Privacy Policy
Last updated: November 4, 2026
This policy explains how Proof It handles your personal data when you use our mobile app on iPhone or Android and related services.
1. Who is responsible for your data
The controller of your data is:
Sulaiman Baruwa
Proof It
Marientaler Straße 24
12437 Berlin, Germany
Email: hello@prooftous.app
For any privacy question or request, email hello@prooftous.app.
2. Summary
- You choose who sees each proof: only you, your circle, or the public.
- We do not sell your data, show ads, or use tracking or advertising tools.
- Our main database and photo storage are hosted in Frankfurt, Germany. Some service providers are based in the United States.
- You can download your data and delete your account from inside the app.
- Proof It is for people aged 16 and over.
3. The data we collect
Account data. Your email address, username, password, display name and profile photo, and timezone. We store passwords only in a protected, hashed form.
Sign in with Apple. If you use it, Apple gives us an identifier and, if you allow it, your name and email address. You may choose Apple's private relay email address.
Proofs and goals. Your declarations, commitments and goals, the sentence you add to a proof, the rear camera photo, the front camera selfie, the time of the proof, goal cover photos, and your streaks and history.
Location, only if you allow it. When you allow location access, the app uses your approximate position to create a place name to stamp on your proof. We store the place name, not your coordinates. It can be seen by people who can see that proof. You can use Proof It without allowing location.
Photo library, only if you allow it. We access photos you choose, such as a goal cover or profile photo, and can save proof photos to your library when you ask.
Social activity. Likes, cheers, reactions, comments, direct messages, followers, circles, accountability partners, and the people you block. Direct messages are stored on our servers and are not end-to-end encrypted.
Onboarding answers. Your answers to the questions when you start, such as your focus area, what gets in your way, and your reminder preference. We use these to personalise your experience. A focus area such as faith could reveal something personal about you, so please choose only what you are comfortable sharing.
Subscriptions. Your plan, subscription status, expiry date and purchase records. Apple or Google processes your payment. We never receive your full card details.
Notifications. A push token for your device and your notification settings.
Safety and moderation. Reports you submit or that others submit about you, appeals, moderation decisions, and account status.
Technical data. When your device connects to our services, our providers process technical data such as your IP address, device and system details, and request logs. This is needed to deliver the service, deliver app updates and keep it secure.
4. Why we use your data, and our legal bases
If you are in the EU, the EEA or the UK, we rely on these legal bases under the GDPR:
| Purpose | Legal basis |
|---|---|
| Creating and running your account, and storing and showing your proofs, goals, streaks and messages | Contract, Art. 6(1)(b) |
| Managing subscriptions and restoring purchases | Contract, Art. 6(1)(b) |
| Sending sign-in and password reset codes and account messages | Contract, Art. 6(1)(b) |
| Location stamps and optional push notifications | Consent, Art. 6(1)(a), through your device permission |
| Personalising the app from your onboarding answers | Contract, Art. 6(1)(b), and consent for any answer that reveals sensitive information, Art. 9(2)(a) |
| Keeping the service safe, handling reports, preventing abuse and fixing faults | Legitimate interests, Art. 6(1)(f) |
| Meeting legal duties, such as tax records or lawful requests | Legal obligation, Art. 6(1)(c) |
You can withdraw consent at any time in your device settings, in the app, or by emailing us. This does not affect processing that took place before you withdrew it.
5. Who can see your content
This depends on the audience you choose. New proofs default to your circle, and you can change that for each proof. Public content can be seen by other Proof It users. People who can see your content could also screenshot or share it outside the app, so please post with care.
Our team may look at content when it is needed to handle a report, investigate abuse or meet a legal duty.
Proofs that are reported can be hidden automatically while they are reviewed. You can appeal a moderation decision by using the app or emailing us.
6. Service providers
We share data only as needed with these providers, who act on our instructions or under their own terms where stated:
| Provider | What it does | Data involved | Location |
|---|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | Account data, content, photos, messages | Frankfurt, Germany (Supabase is a US company) |
| Resend | Sending emails | Email address and email content, including codes and data exports | United States |
| RevenueCat | Managing subscription status | An account identifier, purchase and subscription records | United States |
| Expo (650 Industries) | Delivering push notifications and app updates | Push token, notification content, device and technical data | United States |
| Apple | Sign in with Apple, App Store purchases, TestFlight, iPhone push notifications | Data needed for each service | United States and other countries |
| Google Play purchases and Android push notifications through Firebase Cloud Messaging | Data needed for each service | United States and other countries |
Apple and Google also act as independent controllers for their own stores and accounts. We require our providers to protect your data to the same standard as this policy.
We may also share data if the law requires it, to protect people's safety or legal rights, or if the business is sold or merged, in which case we will tell you first.
7. International transfers
Some providers process data in the United States or other countries outside the EEA. Where this happens, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, including the EU-US Data Privacy Framework where a provider is certified. You can ask us for details at hello@prooftous.app.
8. How long we keep your data
We keep your data for as long as you have an account.
When you delete your account, we delete your profile, content and photos from our active systems straight away, and remove your subscriber record from RevenueCat. Copies in backups are removed as those backups are overwritten in the normal cycle. We may keep limited records where the law requires it or where needed to deal with abuse or a legal claim, only for as long as necessary.
Apple and Google keep their own purchase records under their own policies.
9. Your rights
If you are in the EU, the EEA or the UK, you have the right to:
- access your data and receive a copy
- correct inaccurate data
- have your data deleted
- restrict processing
- receive your data in a portable format
- object to processing based on legitimate interests
- withdraw consent at any time
- ask for a person to review a decision made solely by automated means, if it significantly affects you
In the app. You can edit your profile, download your data and delete your account in Settings. For anything else, email hello@prooftous.app. We reply within one month.
Complaints. You can complain to a data protection authority where you live or work. Our authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
Subscriptions are not cancelled by deleting your account. Please cancel in your Apple or Google account settings.
10. Age limit
Proof It is for people aged 16 and over. We ask you to confirm your age when you sign up. If we learn an account belongs to someone under 16, we will delete it. If you think this has happened, email hello@prooftous.app.
11. Security
We use technical and organisational measures to protect your data, including encrypted connections, access controls and rules limiting who can read each kind of data. No system is completely secure, so we cannot guarantee absolute security. If a breach is likely to put you at risk, we will notify you and the authorities as the law requires.
12. Tracking and advertising
We do not use advertising or tracking tools, or track you across other companies' apps and websites. We do not sell your personal data or share it for targeted advertising.
13. Additional rights for US residents
Depending on your state, you may have the right to know, access, correct, delete and get a copy of your personal data, to opt out of sale, targeted advertising or certain profiling, and not to be discriminated against for using these rights. We do not sell personal data or share it for targeted advertising.
In the past 12 months, we have collected: identifiers, such as email and username; commercial information, such as subscription records; approximate location if you allow it; images and photos; account logins; and message content. We use them for the purposes in section 4.
To use your rights, email hello@prooftous.app. We may need to verify your identity, and you can use an authorised agent. If we refuse your request, you can appeal by emailing us, and then complain to your state attorney general.
14. Changes to this policy
We will update the date above when this policy changes. If a change is significant, we will tell you in the app or by email before it takes effect.
15. Contact
Sulaiman Baruwa, Proof It, Marientaler Straße 24, 12437 Berlin, Germany
hello@prooftous.app