Privacy Policy

1. Controller

2. Data protection officer

Because Clearing’s processing requires a data protection impact assessment, we appoint a data protection officer (Section 38(1) German Federal Data Protection Act, BDSG). Until their contact details are published here, write to [email protected] with the subject “Data protection”.

3. Special-category data and your explicit consent

The fact that you want to quit porn, gambling or social media, and signals about blocked attempts, can reveal information about your sex life or health. The GDPR protects this as special-category data (Art. 9(1) GDPR). We process it only:

• with your explicit consent (Art. 9(2)(a) GDPR), which the app asks for before protection starts and, if you withdrew it, again before you confirm a new pledge; and
• for charge evidence, to establish, exercise or defend legal claims (Art. 9(2)(f) GDPR), for example when a card dispute is raised.

Withdrawing your consent

You can withdraw your consent at any time with effect for the future: in the app under Settings → Privacy → “Withdraw consent”, or by email. Processing up to then remains lawful. Without an account, the withdrawal covers the installation you make it on. From the moment we receive it:

• Nothing from your devices is recorded any more. Check-ins and signals your apps send are discarded on arrival (we only apply which categories the DNS filter should block), and our DNS resolver keeps blocking the categories you chose but stores no counts, blocked domains or test lookups for your devices. Protection keeps working on your devices; the app’s protection indicator shows “Not reporting”, and device verification stops.
• An active pledge ends without a charge and your card is released.
• If a forfeiture event was recorded before your withdrawal (the pledge is in its 48-hour notice, under appeal or being charged), that event is still settled under the Pledge Terms: notice, appeal and, if it is upheld, the charge. For this we keep the evidence of that event to establish, exercise or defend legal claims (Art. 9(2)(f) GDPR), and we record nothing new. If the event is voided, the pledge ends without a charge.
• If no pledge continues, we delete the records of blocked lookups and category signals from your devices and your onboarding answers at once. Otherwise they are deleted on the normal schedule after the pledge ends (section 15). What you are quitting stays on your pledge records, which document the contract, until you delete your account.
• We confirm the withdrawal by email if you have an account. A new pledge asks for your consent again; confirming it turns reporting back on.

4. Using the app without an account

On first launch the app creates a random installation ID and stores it in your device’s Keychain. It is linked to device information (model, system and app version) and to your use of protection.

Onboarding check: if you take the short check in onboarding, we receive what you are quitting, your answers (for example how often and since when), the resulting score, the age range you chose, how you heard about Clearing, your goals and, if you enter it, a first name. We use this to build your plan and to compare your score with the average of all answers. Legal bases: Art. 6(1)(b) and Art. 9(2)(a) GDPR. We keep it until you delete your data in the app.

5. Your account

Pledges and protecting more than one device need an account, created with Sign in with Apple. We receive a random Apple user identifier and an email address, which can be Apple’s private relay address. We store them with your language, currency and linked devices. A session token is kept on your device. Apple processes the sign-in itself; see Apple’s privacy policy. Legal basis: Art. 6(1)(b) GDPR. We keep account data until you delete your account (see Terms of Use, section 9).

6. Protection and verification

Protection runs on your devices. What reaches our servers is listed here per signal. We never receive full URLs, page titles, screenshots, recordings, messages, photos or contacts.

Purpose: to run protection, to show you each device’s status and to detect forfeiture events under the Pledge Terms. The DNS filter connects directly to our own resolver at Hetzner in the EU, authenticated with a certificate per device; it uses its own recursive resolver, so no third party sees your lookups. Legal bases: Art. 6(1)(b) and Art. 9(2)(a) GDPR. Retention: for the term of a pledge plus 30 days; without a pledge, 30 days.

7. Pledges and payments

If you make a pledge, we store its amount, currency, duration, dates, status and events, and a consent record (time, IP address, browser or app identifier, terms version, mandate text). You enter card details in Stripe’s payment sheet; they go directly to Stripe. We only receive the card brand, the last four digits, the expiry date, the issuing country and the result of any 3-D Secure check. Stripe receives your email address and our account reference, never what you are quitting. With Apple Pay, Apple creates a payment token; see Apple’s privacy policy.

Stripe Payments Europe, Ltd. acts as our processor for payment processing and as an independent controller for its own legal duties such as fraud prevention and anti-money-laundering checks; see the Stripe privacy policy. Legal bases: Art. 6(1)(b) GDPR (pledge), Art. 6(1)(c) GDPR (accounting duties), Art. 6(1)(f) GDPR (preventing payment fraud), Art. 9(2)(a) and (f) GDPR (evidence). Retention: the evidence record of a charge for 18 months after the charge, pseudonymised if you delete your account; accounting records (amount, date, receipt, without category) for the statutory periods under German commercial and tax law (currently up to 10 years).

8. Notifications and emails

Push notifications go through the Apple Push Notification service, using a device token. Emails (pledge confirmation, notices, receipts, decisions) are sent through Resend. Notices contain the evidence timeline (category, time, device). Notification texts and email subjects never name what you are quitting. Resend sends from its EU region (Ireland) but stores account data and email logs in the United States (see section 13). Legal bases: Art. 6(1)(b) and Art. 9(2)(a) GDPR. Retention: our notification log is part of the pledge evidence; Resend keeps delivery logs for a limited period under its own retention rules.

9. Appeals, withdrawals and support

When you appeal, withdraw or write to us, we process what you send (category of appeal, your text, email address, pledge reference) and our reviewer’s notes and decision. This also applies to the forms on this website. Legal bases: Art. 6(1)(b) and (c) GDPR, Art. 9(2)(a) and (f) GDPR. Retention: appeals with the pledge evidence; withdrawal declarations until the end of the regular limitation period (three years from the end of the year, Section 195 BGB); other support messages until the matter is resolved, unless we must keep them by law.

10. Product analytics in the app

With your consent we use PostHog to understand which parts of the app help. Events carry your random installation or account ID, device and app information, and product events such as onboarding steps, protection level and pledge status. We never send the category you chose, URLs, notes or appeal texts. Data is stored in PostHog’s EU cloud (Frankfurt). Legal bases: Art. 6(1)(a) and Art. 9(2)(a) GDPR. You can switch analytics off at any time under Settings → Privacy → “Share usage analytics” (on the Mac: Settings → “Share anonymous usage analytics”); from then on the app sends nothing. Retention: at most 24 months.

If you share diagnostics with app developers in your Apple device settings, Apple may pass crash reports to us. You can change this under Settings → Privacy & Security → Analytics & Improvements.

11. This website

useclearing.com runs on servers rented from Hetzner Online GmbH in the EU and is delivered through Cloudflare. Each request creates a short-lived server log entry (IP address, time, requested address, status code, browser and system, referrer) to keep the site running and secure. Legal basis: Art. 6(1)(f) GDPR. Retention: no longer than 14 days, unless needed to investigate a security incident.

The website sets no cookies, uses no local storage, runs no advertising scripts and loads no fonts or other files from third parties. Forms only send data when you submit them, directly to our backend at Hetzner. If the backend is not configured or reachable, the form opens your own email app instead.

To learn which pages and free tools are used, we count visits with PostHog in a cookieless mode. Your browser sends the page address (without anything after “?” or “#”), the referring site, campaign parameters, browser, operating system, screen size and language, plus two kinds of events: a click on a marked button such as the App Store badge, and a self-test reaching its result. Nothing you type or choose in a tool is sent, and no score. The requests go to our own domain (/px) and are forwarded to PostHog’s EU cloud (Frankfurt). PostHog uses the IP address and browser data to derive an approximate location and a pseudonymous visitor hash with a salt that changes every day, so visits cannot be linked across days and no profile is built. Nothing is stored on or read from your device for this. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing which content helps. Retention: at most 24 months. You can object at any time by email; a content blocker that blocks /px also stops it.

12. Recipients and processors

We do not sell data and share nothing with advertisers. These service providers process data for us:

13. Transfers outside the EU

Apple, Resend, PostHog, Cloudflare and Stripe’s parent company are based in the United States. Where data reaches them or can be accessed from there, the transfer is based on the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

14. Automated decisions

Our server detects forfeiture events automatically under the rules in the Pledge Terms (for example two independent signals within 15 minutes, or protection left off for 24 hours). Because this can lead to a charge, we protect you as follows: a single automated signal is never enough; every event starts a 48-hour notice that shows you the evidence; you can contest it, and a person reviews every appeal before any charge. This processing is necessary for the pledge you asked for and based on your explicit consent (Art. 22(2)(a) and (c), Art. 22(4) GDPR).

15. Retention at a glance

16. Data protection impact assessment

Because Clearing processes special-category data and checks whether protection stays on, we carry out a data protection impact assessment under Art. 35 GDPR before launch and review it whenever the processing changes.

17. Security

All connections are encrypted. The DNS filter requires a certificate per device. On iPhone and iPad, check-ins are signed with Apple App Attest. The apps never access the database directly; only our server functions do, with access restricted to the two partners. Data is hosted in the EU and stored without names wherever possible.

18. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and you can withdraw consent at any time (Art. 7(3) GDPR). Write to [email protected]. We will never ask for your Apple ID password or full card number.

You can also complain to a supervisory authority. The authority responsible for us is:

19. Age

Clearing is only for people aged 18 and over. We do not knowingly process data of minors.

20. Changes

We update this policy when the app, our providers or the law change. The date at the top shows the current version.