the GDPR (Art. 9) and as consumer health data under U.S. state laws, and we keep as little of it as we can.

a) Data that stays on your phone

Your questionnaire answers, your journal, your slips and what set them off, urges and their triggers, your progress in the 90-day program, your reminder settings, your why, and your streak and level. They are stored only on your phone and in the Reforged widget on your phone. We don't receive them.

If you use iCloud Backup or back up your iPhone to a computer, iOS may include Reforged data in that backup. Apple and your phone settings control that, not us. On Android, only the small copy described in b) is backed up.

b) Automatic copy of your progress (without an account)

So your streak isn't lost when you reinstall the app, Reforged keeps a small copy of your progress in your own cloud storage: on iPhone in iCloud (key-value storage), on Android in Android Backup by Google. The copy holds only your streak start, level, best streak, urges resisted and your why. Never your answers, journal, triggers or slips.

The copy is stored in your Apple or Google account under their terms. We don't receive it and can't access it. It works only when iCloud or Android backup is turned on for your phone. Settings → Delete all data removes it.

Legal basis: performing our agreement with you (GDPR Art. 6(1)(b)).

c) Account (only if you sign in)

Signing in is optional. On iPhone you sign in with Apple, on Android with Google. Accounts on iPhone and Android are separate.

What we store:

  • Sign in with Apple: we don't ask Apple for your name or email. We receive only an Apple user ID.
  • Sign in with Google: Google shares your email address, your name, a link to your profile picture and a Google user ID. Our sign-in provider stores them with your account. We don't use your name or picture and never show them to anyone.
  • Your progress: the date and time your streak started, your level, your best streak, the number of urges you resisted, your why, and when this was last updated.
  • Never: your questionnaire answers, journal, triggers or slips.

Also: our server provider records technical details of each request, such as the IP address and device type, in short-lived logs. This keeps the service secure and is based on our legitimate interest in preventing misuse (Art. 6(1)(f)).

Why: to restore your progress when you reinstall the app or get a new phone.

Legal basis: performing our agreement with you (Art. 6(1)(b)). Because your progress relates to quitting porn, we store it only with your explicit consent (Art. 9(2)(a)). You give it when you choose Save your progress and sign in, after the screen shows what we save. You can withdraw it at any time by deleting your account. Without an account, Reforged works fully.

d) Community (only if you join)

The community needs a sign-in and an active subscription or free trial.

What we store: your nickname, your posts and replies and when you sent them, the posts you report, the people you block, and whether your subscription is active. To check your subscription, our server links your account to the anonymous customer ID of your purchase (see e) and asks RevenueCat whether it's active.

Who sees it: other members see your nickname, your posts and replies, and when you sent them. They never see your Apple or Google account, email or name. Your reports and blocks are private. Please don't put anything in your posts that identifies you or someone else.

Moderation by OpenAI. Before a post, reply or nickname is published, our server sends its text to OpenAI's moderation service, which checks it for content like harassment, hate, threats and sexual content. Only that text is sent, never your account or any ID. When someone reports a post or reply, its text is checked again the same way. According to OpenAI, it doesn't keep text sent to this service and doesn't use it to train its models. The result can stop a post from being published or hide a reported post. Our moderator reviews reports. If you think a decision about your content was wrong, email us and a person will look at it.

Filters and safety. Our server replaces swear words with asterisks, doesn't publish links, emails or phone numbers, and limits how often you can post. If someone is removed from the community, we keep one-way fingerprints (hashes) of their Apple or Google user ID and of their RevenueCat customer ID, so they can't come back with a new account. A fingerprint can't be turned back into the ID.

Legal basis: performing our agreement with you, which you accept when you tap Agree and join (Art. 6(1)(b)). Filters, moderation, limits and bans are based on our legitimate interest in keeping the community safe (Art. 6(1)(f)). Anything sensitive that you choose to share in a post, you share with your explicit consent (Art. 9(2)(a)), and you can delete it at any time.

e) Purchases

You buy a Reforged subscription through the App Store or Google Play. Apple or Google handles payment, and we never see your payment details. Their privacy policies apply to your purchase.

To check your subscription, the app uses RevenueCat. The app creates an anonymous customer ID at RevenueCat. It isn't linked to your name or email. RevenueCat receives your purchase history (which plan, when, the price and the store's transaction ID) and basic technical details such as the app version and your phone's system. Your account is linked to this ID only if you join the community (see d).

Legal basis: performing our agreement with you (Art. 6(1)(b)).

f) Blocker

  • iPhone: the Blocker blocks adult websites right on your phone. We don't see the websites you visit.
  • Android: the Blocker uses a VPN on your phone. It sends only the names of websites your phone looks up (DNS lookups), encrypted, to a free family-safe filtering service, which doesn't answer for adult websites. Nothing else goes through it. We don't see or store these lookups. The filtering service handles them under its own privacy policy.

Legal basis: performing our agreement with you, because you turn the Blocker on (Art. 6(1)(b)).

g) Reminders and widget

Reminders are scheduled on your phone. We don't send them from a server. They use neutral text that doesn't mention porn. The widget reads data only from your phone.

h) Support

If you email us, we use your email address and message to reply. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)).

i) Our website

The website doesn't use analytics, advertising or tracking cookies. Our hosting provider, Cloudflare, processes your IP address to deliver the pages and protect them from attacks. To block bots, it may set a short-lived security cookie (__cf_bm, deleted after 30 minutes without activity). Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f)).

You don't have to give us any personal data. Without an account, Reforged works on your phone, but only the small copy in b) is backed up. We don't make automated decisions about you that have legal or similarly significant effects.

3. Who processes data for us

These service providers act on our instructions under data processing agreements and must protect your data at least as well as this policy does:

  • Supabase: database, sign-in and our server. Servers in Frankfurt, Germany (Amazon Web Services).
  • RevenueCat: checks subscriptions. USA.
  • OpenAI: moderation of community texts. Our contract is with OpenAI Ireland Ltd. Processing takes place in the USA.
  • Cloudflare: website hosting and forwarding of emails sent to [email protected].
  • Resend: sends our email replies. USA.

Google (Gmail) is our support inbox. Google handles these emails under its own terms and privacy policy.

These companies handle your data as independent controllers under their own privacy policies: Apple (Sign in with Apple, App Store, iCloud), Google (Sign in with Google, Google Play, Android Backup) and the family-safe filtering service used by the Android Blocker.

We don't share your data with anyone else, except if the law requires it.

4. Transfers outside the EU

Some providers (RevenueCat, OpenAI, Resend, Cloudflare, Google, and Supabase for support access) are based in the USA. Transfers are protected by the European Commission's Standard Contractual Clauses or by the EU-U.S. Data Privacy Framework where the provider is certified.

5. What we never do

  • Sell or rent your data.
  • Use your data for advertising, or share it with advertisers or data brokers.
  • Track you across other companies' apps or websites.
  • Use your data to train AI models, or let our providers do so.

6. How long we keep data

  • Data on your phone: until you delete it (Settings → Delete all data, or delete the app). Delete all data also removes the copy in your iCloud or Android backup.
  • Account and progress: until you delete your account. Deletion removes it from our database right away. We don't keep backup copies of the database.
  • Posts and replies: until you delete them or your account. Deleted and removed posts are erased from our database within 30 days. Your posts stay if your subscription ends. You can delete them by deleting your account or by emailing us.
  • Reports: as long as the reported post or reply exists, or until the account that made the report is deleted.
  • Blocks: until you unblock the person (Settings → Blocked users) or either account is deleted.
  • Ban fingerprints: as long as the ban lasts, also after the account is deleted.
  • Server logs (IP address, device type): up to 7 days.
  • RevenueCat: your anonymous purchase records are kept by RevenueCat under its retention rules. We can ask RevenueCat to delete them if you ask us.
  • Support emails: 2 years after our last message, then deleted.

7. Your rights

You have the right to:

  • Access your data and get a copy in a portable format. Email us and we'll send your account data within one month. Without an account, your data is only on your phone, so we don't have a copy.
  • Correct it. Most of it you can edit in the app.
  • Delete it. In the app: Settings → Delete account (this also deletes your nickname, posts, replies, reports and blocks, and revokes Sign in with Apple), or Settings → Delete all data for the data on your phone. Deleting your account doesn't cancel your subscription. Cancel it in your App Store or Google Play settings. If you used Sign in with Google, you can also remove Reforged's access at myaccount.google.com/permissions.
  • Withdraw consent at any time, as easily as you gave it, by deleting your account or your posts. This doesn't affect processing before you withdrew it.
  • Object to processing based on legitimate interest.
  • Restrict processing in certain cases.
  • Complain to a data protection authority. In Czechia that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz). You can also complain in the EU country where you live.

To use any of these rights, email [email protected]. We may ask you to confirm that the account is yours.

8. If you live in the United States

We don't sell or share personal information for targeted advertising, and we don't let third parties track you through Reforged.

Do Not Track: we don't track you across sites or apps, so Do Not Track signals don't change anything.

We honor access, correction and deletion requests from all users, wherever they live. We don't discriminate against you for using them.

Residents of Washington, Nevada and other states with consumer health data laws: see our Consumer Health Data Privacy Policy.

9. Security

Data is encrypted in transit. On our server, each account can access only its own progress, and community data is reachable only through our server, which checks every request. No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.

10. Age

Reforged is only for people 18 and older. We don't knowingly collect data from anyone under 18. If you believe a minor has given us data, email us and we'll delete it.

11. Changes

If we change this policy, we'll update the date at the top. For important changes, we'll let you know in the app before they take effect.

12. Contact

Dominik Wojtucki, Dačická 137, 109 00 Praha, Czech Republic. Email: [email protected].