Privacy Policy

Last updated: 26 May 2026

GambleX ("we", "our", "the app") is a gambling recovery companion built by Alexander Connola. Your privacy matters — this policy explains what data we collect, why, and how we protect it.

1. Data controller

The data controller for personal data processed in connection with GambleX is Alexander Connola, operating GambleX. For privacy enquiries and requests, contact alexconnola@gmail.com.

2. Data We Collect

Account & Profile

• User ID — community — if you sign in to community features via Sign in with Apple, Firebase receives an anonymous, app-scoped Apple user identifier. We do not receive your real name or personal email unless you choose to share it.
• User ID — Coach X — if you use Coach X without community sign-in, the app signs you into Firebase anonymously so we can authenticate requests to our server and enforce App Check. No email or Apple ID is associated with this anonymous account unless you later link Sign in with Apple.
• Display name — an optional nickname you set for the community features.
• Profile photo — stored on-device only; never uploaded to our servers.

App Content

• Community posts & comments — text content you publish to the community feed, stored in Google Cloud Firestore.
• Coach X chat messages — conversation history with the AI coach, processed via our server-side proxy to OpenAI. Messages are sent over an encrypted connection and are not used to train AI models.
• Voice audio — when you use voice chat, microphone audio is transcribed on-device using Apple Speech Recognition and the text is sent to Coach X. Raw audio is not stored on our servers.

Recovery Data

• Journal entries, streak data, urge logs, protocol progress — all stored locally on your device using UserDefaults and are never uploaded to our servers. Community leaderboard data (streak days, gem rank) is synced to Firestore only if you opt in to the leaderboard.

Diagnostics

• Third-party analytics or crash SDKs — The app does not include Firebase Crashlytics, Firebase Performance, or Firebase Analytics. Standard Apple-provided diagnostics (if you participate through your device settings) are governed by Apple's policies.

3. How We Use Your Data

• To provide and improve the app's core functionality (recovery tracking, AI coaching, community).
• To secure cloud features (Firebase Authentication and App Check).
• To manage your subscription via Apple's StoreKit.

We do not use your data for advertising, tracking, or profiling.

Lawful bases (UK GDPR)

Where UK GDPR applies, we rely on the following lawful bases, depending on the processing:

• Performance of a contract — providing the app, subscriptions, and features you request (e.g. community and cloud sync you choose to use).
• Legitimate interests — securing the service and improving the app in ways you would reasonably expect, balanced against your rights.
• Consent — where we ask for it (for example, where Sign in with Apple or platform permissions require explicit consent).
• Legal obligation — where we must process data to comply with applicable law.

4. Data Sharing

We do not sell your data. Data is shared only with:

• Google Firebase — authentication, Firestore database, and App Check (governed by Firebase's privacy policy).
• OpenAI — Coach X chat messages are sent to OpenAI's API for response generation (governed by OpenAI's API data usage policy). OpenAI does not use API inputs to train models.
• Apple — subscription management, Sign in with Apple, and App Store analytics.

5. International Transfers

Some of our processors (including Google Firebase, OpenAI, and Apple) may process or store data outside the UK. Where data is transferred internationally, we use appropriate safeguards permitted under UK data protection law, such as standard contractual clauses and the UK International Data Transfer Agreement (or equivalent mechanisms), supplemented where required by a transfer impact assessment.

6. Data Retention

• On-device data (journal, streak, profile photo) persists until you delete the app.
• Community content in Firestore can be deleted by you at any time (delete your posts/comments).
• Coach X chat history is stored on your device (in iOS UserDefaults) so your conversation persists between sessions; you can clear it at any time using the reset button in the Coach screen, or by uninstalling the app. Our servers process each request transiently and do not retain the conversation after a response is returned.

7. Tracking

GambleX does not track you across other apps or websites. We do not use advertising identifiers or any cross-app tracking frameworks. NSPrivacyTracking is set to false.

8. Security

All network communication uses HTTPS/TLS. Firebase Authentication secures access to cloud resources. Sensitive keys (e.g. AI service credentials) are stored in Google Secret Manager and never included in the app binary.

9. Children's Privacy

GambleX is not intended for children under 17. We do not knowingly collect data from minors.

10. Your Rights

Where UK GDPR (or equivalent law) applies, you may have the following rights in relation to your personal data: access, rectification, erasure, restriction of processing, objection to certain processing, and data portability (where applicable). You may also lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

You can delete your cloud account at any time directly inside the app: open GambleX, tap the gear icon on the Progress tab, scroll to Account, and choose Delete cloud account. This permanently removes your community profile, posts, comments, votes, leaderboard entry, and Coach-related server-side data, and deletes your Firebase Auth user. On-device data (journal entries, streak, profile photo, Coach chat history stored locally) can be removed by deleting the app. For other requests (e.g. access or correction), contact us at the email below; we will respond within the time frames required by applicable law.

11. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) may apply. We do not sell personal information or share it for cross-context behavioural advertising. You may have rights to know about personal information collected, to request deletion, to correct inaccuracies, and to limit certain uses of sensitive personal information. To exercise these rights, contact alexconnola@gmail.com. We will not discriminate against you for exercising these rights.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top will reflect any changes.

13. Contact

If you have questions about this policy, reach us at:

alexconnola@gmail.com