drft Privacy Policy
Last updated: 30 July 2026
drft records decisions about a behaviour you are trying to change. That is unusually sensitive information, and this policy is written to be read rather than to be defensible. If something here is vague, treat the vagueness as the answer.
What drft stores
Your account. Your email address, held by our authentication provider so you can sign in.
What you tell us during setup. Your first name, what you are trying to change, what you are protecting, roughly what you were spending, and when you last started over. You choose all of it and you can change or delete any of it later.
Your decision log. Every urge, action, outcome and slip you record, with the time it happened. If you answer the optional questions after an urge passes, that includes the emotion and situation you named. This log is what every pattern in the app is derived from.
Your journal. Anything you write in the Log tab. Journal entries are kept separately from the decision log and are never used to derive a pattern.
What drft does not do
- We do not sell your data. There is no arrangement under which this could happen. - We do not share it with advertisers, data brokers, insurers, employers, or gambling operators. - We do not use advertising or analytics SDKs that profile you across other apps. - We do not track your location. - We do not read your contacts. When you tap to message someone you trust, that opens your own phone's messaging app. drft never sees who you contacted.
Where it goes
Your account and data are stored with Supabase, our database and authentication provider, on servers in the United States. Access is restricted per user at the database level, so one account cannot read another's data.
AI features send some of your information to OpenAI. Specifically:
- The setup interview sends what you type in your answers. - drft coach sends the messages you write, plus a short summary drawn from your record: your current streak, your total clean days, the trigger you are dealing with and how many times it has come up, what has worked for you, how long your urges usually last, and what you said you are protecting.
Your name and email are never sent to OpenAI. OpenAI processes this as our API customer and, under their API terms, does not use it to train their models. If you would rather none of your information reach a third party, do not use the coach, and skip the conversational setup.
Your control
- Memory can be switched off. In You, turning off "Record my activity" stops drft writing any new events. Patterns stop updating. Nothing is deleted. - Export everything. You tab, "Export my data". - Delete your recovery data. You tab, "Delete recovery data". This permanently removes your decision log. - Delete your account. You tab, "Delete account". This removes your login and everything attached to it, and drft keeps no copy.
Retention
We keep your data until you delete it. We do not keep a shadow copy after deletion.
Children
drft is not intended for anyone under 18 and we do not knowingly collect their information.
drft is not a medical service
drft is not a therapist, doctor, or emergency service, and nothing in it is a diagnosis or treatment. If you are in crisis, call or text 988 in the US, or 911 if anyone is in immediate danger.
Changes
If this policy changes in a way that affects what happens to your data, we will tell you in the app before it takes effect.
Contact
Questions, data requests, or account deletion: drftsupport@gmail.com