Privacy Policy

Effective date: 18 March 2026 · Last updated: 11 October 2026

1. Introduction

RePattern (Arabic: تبصره) ("RePattern", "we", "us", or "our") is a CBT-based self-help app for iOS, developed and operated by an individual developer based in the United Kingdom. Our bundle identifier is help.repattern.app and our website is repattern.help.

RePattern (Arabic: تبصره) ("RePattern", "we", "us", or "our") is a CBT-based self-help app for Android, developed and operated by an individual developer based in the United Kingdom. Our application ID is help.repattern and our website is repattern.help.

This Privacy Policy explains what information the RePattern app ("the App") collects, how it is used, where it is processed, how long it is kept, and your rights. It describes the App as it works today. You are viewing the iOSAndroid version of this policy; the Android versioniOS version differs where the apps differ.

RePattern is a self-help tool. It is not a medical device and not a substitute for professional care.

2. Data Controller

For the purposes of the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and other applicable data protection law, the data controller is:

• Entity: RePattern (sole developer)
• Location: United Kingdom
• Contact email: contact@repattern.help
• Website: repattern.help

For privacy questions, data subject requests, or complaints, contact us at contact@repattern.help. We aim to respond within 30 days.

3. The Short Version

• No account. There is no sign-up, and we never ask for your name, email address or phone number.
• Your journal is stored on your device, and in your own iCloud if iCloud is on for your device (Section 5). We have no access to it.
• Your journal is stored on your device, in an encrypted database. It is not backed up or synced anywhere (Section 5).
• AI is optional and off by default. If you turn it on, the text you are working on is sent over an encrypted connection to our server and passed to our AI provider (Anthropic) to generate a response. We do not store that text. Anthropic keeps it for up to 30 days for safety monitoring (longer only if it is flagged for misuse, as Anthropic's policy describes) and does not train on it (Section 6).
• What our server does keep is limited: usage counters and a few markers for daily limits, keyed by a hashed app identifier, and an operational log and server logs with no content and no app identifier. Subscription-check log lines carry a short hash fragment of the subscription identifier (Section 7).
• No analytics, advertising or crash-reporting SDKs are in the App.
• No analytics or advertising SDKs are in the App. Crash reports (Firebase Crashlytics) are on by default and can be turned off in Settings (Section 9).
• We do not sell or share your data for advertising.

4. Information We Do Not Collect

• Your name, email address, phone number or postal address
• Account credentials (the App has no registration or sign-in)
• Payment card details (payments are handled entirely by AppleGoogle Play)
• Advertising identifiers, cross-app tracking data or cookies
• Precise location (GPS or similar). We use only a two-letter country code, as described in Sections 7 and 8
• Data from HealthKitData from Health Connect or Google Fit, contacts, calendar, photos, microphone or camera
• Your journal history: past thought records, moods and exercise entries are never uploaded to us (iCloud sync, if on, goes to your own iCloud, not to us)

5. Data Stored on Your Device

6. AI Features

6.1 Consent

AI features are off by default. The App sends nothing to our AI service until you turn AI on and agree to the processing described here. Mental-health content is special category data, so we rely on your explicit consent (Section 12). You can turn AI off at any time in Settings; nothing more is sent from that moment. The thought record, exercises, breathing and mood tracking all work without AI.

6.2 Content Sent for AI Processing

Depending on the step you use, the request contains:

• Thought record steps (thinking traps, evidence, reframe, insight, explaining a trap): the situation and automatic thought you entered, your selected emotion and its intensity, the thinking traps you selected (numbers 1–18), and, for the final insight, your evidence, reframe and mood after.
• Exercise recommendation (Premium, on the Home screen): your latest mood and mood trend, the time of day, the thinking traps from recent records, the exercises you did recently, and the situation and thought from your most recent thought record, with how long ago you wrote it.
• Daily tip (Premium): only your App language. The tip is the same for everyone and is not based on your entries.
• Your App language (English or Arabic) with every request.

No other journal content is sent. Your past entries are never uploaded in bulk.

6.3 Technical Information Sent with AI Requests

• App identifier: a random identifier the App creates and keeps in the Keychain. It is not your Apple ID or any advertising identifier. We use it only to apply daily limits and block abuse (Section 7).
• App identifier: an identifier derived by one-way hash from your device's Android ID for this App. The Android ID itself is never sent, and the identifier is not your Google account or advertising ID. It stays the same if you reinstall the App, so that daily limits cannot be reset by reinstalling. We use it only to apply daily limits and block abuse (Section 7).
• Device check: a one-time Apple App AttestGoogle Play Integrity result proving the request comes from the genuine App on a genuine device (Section 7.3).
• App version and platform, so we can keep older versions working.
• Subscription: if you subscribe, your App Store transaction ID, so we can apply Premium limits (Section 7.4).
• Subscription: if you subscribe, your Google Play purchase token, so we can apply Premium limits (Section 7.4).
• IP address: like any internet request, your IP address is visible to Cloudflare and to our server while the request is handled. We do not store it, and we do not use it to identify you or to count your usage.

6.4 How AI Requests Are Processed

Your request travels over HTTPS (TLS 1.2 or higher) through Cloudflare, our network provider, to our server, which is hosted by Railway in the European Union (Netherlands). Our server checks your daily limits and forwards the text to our AI provider:

• Anthropic (Claude) is our AI provider. Anthropic receives the request text and our instructions, but not your IP address, app identifier, subscription details or any other identifier. Under Anthropic's commercial terms, API data is not used to train models, and inputs and outputs are deleted within 30 days; content flagged for a possible usage-policy violation may be kept for up to 2 years. See Anthropic's Privacy Policy.
• Google (Gemini on Vertex AI) is configured as a back-up provider, processing in the EU (Belgium). It is not in use today. If we switch to it, the same text would be sent to Google in the same way, without your IP address or any identifier, Google would not use it for training, and we would update this policy first.

We do not store your text. Our server holds the request and the AI response in memory only while it is being processed, then discards them. We do not log, copy, hash or keep anything derived from your content. Technically our server could read the text while processing it; we commit not to, and no person at RePattern reviews it.

6.5 Crisis Safety

Every AI request is checked for signs of suicidal thoughts, self-harm or harm to others. If the AI or our safety checks detect this, the App shows crisis support and helpline numbers instead of the usual response. This is automated. It is not a diagnosis, monitoring or an emergency service, and we cannot contact you or anyone else. Our server records that a crisis response was shown, as an operational record with no content and no identifier, kept for 1 year for safety reporting (Section 7.1).

6.6 Usage Limits

AI use has daily limits. On the free plan you can complete one AI thought record a day (three on your first day); Premium has much higher limits. These limits are enforced on our server with the counters described in Section 7.2.

7. What Our Server Keeps

Our server never stores journal content or AI responses. It keeps only the following.

7.1 Operational Log

One row per AI request, containing: which AI feature was used, whether it succeeded or why it failed, how many output tokens the AI generated, how long it took, the App language, the AI model, the App version, the platform (iOS or Android), the country (a two-letter code from Cloudflare), whether a crisis response was shown and why, whether you were on Premium, and the time. The row contains no content and no identifier — no app identifier, IP address, transaction ID or purchase token — so it cannot be linked back to you or your device. Rows are deleted after 90 days; rows recording a crisis response are kept for 1 year for clinical-safety reporting.

7.2 Usage Counters

To enforce daily limits, our server counts requests under a key made from a one-way hash (SHA-256) of your app identifier. Counters expire automatically, from one minute up to one day. Under the same hashed key we also keep:

• a marker that this app identifier has used AI, so a new user gets the first-day allowance only once. It holds no time. Only its deletion date, about 400 days after your first AI request and rounded up to a whole day, reflects when you first used AI;
• for your first 24 hours only, a marker for the first-day allowance;
• with Premium, the topics of your last 12 daily tips (topic names we chose, never your content) until 14 days after your latest tip, so tips don't repeat, and your current tip for 4 hours.

These records contain no content.

7.3 Device Checks

To stop automated abuse, the App proves it is genuine using Apple App Attest. Our server checks the result itself; nothing is sent to a third party. Your app identifier and a "verified" flag are kept for up to 24 hours, and one-time challenges for 5 minutes.

To stop automated abuse, the App proves it is genuine using Google Play Integrity. Our server sends the resulting token to Google to be checked; Google's answer tells us whether the App and device are genuine. Your app identifier and a "verified" flag are kept for up to 24 hours, and one-time challenges for 5 minutes. Google processes the check under the Google Privacy Policy.

7.4 Subscription Checks

If you subscribe, our server asks Apple's App Store Server API whether your transaction ID belongs to an active subscription, and remembers the answer for up to 24 hours. Apple also sends our server notices when a subscription renews, lapses or is refunded; we keep a record of each notice with the subscription identifier stored only as a keyed hash (HMAC-SHA256), never in readable form, and delete it 24 months after we receive it.

If you subscribe, our server asks Google Play whether your purchase token belongs to an active subscription, and remembers the answer for up to 24 hours. Google also sends our server notices when a subscription renews, lapses or is refunded; we keep a record of each notice with the subscription identifier stored only as a keyed hash (HMAC-SHA256), never in readable form, and delete it 24 months after we receive it.

7.5 Error Monitoring

When our server hits an unexpected error, a technical report is sent to Sentry (hosted in the EU, Germany). Reports contain the error, the request method and path, the App version and platform. We strip request bodies, your IP address, your app identifier, subscription details and all other headers before anything is sent. Routine responses such as "limit reached" are not reported. Sentry keeps reports for up to 90 days.

7.6 Insight Feedback

When you answer “Was this helpful?” under an AI insight, the App sends your yes or no with a one-time code that came with that insight. On our server the code stands only for the insight’s technical details — the AI model, whether you were on Premium, the App language, platform and version — and it is deleted when your answer arrives, or after 24 hours. We keep one row with your answer and those details, with the time rounded to the hour. The row contains no content and no identifier, so it cannot be linked back to you, your device or the insight. Rows are deleted after 90 days. Answering is optional.

7.7 Server Logs

While it handles a request, our server writes short technical log lines. For an AI request these say, for example, which feature was used, the result, how long it took, the AI model, the platform, whether you were on Premium and whether a crisis response was shown, plus a random request number that groups the lines of one request. Log lines contain no content, no IP address and no app identifier (or hash of it). The security library we use for device checks would print a fragment of a hash of the app identifier; we remove it before the line is written. When our server checks a subscription with AppleGoogle (about once a day for an active subscription), and when a subscription notice arrives, the lines about it include the first 8 characters of a one-way hash of the subscription identifier, so that a failed check can be investigated. Our hosting provider, Railway, keeps these logs for up to 30 days. Railway and Cloudflare also keep their own short-lived records of incoming requests (such as the time, the web address requested and network details) under their own privacy policies (Section 18).

8. Crisis Helplines

To show the right phone numbers, the App asks our server for the helpline list for your region, sending only a two-letter region code (from your device's region settingfrom your mobile network, SIM or device settings). This request carries no app identifier, no subscription details and no content. Our server does not log or store the region; because it is part of the web address, it can appear in the request records our network and hosting providers keep (Section 7.7). The list is not stored on your device either: the App asks again each time it shows help, so without a connection it shows the findahelpline.com link instead of numbers.

9. Crash Reports

The iOS App contains no crash-reporting, analytics or advertising SDKs. If you share crash reports with developers in your iOS settings, Apple may pass us crash logs that don't identify you, under Apple's own terms.

10. Subscriptions and Payments

RePattern Premium is an auto-renewing subscription (weekly or yearly, with prices set by region) sold through Apple's App Store. Apple handles all payment details; we never see them. Your App Store transaction ID is used as described in Section 7.4. Manage or cancel in App Store > your profile > Subscriptions.

RePattern Premium is an auto-renewing subscription (weekly or yearly, with prices set by region) sold through Google Play Billing. Google handles all payment details; we never see them. Your purchase token is used as described in Section 7.4. Manage or cancel in Google Play > Payments & subscriptions.

11. Reminders, Widget and Ratings

• Daily reminders are scheduled on your device. There is no push-notification server and no device token is sent to us.
• The home-screen widget reads your latest mood from the App's storage on your device and makes no network requests.
• The App may ask you to rate it using the standard Applestandard Google Play rating prompt. Your rating goes to the store, not to us.
• When you export a PDF (Premium), it is created on your device and protected with a password; you choose where it goes.

12. Legal Basis for Processing (UK GDPR / EU GDPR)

• Explicit consent (Articles 6(1)(a) and 9(2)(a)): sending your content for AI processing. You can withdraw it at any time in Settings; this does not affect processing before withdrawal. Crash reporting also relies on your choice in Settings.
• Contract (Article 6(1)(b)): checking your subscription so we can provide Premium.
• Legitimate interests (Article 6(1)(f)): usage limits, device checks, error monitoring, the operational log and insight feedback, which keep the service secure, affordable, safe and useful. These use the minimum data needed and no content.

13. Where Data Is Processed

• Our server, database and error monitoring: European Union (Railway in the Netherlands; Sentry in Germany).
• Cloudflare: a global network; your connection is handled at the location nearest you.
• Anthropic: United States.
• Apple (App Attest, App Store, iCloud): under Apple's terms.
• Google (Play Integrity, Play Billing, Firebase Crashlytics): Google's global infrastructure, including the United States.

Transfers outside the UK and EEA rely on the providers' Standard Contractual Clauses, the UK International Data Transfer Addendum or the EU–US / UK–US Data Privacy Framework, as applicable.

14. Your Rights

14.1 UK and EU

You have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, to withdraw consent, and to complain to a supervisory authority (Section 20). Your journal is on your device, where you can view, edit, export and delete it yourself. Our server holds no content, no name or email, and only hashed or short-lived identifiers, so in most cases we cannot link server records to you. If you send us a request, we will help as far as we can.

14.2 California (CCPA / CPRA)

We do not sell or share personal information, and we do not use it for targeted advertising. In the last 12 months we have processed, for the business purposes described in this policy: identifiers (the hashed app identifier and subscription identifiers in Section 7), sensitive personal information you choose to send for AI processing (not stored), and coarse location (country). You have the right to know, delete and correct, and the right not to be discriminated against for using these rights.

14.3 Contact

Email contact@repattern.help. We will respond within 30 days, or sooner where the law requires.

15. Retention and Deletion

• Your journal and safety plan: on your device until you delete them (and in your iCloud, if on, until removed there).
• AI request text: not stored by us; deleted by Anthropic within 30 days (up to 2 years if flagged).
• Operational log: 90 days; crisis-response rows 1 year.
• Usage counters: up to 1 day; first-day marker 24 hours; “has used AI” marker about 400 days; daily-tip topics (Premium) 14 days after the latest tip.
• Device-check records: up to 24 hours.
• Subscription status: up to 24 hours; subscription notices (hashed) 24 months.
• Server logs (Railway): up to 30 days.
• Error reports (Sentry): up to 90 days.
• Crash reports (Crashlytics): up to 90 days.

To delete your data:

• Settings > Delete All Data erases your thought records, moods, exercises, safety plan and cached data from this device (and, with iCloud on, from iCloud), along with the encryption keys and your stored purchase token.
• Uninstalling the App removes its data from the device, except Keychain items, which iOS may keep.
• Turning AI off in Settings stops all further AI requests.
• Turning off crash reports in Settings stops further crash reports.
• Server records expire on the schedule above. Because they are not linked to your identity, there is nothing on our server we could find for you by name or email.

16. Children

RePattern is not intended for children under 13 (or the age of digital consent where you live), and we do not knowingly collect their personal data. If you think a child has used AI features, contact us at contact@repattern.help.

18. Service Providers

• Cloudflare — network and security in front of our server. Keeps its own connection logs under Cloudflare's Privacy Policy.
• Railway — hosts our server, database and server logs in the EU, and keeps its own request logs. Railway's Privacy Policy.
• Anthropic — AI processing (Section 6.4). Anthropic's Privacy Policy.
• Google Cloud (Vertex AI) — back-up AI provider, not currently in use (Section 6.4).
• Sentry — server error monitoring in the EU (Section 7.5). Sentry's Privacy Policy.
• Apple — App Store, subscriptions, App Attest and iCloud. Apple's Privacy Policy.
• Google — Google Play, Play Billing, Play Integrity, in-app review and Firebase Crashlytics. Google Privacy Policy.

We do not use advertising networks, analytics providers, social-media SDKs or data brokers.

19. Security

• HTTPS (TLS 1.2 or higher) for every connection, with certificate pinning to our server.
• iOS Data Protection for the journal; Keychain for identifiers.
• An encrypted database with a second layer of field encryption; keys protected by the Android Keystore; screenshots blocked.
• Device checks (App AttestPlay Integrity) on every AI request.
• No content in server logs, error reports or databases.

No system is perfectly secure. If a breach affects personal data, we will notify the relevant supervisory authority within 72 hours where required, and affected people where we are able to.

20. Changes and Complaints

We will update this page and its "Last updated" date when our practices change. If a change affects AI processing you have consented to, the App will ask for your consent again before it applies. Because we have no accounts or email addresses, we cannot notify you directly.

You can complain to the UK Information Commissioner's Office or to your local EU data protection authority.

21. Contact Us

Email: contact@repattern.help
Website: repattern.help