Privacy Policy

Last updated: 26 August 2026

1. Introduction and Data Controller

Rokan Journey (“Rokan Journey”, “we”, “our”, or “us”) is an offline-first behavioral support and lifestyle improvement app designed to help users reduce or stop pornography use and build healthier routines.

This Privacy Policy explains how information is processed when you use the Rokan Journey mobile application, the rokanjourney.app website, and related services.

Data controller:

sassential OÜ

Registry code: 17489369
Estonian Commercial Register
Sepapaja tn 6
15551 Tallinn
Estonia

Email: support@rokanjourney.app

2. Our Privacy Approach

Rokan Journey is designed to keep your personal recovery information on your device wherever reasonably possible.

The information you enter, create, or generate while using the core recovery features of Rokan Journey is primarily stored in a local app database on your device. This includes your app profile and progress as well as information you record about your recovery, routines, check-ins, urges, and related activities.

We do not use product analytics to analyze or profile sensitive information about your sexuality, pornography use, recovery status, relapses, urges, triggers, feelings, or similar personal recovery information.

Remote processing is limited to functionality that requires it, such as accounts, optional cloud backups, purchases, community functionality, support, website operation, and limited product-usage analytics.

3. Local App Data

Most Rokan Journey data is stored locally on your device.

This includes information you provide to the app and information created as you use its features, such as:

• profile and personalization information
• recovery and check-in information
• goals and onboarding information
• app progress, activities, journeys, quests, crafting, and customization data
• Fight Back information
• preferences and settings and
• other information necessary to provide the app’s functionality

This list describes the general types of information stored locally and is not intended as an exhaustive list of every field used by the app.

Local recovery information is not automatically uploaded to our analytics provider.

Some local information may be processed remotely when you deliberately use functionality that requires it, particularly cloud backup as described below.

4. Account Data

Rokan Journey creates a remote account identity through Supabase during setup.

You may use the app without linking an Apple or Google account. In this case, Supabase creates an anonymous account identifier used to operate the account. Such an account may not be recoverable if your local session is lost.

If you connect Apple or Google, Supabase may receive information provided by the applicable sign-in provider, such as an account identifier, email address, display name, or other authentication information.

We use this information to authenticate you, link and recover your account, and provide account-related functionality.

Your Apple or Google identity and Supabase account identity are not used to identify your Fight Back usage analytics.

5. Cloud Backups

Cloud backup is optional.

If you enable cloud backup, Rokan Journey uploads app data so that your progress can be restored after reinstalling the app or moving to another device.

Because your local Rokan Journey data may contain sensitive information relating to pornography use, sexual behavior, urges, relapses, or other recovery information, cloud backups may contain special-category personal data.

Before cloud backup is enabled, we inform you that sensitive recovery information may be uploaded and ask you to expressly agree to the backup.

Cloud backups are stored in a private Supabase Storage bucket associated with our Supabase project hosted in Frankfurt, Germany.

We use safeguards intended to protect backups, including authenticated account access, private storage, account-scoped access controls, Row Level Security where applicable, encrypted network connections, and provider-managed encryption at rest.

The current version of Rokan Journey does not provide separate end-to-end encryption using a key known only to you.

We currently retain up to three cloud backups per connected account. Older backups are automatically replaced or removed.

We do not use the contents of cloud backups for advertising or product analytics.

Where backup data constitutes special-category personal data under the GDPR, we rely on your explicit consent for this processing.

You may withdraw your consent to future cloud backup processing by disabling cloud backup where available or by deleting your account and cloud data. Withdrawal does not affect processing that was lawful before withdrawal.

6. Feature Requests and Community Content

Rokan Journey may include feature-request, voting, feedback, or other community functionality.

Content identified as public may become visible to other users. Do not submit private or sensitive information in public community areas.

Votes or similar interactions may be associated with your remote account where necessary to operate the functionality, such as enforcing voting limits.

Your account identity is not displayed publicly with your votes.

7. Product Analytics

We use PostHog Cloud EU for limited product analytics.

The purpose of these analytics is to understand how people interact with Rokan Journey, whether features are being used, where usability problems occur, and how we can improve the product.

Analytics may cover general product interactions such as:

• navigation and use of app features
• onboarding progress
• journeys, quests, crafting, progression, and other gameplay interactions
• use of subscription and purchase functionality and
• similar interactions with the app’s user interface and features

We may use technical analytics identifiers to distinguish general app-usage events. We do not intentionally use your email address, Apple or Google account identity, or Supabase account identity as the analytics identifier.

Fight Back feature usage

Because Fight Back is a core feature of Rokan Journey, we measure whether the feature itself is being used and whether users complete or leave the activity.

We may therefore record:

• fight_back_started
• fight_back_completed and
• fight_back_gave_up

These events contain information about the use of the feature, not the sensitive recovery information entered during it.

Each Fight Back event is sent using a newly generated random identifier created specifically for that individual event.

The identifier is not reused for later Fight Back events and is not intentionally linked to your Rokan Journey account, your general analytics identity, or another Fight Back event.

Sensitive recovery information

Our analytics are designed to measure how the product is used, not the intimate recovery state of individual users.

We do not use PostHog to analyze or build profiles based on sensitive information about a user’s sexuality, pornography use, recovery status, urges, relapses, triggers, feelings, or similar recovery content.

We do not sell analytics data or use Rokan Journey analytics for behavioral advertising.

8. Website Analytics

The rokanjourney.app website may use Vercel Web Analytics to understand basic website traffic, page usage, and website performance.

Website analytics are separate from your local Rokan Journey recovery data and cloud backups.

9. Subscriptions and Payments

Rokan Journey Plus subscriptions are purchased through the Apple App Store or Google Play.

Apple or Google processes the payment transaction. We do not receive or store your full payment-card details.

We use RevenueCat to validate purchases and manage subscription status and premium entitlements.

Apple, Google, and RevenueCat may process information necessary to operate subscriptions, such as product, transaction, entitlement, renewal, and subscription-status information.

Rokan Journey may also keep a limited local subscription-status cache so that premium functionality can remain available while temporarily offline.

10. Notifications

Rokan Journey uses local notifications if you enable reminders.

Notification settings are primarily stored on your device.

We do not use your recovery information to send behavioral advertising or marketing notifications.

11. Purposes and Legal Bases

Where the GDPR applies, we process personal data only where an applicable legal basis exists.

Providing Rokan Journey and your account

We process information necessary to create and operate your account and provide requested Rokan Journey functionality.

Legal basis: performance of our contract with you under Article 6(1)(b) GDPR.

Apple and Google account linking

When you choose to link Apple or Google, we process the information necessary to authenticate and recover your account.

Legal basis: performance of our contract with you under Article 6(1)(b) GDPR.

Cloud backup

Cloud backup is optional and may include sensitive recovery information.

Legal basis: consent under Article 6(1)(a) GDPR and, where the backup contains special-category personal data, explicit consent under Article 9(2)(a) GDPR.

Purchases and subscriptions

We process purchase and entitlement information necessary to provide Rokan Journey Plus.

Legal basis: performance of our contract with you under Article 6(1)(b) GDPR.

Information may also be processed where required to comply with accounting, tax, or other legal obligations under Article 6(1)(c) GDPR.

Product analytics

We use limited product analytics to understand, maintain, and improve Rokan Journey.

To the extent these analytics involve personal data and applicable law permits the processing on this basis, we rely on our legitimate interests in operating, understanding, securing, and improving Rokan Journey under Article 6(1)(f) GDPR.

We deliberately limit product analytics and do not use them to analyze sensitive personal recovery information.

Where applicable law imposes additional requirements on analytics technologies, we comply with those requirements.

Community features, security, and support

We may process information where necessary to provide community functionality, respond to support requests, maintain security, prevent fraud or abuse, comply with legal obligations, or establish, exercise, or defend legal claims.

Depending on the circumstances, the applicable basis may be Article 6(1)(b), Article 6(1)(c), or Article 6(1)(f) GDPR.

12. Service Providers and Data Sharing

We do not sell your personal data.

We use service providers where necessary to operate Rokan Journey and our website.

These may include:

• Supabase for authentication, remote account functionality, database functionality, and cloud backups
• PostHog for limited product analytics
• Vercel for website hosting and website analytics
• RevenueCat for subscription and entitlement management
• Apple for Sign in with Apple, App Store distribution, and purchases
• Google for Google account linking, Google Play distribution, and purchases and
• providers used for support and necessary business operations

These providers process information according to their role, our contractual arrangements, applicable law, and their own privacy documentation.

Some providers or their subprocessors may process information outside the European Economic Area.

Where GDPR requirements apply to an international transfer of personal data, we use an applicable lawful transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, or another recognized safeguard.

13. Data Retention and Deletion

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy or where retention is required by law.

In general:

• local app data remains on your device until removed through the app, deleted by you, or removed with the application depending on platform behavior
• remote account information is generally retained while your account exists
• up to three current cloud backups may be retained while cloud backup is enabled
• older backups are automatically replaced or removed
• community information is retained as necessary to operate the relevant functionality
• transaction information may be retained where required for accounting, tax, fraud prevention, or legal obligations
• support communications are retained only as long as reasonably necessary for support, business records, or legal claims and
• product analytics are retained according to our analytics retention settings and their continued usefulness for product analysis

You can initiate deletion through:

Home > Settings > Account & Data > Delete data & account

You may also request deletion by contacting:

support@rokanjourney.app

Account deletion removes personal data associated with your active Rokan Journey account where deletion applies, including your remote account and active cloud-backup data.

Limited information may remain temporarily in technical backups or security systems, or where longer retention is required or permitted by law.

Public community content may remain where it can lawfully remain without being associated with your account.

Because Fight Back usage events are deliberately not linked to your account or a reusable Fight Back identifier, we may not be technically able to identify a previously submitted Fight Back usage event as belonging to you.

Deleting your Rokan Journey account does not cancel an Apple App Store or Google Play subscription.

14. Your Data Protection Rights

Depending on applicable law and the circumstances of the processing, you may have rights including:

• access to personal data concerning you
• correction of inaccurate personal data
• deletion of personal data
• restriction of processing
• objection to processing based on legitimate interests
• data portability where applicable and
• withdrawal of consent where processing is based on consent

Withdrawal of consent does not affect processing that was lawful before withdrawal.

These rights may be subject to conditions and exceptions under applicable law.

To exercise your rights, contact:

support@rokanjourney.app

We may need to verify your identity before fulfilling a request where necessary to protect your account and information.

If you are in the European Economic Area, you also have the right to lodge a complaint with a competent data-protection supervisory authority.

Our supervisory authority in Estonia is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon):

https://www.aki.ee/en

15. Security

We use technical and organizational measures intended to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction.

These measures include appropriate access controls, encrypted network connections, private cloud storage, provider-managed encryption, account-scoped permissions, and data minimization.

No system can be guaranteed to be completely secure.

You are responsible for protecting access to your device and any Apple or Google account connected to Rokan Journey.

16. Age and Children

Rokan Journey is intended only for users who are permitted to use the service under applicable law and applicable app-store age requirements.

Where applicable law requires authorization from a parent or legal guardian for use of the service or particular personal-data processing, Rokan Journey may be used only with that authorization.

We do not knowingly seek to collect personal information from children in circumstances where doing so would be unlawful.

17. Changes to This Privacy Policy

We may update this Privacy Policy when Rokan Journey, our data practices, service providers, or legal requirements change.

The latest version will always be available at:

https://rokanjourney.app/privacy

Where required by applicable law, we will provide additional notice of material changes.