Your notes stay here.

ENUFF asks you to create an account before starting the assessment. We store the email address or provider identity and the session that proves it is you. If you join Community, the name and posts you publish are stored on our servers and can be read by other signed-in members.

iPhone Screen Time protection is free and can be used without an account or the assessment. Its permission, selected apps, and website rules stay on the device.

Membership is billed by Apple or Google. We learn whether ENUFF Premium is active. We do not receive your card number. We do not sell personal information, and this version of the apps has no advertising and no behavioral analytics.

Device storage is the app’s private storage. It is not a separate encrypted vault. Exports include your reflections in a readable form. Protect the device with a passcode, and keep exports somewhere you trust.

Recovery records are saved in a private on-device database, separately for the guest space and for each signed-in account used on that device. They are not sent to ENUFF when you sign in, subscribe, or restore a purchase.

If you already have a guest journey and then sign in, the app can ask whether to copy it into a separate local space for that account. The copy stays on the device. The original guest journey remains available when you are signed out. You can decline and start a separate local journey instead.

A browser preview of the app, if you use one, keeps recovery data in that browser’s IndexedDB storage, with migration from older local storage. Clearing the browser can erase it. The installed iOS and Android apps are the product these pages describe.

An account is required for the assessment and recovery journey. Free iPhone protection does not require one. Before sign-in, the app asks you to confirm your age and accept the Terms, with a link to this policy. After sign-in, your account stores the terms and privacy version, adult confirmation, and a server-generated acceptance timestamp. Existing accounts are asked again when the required version changes. Creating an account does not move your recovery notes to the cloud.

Sign-out ends the session on that device. It does not delete the account, cancel a subscription, or erase the on-device journey.

Community is a signed-in space. Guests cannot post. The app does not publish sample preview posts. New posts, replies, usernames, and emoji are held for staff review. Approved content can be read by other members who are not blocked. Pending and rejected submissions remain available to their author and authorized staff; they are not public. A neutral member name is used until a profile is approved.

You can delete your own post. The text is removed. Replies in that conversation may remain as a notice that the original was deleted. ENUFF can hide a post or restrict a member’s Community access after a report. Hiding a root post hides its conversation.

Do not post your legal name, contact details, or someone else’s private information if you want to stay behind the Community name. Other members cannot see your email. Authorized staff can connect your Community identity to your account for moderation and support. Ordinary members cannot make that connection.

ENUFF Premium is an auto-renewing subscription sold by the App Store or Google Play. The purchase screen shows the price, currency, and period before you confirm.

The apps use RevenueCat to read that store status. RevenueCat may initialize with an anonymous installation id. After you sign in, the app sends your account id to RevenueCat so the same membership can follow that account. It does not send your assessment, journal, email, or protection rules.

RevenueCat sends subscription events to our backend. We store a limited membership snapshot linked to the account id, including the product, store, expiry, renewal or billing issues, refund status, test environment, and time last checked. Authorized staff can refresh this information to investigate access problems. Apple or Google keeps the payment account. Restoring a purchase restores membership. It does not restore reflections that existed only on another device.

Protection is optional and runs on the device. ENUFF does not keep a history of sites you visit or apps you open.

On iPhone, protection uses Apple’s Screen Time tools after you approve them. The apps and categories you pick stay in Apple’s on-device selection. ENUFF does not receive a list of what you browsed. You can revoke Screen Time access in iOS Settings.

On Android, ENUFF uses the Accessibility service to identify the app that opens. When its app identifier matches a selected app and your manual blocking or schedule is on, ENUFF returns you to the home screen. The app picker shows launchable apps and saves only the apps you choose. Identifiers are checked on the device; they are not uploaded or saved as an app-use history.

The Android service does not read screen contents, messages, passwords, browser addresses or screenshots. Android protection blocks selected apps; it does not filter websites, inspect traffic or use a VPN. Your app choices and schedules stay in private device storage. Schedules follow the device’s local clock and time zone.

A separate in-app disclosure explains Accessibility access before you choose Agree & open Settings. You can decline. Granting access does not turn blocking on; you choose manual blocking or enable a schedule separately. You can pause all blocking in ENUFF or revoke access in Android’s Accessibility Settings. Pausing keeps your choices and schedules saved. Settings, your home screen, phone controls and ENUFF remain accessible. Force-stop, revoked access or battery restrictions can interrupt blocking; check its status after restarting your phone.

This version does not use advertising identifiers, cross-app tracking, or a product analytics SDK. It does not ask for your contacts, photos, microphone, precise location, or health records from Apple Health or Google Health. It does not send recovery notes to an AI service. There is no AI coach in this version.

The database has room for a future cloud copy of recovery records. That copy is not enabled. If we offer it later, we will ask for a separate choice and update this policy before any upload.

This website does not ask you to create an account and does not set advertising or analytics cookies. The host that serves these pages may keep ordinary connection logs, such as IP address and the page requested, to operate and secure the site.

We use these providers for the parts of the service that leave your device:

• Supabase stores accounts and Community. The current project is in the Tokyo region.
• Resend sends the sign-in email. It does not receive recovery content.
• RevenueCat reads subscription status from the stores.
• Apple and Google process the purchase, and Apple processes Screen Time permission on the iPhone.
• Vercel hosts this website and processes ordinary connection information to serve and secure its pages.

Availability depends on the countries selected in the stores. Account, Community, subscription snapshots, and support-operation data are processed in Japan and in the countries where those providers operate, which include the United States. We do this to provide the account, Community, and membership you choose.

Authorized staff use a dashboard protected by sign-in, authenticator verification, and a current staff permission. They can review Community submissions and reports, remove content, restrict Community access, and inspect decision history.

For account and subscription support, staff can see an account’s email, id, creation date, staff status, and limited membership snapshot. Deletion requests record an internal support reference, ownership-verification status, deadline, attempts, and outcome. These tools do not expose your assessment, private journal, check-ins, protection selections, passwords, or raw purchase receipts.

If you email support, we receive the information you choose to send. Do not send passwords, sign-in codes, payment-card details, or recovery exports unless needed for your request. The website’s deletion button opens an email draft; it does not submit a request until you send it. Staff verify ownership before acting on that request.

Your account, agreement receipts, Community records, and membership snapshot remain while the account exists, unless you remove content earlier. Account deletion removes these linked records from the active database. Reports and moderation records tied to deleted content are removed with it; if a staff account is deleted, its identity is removed from reviews of other members’ content.

Completed support-deletion cases retain a limited receipt: an internal case reference, dates, actions, and outcome. The target email and account identifier are removed. We retain these receipts to handle follow-up and document completion; they do not contain your journal or copies of Community posts. Cancelled requests remain linked to the account while it exists so staff can resolve follow-up; cancelling a request does not delete the account.

Provider backups, security logs, support emails, and store transaction records have separate retention. Account deletion does not instantly erase every backup or the records Apple or Google must retain. Access to retained records is limited to operating and securing the service, resolving a request, and legal obligations. Contact us about a specific retained record. There is no enabled cloud backup of your private recovery history.

Export. In Settings, Export my data shares a copy of the recovery snapshot on that device, including notes and reflections. It does not include Community posts, Screen Time selections or Android app-blocking rules. The share sheet lets you save or send that copy yourself.

Reset the journey. Reset my journey clears the assessment, check-ins, and progress in the local account space you are using. Export first if you want a copy. Reset does not sign you out, cancel a subscription, delete Community posts, or turn device protection off.

Sign out. Sign out on this device ends that session. The on-device journey for that account remains on the device until you reset it or remove the app.

Delete the account. Use Account → Delete my account in versions that include that option, or use our account deletion page without the app. We verify ownership for email requests and complete them within 30 days after verification. Deletion removes the authentication account, profile, preferences, legal consent receipts, Community membership and its posts, replies, reactions, blocks and reports, and any recovery records saved to your account online. We also request RevenueCat customer-record erasure, which it processes asynchronously. In-app deletion clears the account’s journey on the device used for deletion and retains only a local account identifier that prevents stale sessions restoring it. It does not cancel an App Store or Play subscription, erase local copies on other devices or the separate signed-out journey, or switch off device protection. Reset other local journeys before deletion, or remove the app and its local data.

Subscriptions and permissions. Manage or cancel ENUFF Premium in your Apple ID or Google Play subscriptions. Revoke Screen Time or Android Accessibility access in the system settings. You can use Community without posting.

ENUFF is for adults. You must be 18 or older. The apps are not directed to children, and we do not knowingly create accounts for anyone under 18. If you believe a child has an account, email [email protected] and we will delete it.

We will update this page when the data practices change. The date at the top is the policy version. Material updates require a new explicit agreement in the app. If a change would start uploading recovery notes, we will not do that under this policy: we will publish the new policy and ask for a separate choice first.

Privacy questions and deletion requests: [email protected].

Also read the terms.