Privacy Policy

Last updated: 17 September 2026

GamX ("we", "our", "the app") is a gambling recovery companion built by Alexander Connola. Your privacy matters. This policy explains what data we collect, why, and how we protect it.

1. Data controller

The data controller for personal data processed in connection with GamX is Alexander Connola, operating GamX. For privacy enquiries and requests, contact alexconnola@gmail.com.

2. Data We Collect

Account & Profile

• User ID (community): if you sign in to community features via Sign in with Apple, Firebase receives an anonymous, app-scoped Apple user identifier. We do not receive your real name or personal email unless you choose to share it.
• User ID (Coach X): if you use Coach X without community sign-in, the app signs you into Firebase anonymously so we can authenticate requests to our server and enforce App Check. No email or Apple ID is associated with this anonymous account unless you later link Sign in with Apple.
• Display name: an optional nickname you set for the community features.
• Profile photo: stored on-device only; never uploaded to our servers.

App Content

• Community posts & comments: text content you publish to the community feed, stored in Google Cloud Firestore.
• Coach X chat messages: conversation history with the AI coach, processed via our server-side proxy to OpenAI. Messages are sent over an encrypted connection and are not used to train AI models.
• Voice audio: when you use voice chat, microphone audio is transcribed on-device using Apple Speech Recognition and the text is sent to Coach X. Raw audio is not stored on our servers.

Recovery Data

• Journal entries, streak data, urge logs, protocol progress: all stored locally on your device using UserDefaults and are never uploaded to our servers. Community leaderboard data (streak days, gem rank) is synced to Firestore only if you opt in to the leaderboard.

Diagnostics & product analytics

• Mixpanel: the app uses Mixpanel (EU endpoint api-eu.mixpanel.com) for product analytics. This may include a device identifier, product interaction events (for example screen views and feature use), and your Firebase user ID when you are signed in with Sign in with Apple. Mixpanel is used only to understand and improve the app. It is not used for advertising or cross-app tracking.
• RevenueCat: the app uses RevenueCat to sync App Store subscription status (active entitlement, renewals, and restorations) so we can manage access and understand subscription health. This may include your Firebase user ID when you are signed in with Sign in with Apple, App Store transaction identifiers, and product identifiers. Billing itself stays with Apple. RevenueCat is not used for advertising or cross-app tracking.
• Firebase Analytics / Crashlytics / Performance: the app does not include Firebase Crashlytics, Firebase Performance, or Firebase Analytics. Standard Apple-provided diagnostics (if you participate through your device settings) are governed by Apple's policies.

3. How We Use Your Data

• To provide and improve the app's core functionality (recovery tracking, AI coaching, community).
• To secure cloud features (Firebase Authentication and App Check).
• To manage your subscription via Apple's StoreKit, with RevenueCat used to sync and display subscription status.
• To analyse product usage via Mixpanel so we can improve onboarding and features.

We do not use your data for advertising or cross-app tracking.

Lawful bases (UK GDPR)

Where UK GDPR applies, we rely on the following lawful bases, depending on the processing:

• Performance of a contract: providing the app, subscriptions, and features you request (e.g. community and cloud sync you choose to use).
• Legitimate interests: securing the service and improving the app in ways you would reasonably expect, balanced against your rights.
• Consent: where we ask for it (for example, where Sign in with Apple or platform permissions require explicit consent).
• Legal obligation: where we must process data to comply with applicable law.

4. Data Sharing

We do not sell your data. Data is shared only with:

• Google Firebase: authentication, Firestore database, and App Check (governed by Firebase's privacy policy).
• OpenAI: Coach X chat messages are sent to OpenAI's API for response generation (governed by OpenAI's API data usage policy). OpenAI does not use API inputs to train models.
• Mixpanel: product analytics events and related identifiers (governed by Mixpanel's privacy policy). Events are sent to Mixpanel's EU data residency endpoint.
• RevenueCat: subscription receipts and entitlement status (governed by RevenueCat's privacy policy).
• Apple: subscription management, Sign in with Apple, and App Store analytics.

5. International Transfers

Some of our processors (including Google Firebase, OpenAI, Mixpanel, RevenueCat, and Apple) may process or store data outside the UK. Mixpanel analytics for this app are configured to use Mixpanel's EU endpoint. Where data is transferred internationally, we use appropriate safeguards permitted under UK data protection law, such as standard contractual clauses and the UK International Data Transfer Agreement (or equivalent mechanisms), supplemented where required by a transfer impact assessment.

6. Data Retention

• On-device data (journal, streak, profile photo) persists until you delete the app.
• Community content in Firestore can be deleted by you at any time (delete your posts/comments).
• Coach X chat history is stored on your device (in iOS UserDefaults) so your conversation persists between sessions; you can clear it at any time using the reset button in the Coach screen, or by uninstalling the app. Our servers process each request transiently and do not retain the conversation after a response is returned.
• Mixpanel product analytics events are retained according to our Mixpanel project settings and Mixpanel's policies. Deleting your cloud account removes your Firebase Auth user and community data; it does not automatically erase historical analytics events already sent to Mixpanel. Contact us if you need help with an analytics erasure request.
• RevenueCat subscription records are retained according to RevenueCat's policies and our project settings. Deleting your cloud account does not automatically erase historical purchase records already synced to RevenueCat. Contact us if you need help with an erasure request.

7. Tracking

GamX does not track you across other apps or websites. We do not use advertising identifiers or any cross-app tracking frameworks. NSPrivacyTracking is set to false.

8. Security

All network communication uses HTTPS/TLS. Firebase Authentication secures access to cloud resources. Sensitive keys (e.g. AI service credentials) are stored in Google Secret Manager and never included in the app binary.

9. Children's Privacy

GamX is not intended for children under 18. Anonymous community features are restricted to adults 18+. We do not knowingly collect data from minors.

10. Your Rights

Where UK GDPR (or equivalent law) applies, you may have the following rights in relation to your personal data: access, rectification, erasure, restriction of processing, objection to certain processing, and data portability (where applicable). You may also lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

You can delete your cloud account at any time directly inside the app: open GamX, tap the gear icon on the Progress tab, scroll to Account, and choose Delete cloud account. This permanently removes your community profile, posts, comments, votes, leaderboard entry, and Coach-related server-side data, and deletes your Firebase Auth user. On-device data (journal entries, streak, profile photo, Coach chat history stored locally) can be removed by deleting the app. For other requests (e.g. access or correction), contact us at the email below; we will respond within the time frames required by applicable law.

11. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) may apply. We do not sell personal information or share it for cross-context behavioural advertising. You may have rights to know about personal information collected, to request deletion, to correct inaccuracies, and to limit certain uses of sensitive personal information. To exercise these rights, contact alexconnola@gmail.com. We will not discriminate against you for exercising these rights.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top will reflect any changes.

13. Contact

If you have questions about this policy, reach us at:

alexconnola@gmail.com