HOLDON
KOEN

Privacy Policy

Effective Date: July 19, 2026

1. Overview

HOLDON protects the personal information of users of our "Gambling Urge Management App" and provides guidance on the types of information collected, purposes of use, retention periods, and user rights.

2. Personal Information Collected

Upon Registration

  • Google or Apple account linked information (email, name)
  • Age range, alternative activities of interest, auto-generated nickname
  • User (person in recovery) or Supporter role

During Service Use

  • Urge session data (time, emotions, alternative behaviors, intensity)
  • Care program data (gambling type, frequency, duration, financial impact)
  • Daily check-ins (urge intensity, stress, sleep, gambling status, etc.)
  • Urge event records
  • Community posts and chats
  • AI coaching conversations (saving is optional)
  • Profile photo (optional)

Automatically Collected

  • Device push token (FCM): collected for sending notifications
  • iOS or Android platform information
  • App usage events (Firebase Analytics): first open, sessions, app updates, etc. — for ad performance measurement and service improvement; no identity information

3. Sensitive Information Notice

Gambling type, frequency, addiction duration, financial impact, and urge intensity are considered health-related sensitive information. This data is used solely for the purpose of providing the service and is never shared with third parties without user consent.

4. Purpose of Personal Information Use

  • Service provision and personalized content
  • AI coaching feedback
  • Sending notifications
  • Community management
  • Providing care progress status (binary status only) to supporters
  • Service improvement
  • Ad performance measurement (aggregate measurement of ad effectiveness in helping users discover the service, no personal identification)

5. Third-Party Provision and Outsourcing

The third parties below provide an equivalent level of personal-data protection under their own privacy policies (OpenAI: openai.com/policies/privacy-policy, Anthropic: anthropic.com/legal/privacy, Google/Firebase: policies.google.com/privacy, Supabase: supabase.com/privacy, RevenueCat: revenuecat.com/privacy).

AI Service Providers

  • OpenAI: AI coaching response generation
  • Anthropic (Claude), Google (Gemini) - alternative providers
  • User identifying information (name, email) is not transmitted

Infrastructure Providers

  • Supabase: Database, authentication, file storage (server location: United States)
  • Firebase (Google): Push notifications (FCM), crash diagnostics (Crashlytics), and analytics for ad performance measurement and service improvement. No identity information such as name or email is sent

Payment Service Providers

  • RevenueCat, Inc.: In-app purchase subscription processing, validation, and subscription status management
  • Data transmitted: App user identifier (internal UID), purchase receipts and transaction data issued by Apple App Store / Google Play
  • Directly identifying information such as name or email is not transmitted
  • Retention: For the duration of subscription status management

Authentication Providers

  • When logging in with Google or Apple accounts

6. Retention and Deletion of Personal Information

On-device data: Automatically removed when the app is deleted

Retention Period

Retained for the duration of the account

Upon Account Deletion

All data is permanently deleted immediately - including profile, session records, check-in records, AI chats, community posts, chat messages, connection information, and profile photos

7. User Rights

  • Delete account in settings (all data permanently deleted)
  • Opt out of AI chat saving
  • Disable individual notifications
  • Use community anonymously
  • Disconnect from supporter

8. Device Access Permissions

Permissions that may be requested (all optional):

  • Notifications (check-in, care, chat notifications)
  • Camera (profile photo capture)
  • Photo library
  • Face ID/Touch ID (app lock)

Location information is not collected.

9. Locally Stored Data

The following data is stored only on the device (SharedPreferences) and is not transmitted to servers:

  • App lock settings
  • Notification frequency and risk time zones
  • IF-THEN implementation intention rules
  • Planned activities
  • Last chat check time

10. Child Protection

The service is not intended for children under the age of 14. If we become aware that a user is under 14, their information will be deleted immediately.

11. AI Safety Filters

  • Conversations about gambling strategies or methods are automatically blocked
  • When expressions of self-harm/suicide are detected, contact information for professional counseling organizations is provided

12. Changes to the Privacy Policy

Changes will be announced through in-app notifications. Separate consent may be requested for significant changes.

13. Contact

Email: [email protected]