1<!doctype html> 2<html lang="en"> 3<head> 4<meta charset="utf-8"> 5<meta name="viewport" content="width=device-width, initial-scale=1"> 6<title>Privacy Policy â Gracen</title> 7<link rel="preconnect" href="https://fonts.googleapis.com"> 8<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> 9<link href="https://fonts.googleapis.com/css2?family=DM+Sans:wght@400;500;600;700&display=swap" rel="stylesheet"> 10<link rel="stylesheet" href="/style.css"> 11</head> 12<body> 13<header class="site-nav"> 14 <div class="wrap"> 15 <a class="brand" href="/">Gracen</a> 16 <nav><ul> 17 <li><a href="/privacy-policy" aria-current="page">Privacy</a></li> 18 <li><a href="/terms-and-conditions">Terms</a></li> 19 <li><a href="/data-deletion">Data Deletion</a></li> 20 <li><a href="/impressum">Impressum</a></li> 21 </ul></nav> 22 </div> 23</header> 24 25<main class="wrap"> 26<article class="doc"> 27 <h1>Privacy Policy</h1> 28 <p class="updated"><strong>Last updated: 14 August 2026</strong></p> 29 30 <p>This Privacy Policy explains how <strong>S&C Development GmbH</strong> ("Gracen", "we", "us", "our") collects, uses, shares and protects your personal data when you use the Gracen mobile application, the Gracen website and sign-up funnel, the Gracen browser extension, and any related products and services (together, the "Service").</p> 31 <p>We are the data controller for the personal data described in this Policy.</p> 32 <div class="addr"> 33 <strong>Controller:</strong><br> 34 S&C Development GmbH<br> 35 Machnower Str. 17, 14165 Berlin, Germany<br> 36 Email: [email protected] 37 </div> 38 <p>We are based in Germany, and most of our users are in the United States. Depending on where you live, either the EU General Data Protection Regulation (GDPR) or US state privacy laws (such as the California Consumer Privacy Act) give you specific rights, which are described in the "Your rights" sections below.</p> 39 40 <hr> 41 42 <h2>1. The data we collect</h2> 43 <h3>1.1 Data you give us</h3> 44 <ul> 45 <li><strong>Account data</strong> â your name or display name, email address, and the authentication identifier from the method you sign in with (Sign in with Apple, Google, or email). We do not receive or store your Apple/Google password.</li> 46 <li><strong>Onboarding and assessment data</strong> â the answers you give in the onboarding quiz, including your age or age range, gender, and questions about your pornography use, goals and motivations. Because some of these answers concern your sexual behaviour, we treat them as <strong>sensitive data</strong> (see Section 3).</li> 47 <li><strong>Subscription and purchase data</strong> â the plan you buy, purchase and renewal history, and (for website purchases) billing details. Card and bank details are collected and processed directly by our payment processor (Stripe); we do not store your full card number.</li> 48 <li><strong>Community content</strong> â the posts, comments, reactions and display name you create in the in-app community. This content is visible to other users (see Section 4).</li> 49 <li><strong>Accountability Partner data</strong> â the partners you invite or accept, the names or nicknames you or they provide, and your notification preferences.</li> 50 <li><strong>Support and communications</strong> â the content of messages you send us and your contact details.</li> 51 </ul> 52 <h3>1.2 Data we collect automatically</h3> 53 <ul> 54 <li><strong>Usage and device data</strong> â IP address, device type and identifiers, operating system, app version, in-app activity, dates and times of use, and diagnostic data.</li> 55 <li><strong>Session replay and analytics</strong> â anonymised or pseudonymised recordings of screens and interactions used to understand and improve the Service, through third-party analytics and session-replay tools.</li> 56 <li><strong>Crash and performance data</strong> â error and crash reports, through a third-party crash-reporting tool.</li> 57 <li><strong>Marketing and attribution data</strong> â data about how you found and installed the app and how our
57campaigns perform, through advertising and attribution partners. See Section 6 on advertising.</li> 58 </ul> 59 <h3>1.3 Content Filter data</h3> 60 <p>The <strong>Content Filter</strong> runs entirely on your device. On iOS it uses Apple's Screen Time (Family Controls) framework; on Android it uses an on-device VPN/DNS filter; and in the browser our extension filters locally. We do <strong>not</strong> collect, transmit or store the websites you visit, the domains the filter blocks, or your browsing history. Your filter settings stay on your device.</p> 61 <h3>1.4 Accountability Partner data</h3> 62 <p>When you use the <strong>Accountability Partner</strong> feature, we process:</p> 63 <ul> 64 <li>the partner connections you create â the name or nickname you or your partner provide, and the account/device identifier needed to link you;</li> 65 <li>the <strong>streak and progress information</strong> you share with a partner (for example your current streak length); and</li> 66 <li>the <strong>messages</strong> you exchange with your partner in the app.</li> 67 </ul> 68 <p>We use this only to operate the accountability features you have chosen to enable.</p> 69 70 <hr> 71 72 <h2>2. Why we use your data and our legal bases (GDPR)</h2> 73 <p>Where the GDPR applies, we rely on the following legal bases:</p> 74 <div class="table-scroll"> 75 <table> 76 <thead><tr><th>Purpose</th><th>Legal basis</th></tr></thead> 77 <tbody> 78 <tr><td>Create and manage your account; provide the app, community, filter and accountability features; process your subscription</td><td>Performance of a contract (Art. 6(1)(b))</td></tr> 79 <tr><td>Process onboarding answers about your sexual behaviour, run the Content Filter, and share data with Accountability Partners</td><td>Your <strong>explicit consent</strong> (Art. 6(1)(a) and Art. 9(2)(a)) â see Section 3</td></tr> 80 <tr><td>Keep the Service secure, prevent fraud and abuse, debug and improve the product, and understand aggregate usage</td><td>Our legitimate interests in operating a safe, working product (Art. 6(1)(f))</td></tr> 81 <tr><td>Analytics, session replay, advertising and attribution that are not strictly necessary</td><td>Your consent (Art. 6(1)(a)), via in-app permission prompts and the website cookie/tracking banner</td></tr> 82 <tr><td>Send you service and marketing messages</td><td>Contract and consent, subject to your marketing choices</td></tr> 83 <tr><td>Analyse community posts, comments and other user-generated content to understand user needs, evaluate and improve the Service, and develop and optimise our marketing and communications</td><td>Our legitimate interests in understanding and improving the Service (Art. 6(1)(f)); where such content is special category data, your <strong>explicit consent</strong> (Art. 9(2)(a)) or, for content you have manifestly made public, Art. 9(2)(e)</td></tr> 84 <tr><td>Keep invoices and tax records; respond to lawful requests</td><td>Compliance with a legal obligation (Art. 6(1)(c))</td></tr> 85 </tbody> 86 </table> 87 </div> 88 <p>You can withdraw any consent at any time (see Section 10). Withdrawing consent does not affect processing that already took place.</p> 89 90 <hr> 91 92 <h2>3. Sensitive data (special category data)</h2> 93 <p>Some data we process reveals information about your <strong>sex life or sexual behaviour</strong> â in particular your onboarding answers and your relapse and streak history. Under the GDPR this is "special category" data (Art. 9); under US state laws it is "sensitive personal information".</p> 94 <p>We process this data <strong>only</strong> on the basis of your <strong>explicit consent</strong>, which you give when you complete onboarding and when you choose to share progress with an Accountability Partner. You can withdraw this consent at any time by removing a partner or deleting your account. We apply extra safeguards to this data, including strict access controls and encrypted transmission.</p> 95 <p>We never sell this sensitive data, and we do not use it for advertising.</p> 96 97 <hr> 98 99 <h2>4. The community and other users</h2> 100 <p>The Gracen community lets you post and comment. <strong>Anything you post can be seen by other users of the Service</strong>, and you should assume it may be copied or shared beyond the app. Please do not post information you want to keep private. You can post under a display name rather than your real name. We moderate the community and can remove content and suspend accounts as described
100in our Terms & Conditions.</p> 101 <p>We also review community content on a de-identified basis to understand how people describe what they are going through, and to describe the Service more clearly â including in our marketing. We look for patterns across many people rather than at individuals. If we would like to publish something you wrote, for example as a testimonial, <strong>we ask you first</strong> and you are free to say no.</p> 102 103 <hr> 104 105 <h2>5. Accountability Partners</h2> 106 <p>The Accountability Partner feature lets you connect with people who support your progress:</p> 107 <ul> 108 <li>You can share your <strong>streak and progress</strong> with a partner and <strong>exchange messages</strong> with them in the app.</li> 109 <li>Partner connections are created <strong>only</strong> through your invitation, your acceptance, or opt-in matching that you consent to. You control who you connect with.</li> 110 <li>You can <strong>remove</strong> a partner at any time in the app; when you do, or when you delete your account, the connection ends and related data is deleted.</li> 111 </ul> 112 <p>By connecting with a partner you consent to sharing your streak/progress and messages with that person. If you are matched with or invited by another user, we process your name/nickname and the identifier needed to link your accounts, based on our legitimate interest in operating the feature you have joined.</p> 113 114 <hr> 115 116 <h2>6. Advertising, analytics and cookies</h2> 117 <p>We use analytics and session-replay tools to understand how the Service is used, and advertising and attribution tools to measure and improve our marketing. Some of this activity may qualify as "targeted advertising" or "sharing" of personal data under US state laws.</p> 118 <ul> 119 <li><strong>In the app:</strong> where required, we ask for your permission before tracking (including Apple's App Tracking Transparency prompt on iOS). You can change tracking permissions in your device settings.</li> 120 <li><strong>On our website/funnel:</strong> we use cookies and similar technologies for essential functions, analytics and advertising. Non-essential cookies and trackers are only set with your consent through our cookie banner, which also lets you withdraw consent.</li> 121 <li><strong>Opt out:</strong> you can opt out of advertising-related sharing at any time by declining tracking, adjusting your device settings, using the cookie banner on our website, or contacting us at [email protected].</li> 122 </ul> 123 <p>We never use your sensitive data (Section 3) for advertising.</p> 124 125 <hr> 126 127 <h2>7. Who we share data with</h2> 128 <p>We do not sell your personal data. We share it only with:</p> 129 <ul> 130 <li><strong>Service providers (processors)</strong> who process data on our behalf under contract, in the following categories: cloud hosting and database providers (located in the United States); payment processors; subscription-management and paywall providers; product-analytics and session-replay providers; crash- and error-reporting providers; advertising and attribution partners; email and messaging providers; and the app-store, sign-in and push-notification providers needed to operate the app.</li> 131 <li><strong>Your Accountability Partners</strong>, as described in Section 5, with your consent.</li> 132 <li><strong>Other users</strong>, for anything you post in the community (Section 4).</li> 133 <li><strong>Acquirers</strong>, if we are involved in a merger, acquisition or sale of assets, in which case we will require the recipient to honour this Policy.</li> 134 <li><strong>Authorities or advisors</strong>, where we are legally required to disclose data, or to establish, exercise or defend legal claims.</li> 135 </ul> 136 <p>A current list of our subprocessors is available on request at [email protected].</p> 137 138 <hr> 139 140 <h2>8. International data transfers</h2> 141 <p>Our backend and several of our providers are located in the <strong>United States</strong>, so your data is processed there. If you are in the European Economic Area, the UK or Switzerland, this is an international transfer. We rely on appropriate safeguards for these transfers, principally the European Commission's <strong>Standard Contractual Clauses</strong> (and the UK Addendum / Swiss equivalents) with the providers concerned, together with additional technical and organisational measures. You can request more information or a copy of the relevant safeguards at [email protected].</p> 142 143 <hr> 144 145 <h2>9. How long we keep data</h2> 146 <ul> 147 <li><strong>Accountability Partner data (connections and messages):</strong> kept for the duration of the connection; deleted when you remove the partner or delete your account.</li> 148 <li><strong>Account and profile data:</strong> kept while your account is active and deleted after account deleti
148on, except where we must keep it longer.</li> 149 <li><strong>Invoices and tax records:</strong> kept for the statutory retention periods under German commercial and tax law (generally up to 10 years).</li> 150 <li><strong>Analytics, crash and marketing data:</strong> kept only as long as needed for the purpose, then deleted or aggregated/anonymised.</li> 151 </ul> 152 <p>We may retain limited data longer where necessary to comply with legal obligations, resolve disputes or enforce our agreements.</p> 153 154 <hr> 155 156 <h2>10. Your rights (EEA / UK / Switzerland â GDPR)</h2> 157 <p>You have the right to: <strong>access</strong> your data; <strong>rectify</strong> inaccurate data; <strong>erase</strong> your data; <strong>restrict</strong> or <strong>object</strong> to processing; <strong>data portability</strong>; and to <strong>withdraw consent</strong> at any time. You also have the right to <strong>lodge a complaint with a supervisory authority</strong>. Our lead authority is the <em>Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)</em>, but you may also contact the authority where you live.</p> 158 <p>To exercise your rights, use the in-app account settings or email <strong>[email protected]</strong>. We will respond within the timeframes required by law. For erasure specifically, our <a href="/data-deletion">Account & Data Deletion</a> page sets out the exact steps.</p> 159 160 <hr> 161 162 <h2>11. Your rights (United States)</h2> 163 <p>Depending on your state (for example California, Virginia, Colorado, Connecticut, Utah, Texas and others), you may have the right to:</p> 164 <ul> 165 <li><strong>know/access</strong> the personal information we have collected about you;</li> 166 <li><strong>delete</strong> your personal information;</li> 167 <li><strong>correct</strong> inaccurate personal information;</li> 168 <li><strong>opt out</strong> of the "sale" or "sharing" of personal information and of "targeted advertising";</li> 169 <li><strong>limit the use</strong> of sensitive personal information; and</li> 170 <li>be free from <strong>discrimination</strong> for exercising these rights.</li> 171 </ul> 172 <p>We do not sell your personal information for money. As explained in Section 6, some advertising activity may be considered "sharing" or "targeted advertising" â you can opt out at any time by declining tracking, using our website cookie banner, or emailing [email protected]. To make any other request, email <strong>[email protected]</strong>. You may use an authorised agent, and we will verify your request before acting on it.</p> 173 <p><em>California "Shine the Light":</em> you may request information about disclosures of personal information to third parties for their direct marketing purposes; we do not make such disclosures.</p> 174 175 <hr> 176 177 <h2>12. Children and minors</h2> 178 <p>Gracen is intended for users aged <strong>13 and older</strong>. It is <strong>not directed to children under 13</strong>, and we do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has provided us with personal data, contact us at [email protected] and we will delete it.</p> 179 <p><strong>Users aged 13â17.</strong> If you are under the age of majority where you live (usually 18), you may use Gracen only with the involvement and permission of a parent or guardian, who should review these terms and this Policy with you. Where the law requires a parent's consent for a minor to use a service like ours â for example users under 16 in the EEA, or as otherwise required by your country or US state â we rely on that parental consent. A parent or guardian may contact us at [email protected] to review, correct or delete their child's data.</p> 180 <p><strong>Advertising and minors.</strong> We do not use the data of users we know to be minors for targeted advertising, and we do not "sell" or "share" (as those terms are defined under US state privacy laws) the personal information of users we know to be under 16. We never use minors' sensitive data for advertising.</p> 181 182 <hr> 183 184 <h2>13. Security</h2> 185 <p>We use commercially reasonable technical and organisational measures to protect your data, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.</p> 186 187 <hr> 188 189 <h2>14. Third-party links</h2> 190 <p>The Service may link to third-party sites and services that we do not control. This Policy does not apply to them, and we encourage you to read their privacy policies.</p> 191 192 <hr> 193 194 <h2>15. Changes to this Policy</h2> 195 <p>We may update this Policy from time to time. The current version is always posted here with its "Last updated" date, and changes take effect when posted. If we make material changes, we will provide additional notice where required by law (for example, in the app or by email).</p> 196 197 <hr> 198 199 <h2>16. Contact</h2>
200 <div class="addr"> 201 <strong>S&C Development GmbH</strong><br> 202 Machnower Str. 17, 14165 Berlin, Germany<br> 203 Email: <strong>[email protected]</strong> 204 </div> 205 <p>For our company details, see our <a href="/impressum">Impressum</a>.</p> 206</article> 207</main> 208 209<footer class="site-footer"> 210 <div class="wrap"> 211 S&C Development GmbH · Machnower Str. 17, 14165 Berlin, Germany · <a href="mailto:[email protected]">[email protected]</a> 212 </div> 213</footer> 214</body> 215</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.