Nopetini
Privacy policy
Last updated: 9 November 2026 · applies to the Nopetini Android app and nopetini.pages.dev
The short version. Rehearsal scripts, SOS content and your notes stay on your phone. Your drink log, goals and saved lines are stored on our server in the EU so you don't lose them. Your words go to an AI provider only to play a rehearsal and aren't stored by us. Analytics and ads only run with your consent, and they never receive drinking data, transcripts or refusal lines. You can export or delete everything at any time.
1. Who is responsible
Controller under the GDPR: Andreas Zender, Edigheimer Str. 111, 67069 Ludwigshafen am Rhein, Germany · nopetini2026@gmail.com. We have no data protection officer (not required at our size); write to the address above with any privacy question.
2. What the app processes, and why
| Data | Where it lives | Purpose · legal basis |
|---|---|---|
| Rehearsal scripts (what you and the coach said), SOS pep-talk content, coach-memory notes, photos you add to a wish | Only on your phone | The features themselves. Never sent to our server, except the rehearsal turns described in section 3. |
| Account: an anonymous user ID; your email address if you register (or your Google account email if you sign in with Google) | Supabase (EU, Frankfurt) | Running your account and keeping your data across phones · contract (Art. 6(1)(b) GDPR) |
| Drink log, goals, challenges, planned nights, check-in results, saved Nopetini cards, urge-tool uses, wishes (name and price), settings | On your phone and synced to Supabase (EU, Frankfurt) | Your tracking and progress, backup across devices · contract (Art. 6(1)(b)); because drinking data can be health-related, your explicit consent (Art. 9(2)(a)), which you can withdraw by deleting your account |
| Usage counters (rehearsals per week), Pro status, rewarded-ad credits | Our Cloudflare Worker database (D1), keyed by your user ID | Fair limits of the free tier and unlocking Pro · contract (Art. 6(1)(b)) |
| Purchase status (no card details) | RevenueCat and Google Play | Selling and restoring Nopetini Pro · contract (Art. 6(1)(b)); tax records legal obligation (Art. 6(1)(c)) |
| Technical logs of coach requests: request ID, a hashed user ID, model, latency, token counts, guardrail result – no text | Cloudflare, 7 days | Security, abuse prevention and keeping the free tier running · legitimate interest (Art. 6(1)(f)) |
| Crash reports (device model, OS, stack trace; no text you typed) | Google Firebase Crashlytics | Fixing crashes · legitimate interest (Art. 6(1)(f)); switch it off in Menu → Your data & privacy |
| Usage events (e.g. "rehearsal completed", screen and button events with fixed values), app instance ID, country-level location | Google Analytics for Firebase, 2-month retention | Understanding which features help and measuring our ads · consent (Art. 6(1)(a)); in the EEA, UK and Switzerland only after you agree in the consent form; elsewhere switch it off in Menu → Your data & privacy |
| Advertising ID and ad interaction | Google AdMob, only when you choose to watch a rewarded ad (free users) | Showing the ad and granting your credit · consent (Art. 6(1)(a)) via the consent form |
| Your email when you contact us | Our mailbox | Answering you · legitimate interest (Art. 6(1)(f)) |
Never sent to analytics or ad SDKs: drink logs, amounts, goals, situations, refusal lines, transcripts, check-in text, safety answers or any free text you type.
3. The AI coach
When you rehearse, ask for a pep talk or get your weekly insight, the text of that request (the situation, the conversation so far and, for Pro, a short summary of what worked before) is sent through our Cloudflare Worker and Cloudflare AI Gateway to one AI provider in this order: Groq, Mistral AI, Cloudflare Workers AI. The provider generates the reply and, under its API terms, does not use the data for training. We don't store the text: the Worker keeps no prompts or answers, and request logging in the AI Gateway is switched off. Please don't type names, health details or other sensitive information about yourself or others into a rehearsal.
4. Processors and recipients
- Supabase Inc. – database and login, servers in Frankfurt (EU).
- Cloudflare Inc. – coach Worker, AI Gateway, Workers AI, the D1 database and hosting of this website.
- Groq Inc. (USA) and Mistral AI (France) – AI replies, see section 3.
- Google (Ireland / USA) – Firebase Analytics, Crashlytics, AdMob, the consent form (UMP), Google Sign-In and Google Play billing.
- RevenueCat Inc. (USA) – subscription management; it also passes purchase events to Google Analytics when you have consented to analytics.
- Brevo (Sendinblue SAS) (France) – sends login and password emails (your email address only).
Where data goes to the USA, the transfer relies on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses. We have data processing agreements with our processors.
5. How long we keep data
- Account and synced data: until you delete your account. Deleted entries are removed from the server within a week.
- Coach request logs: 7 days. Analytics: 2 months. Crash reports: up to 90 days.
- Purchase records: as long as tax law requires (Google Play and RevenueCat keep them as well).
6. Your choices and rights
- Change your analytics and ads choice at any time in Menu → Your data & privacy (including the consent form). Withdrawing consent doesn't affect processing before it.
- Export all your data as CSV or JSON in Menu → Your data & privacy.
- Delete your account and data in the app (Menu → Account → Delete account and data) or as described on the deletion page.
- You have the right to access, rectification, erasure, restriction, data portability and to object (Art. 15–21 GDPR). Write to nopetini2026@gmail.com.
- You can complain to a supervisory authority, for example the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz.
7. Age
Nopetini is for adults aged 18 and over. We don't knowingly process data of anyone younger; the app asks for your age during setup.
8. This website
nopetini.pages.dev uses no cookies, no analytics and no third-party scripts; fonts are served from our own domain. Cloudflare, which hosts it, processes your IP address and request data in server logs to deliver the page and protect it from attacks (legitimate interest, Art. 6(1)(f)).
9. Changes
We'll update this page when the app changes how it handles data and show the date at the top. For significant changes we'll tell you in the app.