Privacy Policy

Sabotages is free and run by Aly Dewji, an independent developer in the UK, who is responsible for your data (the “controller”). For any privacy question or request, get in touch through our Contact page.

When you’re signed out, nothing you track is stored, and it’s gone when you leave. Display settings, like your theme and colour palette, stay on your device either way.

When you’re signed in, a copy of your data is also kept in your browser so the app works offline. Signing out removes that copy, and your name, from the device.

The Charities page opens on helplines for the country your connection comes from, so the first numbers you see are ones you can call. That’s only used to pick the page. We don’t store it.

We only use what’s needed to run the app, plus Google Analytics if you agree to it. There are no advertising cookies.

• Display settings (mt_prefs): your theme, palette and similar choices, until you clear them.
• Your data (mt_store), while you’re signed in: the offline copy described above, removed when you sign out.
• Sign-in cookies (sb-…-auth-token): keep you signed in on this device.
• Cloudflare Turnstile: on the sign-in and contact forms, checks in the background that you’re a person, not a bot. It isn’t used for tracking or ads.
• Google Analytics (_ga cookies), only if you say yes on the cookie banner: counts visits to our public pages while you’re signed out, so we can see which pages help people. It never runs while you’re signed in or on Reports, Settings or Account, never sees anything you track, and isn’t used for ads. Your answer is kept on your device (mt_analytics); change it any time with “Cookie settings” at the bottom of the page.

Your data is only saved when you have an account. We store your email address (so we can send you sign-in codes) and your trackers, daily scores, notes, medication doses and the times you ticked them. This is kept in a Supabase database hosted in London (eu-west-2).

Your scores, notes and medication can reveal information about your health. UK data protection law treats this as special category data. We only store it with your explicit consent, which you give with its own tick box when you sign in, separate from agreeing to our terms. You can withdraw that consent at any time by deleting your account.

When you agree, we record which version of the Terms and this policy you agreed to, and when, with your account. If they change in a way that needs your agreement again, the app asks you.

When you use the Contact page, we store your name, email address and message. Feedback is stored with an email address only if you give one. Each message is also emailed to us so we see it. We use these only to reply and to improve Sabotages, on the basis of our legitimate interest in doing so.

Messages are kept apart from accounts, so deleting your account doesn’t delete them. We keep them only as long as we need them. To have yours deleted sooner, ask us through the Contact page.

We use your data only to provide the service you asked for: saving what you log, syncing it between your devices, showing your reports and sending your sign-in codes. Our lawful basis for this is that it’s needed to provide the service. For health information, our lawful basis is your explicit consent.

We don’t sell your data and we don’t run advertising trackers. Google Analytics, if you agree to it, is used only to count visits, on the basis of your consent.

We use a small number of services to run Sabotages:

• Supabase stores your account and everything you log.
• Vercel hosts the website. Its servers that handle your requests run in London, behind a worldwide network that delivers the pages.
• Resend emails your sign-in codes, and passes messages from the Contact page on to us.
• Cloudflare, based in the US, checks the sign-in and contact forms to block bots (Turnstile). It sees your connection and browser details, not anything you track.
• Vercel Web Analytics counts visits. It doesn’t use cookies and doesn’t receive anything you track.
• Google Analytics, from Google, counts visits to public pages, only if you agree (see Cookies above). Google signals and ad personalisation are switched off.

Some of these may process data outside the UK, for example in the US. Where they do, it’s protected by safeguards recognised under UK law, such as the UK Extension to the EU-US Data Privacy Framework or the UK’s international data transfer agreement.

We keep your data until you delete your account. When you do, your account and everything in it is deleted. Copies can remain in the database’s daily backups for up to 7 days, after which they’re gone too.

You can:

• see and export your data at any time from Settings
• correct your data by editing it in the app, or ask us through our Contact page
• delete your account and everything in it from the Account page
• withdraw your consent, by deleting your account
• ask us to limit how we use your data, or object to how we use it
• get your data in a format other apps can read (the JSON export in Settings)

For anything the app doesn’t do for you, ask through our Contact page and we’ll reply within a month.

If you’re unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Each account can only read its own data. Everything travels over HTTPS. There are no passwords to leak: you sign in with a six digit code sent to your email.

To stop scripts making accounts in bulk, when your first sign-in sets up an account we keep a scrambled code made from your network address (never the address itself), with the time. It’s only used to count new accounts from the same network, and it’s deleted once it’s a day old.

Sabotages is for adults aged 18 and over. Please don’t create an account if you’re under 18.

Sabotages is free. Any optional donation is handled by a third party (Ko-fi). We never see your card details.

If we change this policy, we’ll update it here and change the date at the top.