Privacy Policy

1. Who We Are

DrySure ("we," "our," or "us") is operated by QUITSURE FZCO, with its registered office at DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, DDP, Building A1, Dubai, United Arab Emirates. We are the "controller" (or "data fiduciary") responsible for your personal data.

This Privacy Policy explains what information we collect when you use the DrySure mobile app and the drysure.app website (together, the "Service"), why we use it, who we share it with, how long we keep it, and the choices and rights you have. DrySure is a self-help and coaching app for adults who want to drink less or stop drinking. It is not a medical or treatment service.

For any privacy question or request, email hello@drysure.app.

2. Information We Collect

(a) Information you give us

• Account information: your name (if you give it), email address, and sign-in details. You can sign in with an emailed one-time code, Google, or Apple. If you use Google or Apple, they share your account identifier and email address with us (Apple may give us a private relay address instead).
• Profile and goal information: answers you give during onboarding, such as your age range, your goal (quit, cut back, or not sure yet), your current drinking patterns, and your preferences.
• Drinking and progress entries: program progress, completed exercises, and streaks, plus, where the app offers them, alcohol-free days, drinks you log, and weekly targets you set.
• Journal and exercise entries: the free-text reflections, mood notes, and exercise answers you write.
• Conversations with Clara: if Clara, our AI coach, is available in your version of the app and you use it, the messages you send to Clara and Clara's replies.
• Community content: if the community is available in your version of the app and you use it, your posts, comments, images, and community display name. Other members can see what you post in the community, so please don't share anything there you want to keep private.
• Support messages: what you send us when you email or contact support.

(b) Information collected automatically

• Device and app information: device model, operating system, app version, language, time zone, and app identifiers such as a Firebase installation ID and a push notification token.
• Usage information: which screens and features you use and when (for example, lessons completed), collected through Firebase Analytics and our own server-side event records.
• Install attribution: how you found the app, such as the store listing, campaign, or link (UTM) parameters that led to your install.
• Diagnostic information: error logs and performance data that help us fix problems.
• Approximate location: a general area (such as country or region) inferred from your IP address. We do not collect precise GPS location.

(c) Information from others

• Apple, Google, and RevenueCat: whether you have an active subscription, the plan, and renewal status. We never receive your full card details.
• Sign-in providers: as described in (a).

DrySure does not read data from Apple Health, Google Fit, or other health platforms. If we ever add that, we will ask for your permission first.

3. Your Drinking and Health-Related Data

Information about your drinking, cravings, mood, and wellbeing, including what you write in your journal and tell Clara, is sensitive. Laws treat it as health data or special-category data (for example, the EU and UK GDPR), as "consumer health data" (for example, Washington's My Health My Data Act and Nevada's equivalent law), or as sensitive personal information (for example, California law). We treat it that way everywhere:

• We use it only to provide the features you use, and only with your explicit consent where the law requires it.
• We never sell it, never use it for advertising or to target ads, and never share it with advertisers or data brokers.
• We share it only with the service providers in Section 6 that process it for us under contract, and as required by law.
• You can withdraw consent at any time by deleting entries or deleting your account in the app (Account > My Account), or by emailing us. Withdrawing consent means we can no longer provide the features that depend on that data.

4. How We Use Your Information and Why

We use your information for the purposes below. If you are in the EU, EEA, or UK, the legal basis for each is shown in brackets.

• Providing the Service: creating your account, running your program, progress tracking, journal, exercises, community, and Clara (performance of our contract with you; explicit consent for health-related data).
• Personalization: tailoring your program, content, and Clara's replies to your goal and progress (contract; explicit consent for health-related data).
• Subscriptions: checking and managing your subscription through Apple, Google, and RevenueCat (contract; legal obligation for tax and accounting records).
• Service messages: sign-in codes, security alerts, and important changes to the Service (contract; legitimate interests).
• Push notifications: reminders and encouragement, if you allow notifications on your device (consent; you can turn them off in your device settings at any time).
• Marketing and lifecycle emails: tips, program nudges, product news, and offers. These emails may contain a small image that records when an email is opened and links that record when they are clicked. Where the law requires it, we ask for your consent before sending marketing emails or using this tracking; otherwise we rely on legitimate interests. Every marketing email has an unsubscribe link, and unsubscribing does not affect service messages.
• Analytics and improvement: understanding how the app is used, which content helps, and where it breaks, and measuring which channels bring people to DrySure (legitimate interests, or consent where the law requires it). We use analytics in aggregate and do not put the content of your journal or Clara conversations into analytics tools.
• Safety, security, and moderation: keeping the community safe, preventing fraud and abuse, and protecting the Service (legitimate interests; legal obligation).
• Legal compliance: meeting legal obligations and responding to lawful requests (legal obligation).

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see Section 10).

5. AI and Automated Processing

Some DrySure features use trusted third-party AI providers, such as Google (Gemini) and Anthropic (Claude). They process your data only on our instructions and only to provide that feature. The providers we use may change as these services improve; you can ask us for the current list at hello@drysure.app.

• Program search: your search text is processed by an AI provider so we can find matching lessons and exercises.
• Clara, our AI coach (if available in your version of the app): Clara is an AI system, not a person and not a clinician. When you chat with Clara, your messages and relevant context from your program (such as your first name, your goal and your recent progress) are processed by an AI provider to write Clara's replies and to summarize your conversations so Clara can keep context.
• Community moderation (if available in your version of the app): an AI provider helps check posts, comments and display names for content that may break our rules.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. If your content is removed or your account is restricted after an automated flag, you can ask for a person to review it by emailing hello@drysure.app.

6. Who We Share Information With

We do not sell your personal data, and we do not share it for cross-context behavioral (targeted) advertising. We share it only with:

(a) Service providers (processors)

These companies process data for us under written contracts and may not use it for their own purposes:

• Google Cloud (hosting and storage): our servers, database (Cloud SQL), file storage (Cloud Storage), and cache (Redis). Holds all account and app data.
• Google Firebase: sign-in (Firebase Authentication), push notifications (Firebase Cloud Messaging), app analytics (Firebase Analytics), and hosting this website (Firebase Hosting).
• AI providers (program search, Clara, and community moderation): see Section 5.
• Amazon Web Services (SES) (email delivery): your email address, the emails we send, and open/click events.
• RevenueCat (subscription management): purchase and entitlement records and an app user ID.

(b) Others

• Apple and Google handle payments, sign-in, and app distribution under their own privacy policies.
• Other members see what you post in the community.
• Authorities or others when the law requires it, or when we believe in good faith it is needed to protect someone's life or safety, or to defend legal claims.
• A buyer or successor if DrySure is involved in a merger, acquisition, or sale of assets. This Privacy Policy will continue to apply to your data, and we will tell you before it is transferred where the law requires.

7. How Long We Keep Information

• Account and app data (profile, entries, journal, Clara conversations): while your account is open.
• When you delete your account (in the app under Account > My Account, or by emailing us): deleting in the app removes your account and app data from our live systems straight away, and we complete emailed requests within 30 days. Removal from connected services and from our backups is completed within 30 days. See how to delete your account for what is deleted and what is kept.
• Community posts: deleted with your account, or earlier if you delete them.
• Analytics data and server and diagnostic logs: for a limited period, then deleted or aggregated so they no longer identify you.
• Subscription and transaction records: as long as tax and accounting law requires.
• Support emails: as long as needed to help you and handle any follow-up.
• Moderation and safety records: as long as needed to handle the issue, any appeal, or legal claims.

Deleting the app from your phone does not delete your account.

8. How We Protect Information

We use technical and organizational measures suited to the sensitivity of this data, including encryption in transit (TLS) and at rest, access limited to staff who need it, and hosting with established cloud providers. No system is completely secure, so we can't guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires.

9. International Transfers

We are based in the United Arab Emirates, and our providers process data in other countries, including the United States. When we transfer personal data out of the EU, EEA, UK, or another country with transfer rules, we use a recognized safeguard, such as an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-U.S. Data Privacy Framework. You can ask us for a copy of the relevant safeguard.

10. Your Rights and Choices

Depending on where you live, you have some or all of these rights:

• Access: get a copy of your personal data and information about how we use it.
• Correction: fix inaccurate or incomplete data.
• Deletion: delete your data, including by deleting your account in the app.
• Portability: receive your data in a commonly used, machine-readable format.
• Restriction and objection: limit or object to certain uses, including any use based on legitimate interests and all direct marketing.
• Withdraw consent: at any time, without affecting what we did before you withdrew it.
• Human review: ask for a person to review an automated decision (see Section 5).
• Opt out of sale, sharing, and targeted advertising: we don't do these, so there is nothing to opt out of. If that ever changes, we will update this policy and honor browser opt-out signals such as Global Privacy Control.
• Non-discrimination: we will not treat you differently for using your rights.

How to use your rights: you can view, edit, and delete most of your data and delete your account directly in the app. For anything else, email hello@drysure.app from the address linked to your account. We may need to verify your identity first. We respond within one month (EU/UK), 45 days (US states), or the time your local law sets, and will tell you if we need longer. An authorized agent may make a request for you where the law allows, with proof of authority. If we decline your request, you can appeal by replying to our decision; we will respond to the appeal within the time your law requires.

Region-specific information

• EU, EEA, and UK: you can complain to your local data protection authority (in the UK, the Information Commissioner's Office). We'd appreciate the chance to help first.
• United States (California and other states with privacy laws): in the last 12 months we collected the categories in Section 2 (identifiers, account details, commercial information about subscriptions, internet and app activity, approximate location, and sensitive personal information about health) for the purposes in Section 4, and disclosed them only to the recipients in Section 6. We use sensitive personal information only to provide the Service you asked for, so we do not offer a separate "limit" option. We do not sell or share personal information, including that of anyone under 16.
• Washington, Nevada, and other consumer health data laws: we collect and share consumer health data only with your consent and as needed to provide the Service, never sell it, and you can ask for a list of the third parties we shared it with, or ask us to delete it.
• India: under the Digital Personal Data Protection Act, 2023, you can also nominate someone to exercise your rights if you die or become incapacitated, and raise a grievance with us at hello@drysure.app before complaining to the Data Protection Board of India.
• Brazil: you have the rights in Article 18 of the LGPD, which you can exercise by emailing hello@drysure.app, and you may complain to the ANPD.
• Canada and Australia: you can complain to the Office of the Privacy Commissioner of Canada or the Office of the Australian Information Commissioner if you are not satisfied with our response.

11. Age Requirement and Children's Data

DrySure is for adults aged 18 and over. The app asks your age during onboarding and doesn't let anyone who says they are under 18 continue. We do not knowingly collect personal data from anyone under 18, and we do not track or monitor children's behavior or target advertising at them. If we learn that we have collected personal data from someone under 18, we will delete it. If you believe someone under 18 has given us personal data, please email hello@drysure.app and we will delete it.

12. This Website and Cookies

The drysure.app website is informational. It does not use analytics, advertising, or social-media tracking, and it does not set cookies or store anything else in your browser. Specifically:

• Our hosting provider (Firebase Hosting) processes your IP address and standard request information to deliver pages and keep the site secure.
• Fonts are served from our own site, so loading a page does not contact a third-party font service.
• The contact form does not send anything to us; it opens your own email app with a pre-filled message, which you choose whether to send.
• Links to the App Store, Google Play, or other sites take you to services with their own privacy policies.

If we add analytics or other non-essential cookies to the website later, we will update this section first and ask for consent where the law requires it.

13. Changes to This Policy

We may update this policy as the Service or the law changes. We will change the "last updated" date above and, for material changes, tell you in the app or by email before they take effect. If a change needs your consent (for example, a new use of your health-related data), we will ask for it and will not apply the change to you without it.

14. Contact Us

For any question or request about your privacy: