Privacy Policy

Last updated 18 October 2026

The short version

• Your recovery stays on your phone. Journals, moods, urges, check-ins, your answers and your progress history are stored only on your device, encrypted. We never receive them.
• The exception is what you choose to share with your Team. If you tell your team how your day is going, share a streak milestone or a badge, or ask them for support, that message leaves your phone and your teammates see it (section 5).
• Our server holds very little, and only when you use a feature that needs it: an account if you have Premium and create one, and Team if you choose to join one.
• No ads, no analytics, no tracking. We do not sell or share your data for advertising, and there is no advertising code in the app.
• You can delete your account at any time, and it is deleted at once.

1. Who we are

Vibrise is a mobile app that helps people quit porn. It is run by Yusuf Efe Temiztürk, a sole proprietorship registered in Türkiye, which is the data controller for the personal data described here.

Address: Merdivenköy Mah. Dikyol Sk. No: 2 B Blok İç Kapı No: 179, Kadıköy, İstanbul, Türkiye
Email: support@vibrise.app

This policy covers the Vibrise app on iPhone and Android and this website, vibrise.app. In it, "we" and "us" mean Vibrise, and "you" means the person using the app or the site.

2. What stays on your phone

Vibrise is built so that the most personal parts of your recovery never leave your device. These are stored only on your phone, unless you choose to share something from them with your Team (section 5):

• your journals, gratitude entries and notes
• your mood check-ins, urge logs and the details you add to them
• your answers to the questions when you set up the app
• your streak and its history, your Focus Points, Rise, badges and every other measure of your progress
• your daily plan, the activities you log, and what you read in the app's library
• the apps you choose to block and your block schedules

How it is protected. This data is kept in an encrypted database on your phone. The key to it is held in your phone's secure storage (the iPhone Keychain or the Android Keystore). We keep the database and its key out of iCloud and Google backups on purpose, so a copy of your recovery never ends up in a cloud account.

What that means for you. If you delete the app or lose your phone, this data is gone, and we cannot bring it back, because we never had it. To move to a new phone, use Download My Data in Settings. It makes an encrypted file, protected with a password you choose, that you keep wherever you like. On the new phone, Vibrise can read that file and restore your data. We never receive the file or its password.

Permissions the app asks for

• Screen Time (iPhone). Used to block the apps you choose during a block session. Apple gives Vibrise only coded identifiers for those apps, and they stay on your phone. If you turn on the adult content filter, Apple's own web filter does the filtering.
• Usage access and display over other apps (Android). Used to notice when an app you have chosen to block is opened, and to show the block screen over it. This information stays on your phone.
• Notifications (iPhone and Android). Vibrise sends notifications only if you allow them. See Notifications in section 3.
• Proximity sensor. The push-up counter uses your phone's proximity sensor to count reps. It does not use the camera, and nothing is recorded or sent.

3. What leaves your phone

Some features cannot work without a server. Here is everything that leaves your phone, and why.

Library content (everyone)

The articles and pictures in the app's library are downloaded from our server. The app downloads the text of the whole library at once, so the server does not learn which article you read. Pictures are downloaded the first time they are shown and then kept on your phone, so the server can see which pictures were requested, but not by whom: these downloads carry no account, no name and no device ID. Like any request on the internet, they show your IP address to the server that answers.

Device check (when you sign in or join a Team)

When you ask for or enter a sign-in code, and when you join a Team, the app asks Apple (App Attest) or Google (Play Integrity) to confirm that the request comes from the real Vibrise app on a real device. This protects accounts from automated attacks. Apple or Google handle that check under their own privacy policies. We keep nothing from it except a one-time random value that is deleted within minutes.

Limits that stop abuse

To stop someone from flooding the service, our server counts some requests for a short time: how many sign-in codes were requested for an email address or from an IP address, and how many wrong codes were tried. These counters hold the email address and IP address only in coded form, and they are deleted after 24 hours.

Server logs

Supabase, which runs our server, keeps a log of requests that includes the IP address they came from. These logs are kept for up to 7 days.

Notifications

Vibrise sends notifications on iPhone and Android only if you allow them, and you can turn them off at any time in your phone's settings. They never say anything sensitive on your lock screen.

• Notifications about your own day (journal and Daily Plan reminders, block sessions, milestones, badges and reports) are scheduled by the app on your phone, from data on your phone. Nothing about them is sent to our server. On Android, a small notification also shows while a block session is running.
• Team notifications (for example, when someone answers your support request) have to come from our server. For them, your phone gives us a push token: a code that lets Apple's push service (iPhone) or Google's Firebase Cloud Messaging (Android) deliver a notification to your device. We store the token with your Team account and delete it when you sign out or delete your account. A Team notification carries no teammate's name, and our server sends nothing if you turn Team notifications off. On Android, Google's push service also registers your device with Google, under Google's privacy policy.

4. Accounts

You can use Vibrise without an account. Accounts are part of Premium: only Premium users can create one, and you need one to join a Team.

What your account holds:

• your email address, or the account identifier and email address that Apple, Google or Facebook give us when you sign in with them (if you use Apple's "Hide My Email", we receive Apple's relay address instead)
• the username you choose
• which of Vibrise's own pictures you use as your profile picture (you cannot upload a photo)

Nothing else goes to the server with your account. If Apple, Google or Facebook send us your real name or photo when you sign in, our server deletes them as they arrive.

Signing in by email. We email you a 6-digit code. To send it, our email provider (Lettermint) receives your email address, the subject line and the code. This means the email provider knows that your address is used to sign in to Vibrise. On our own server, the record of a code holds only a coded form of your email address and is deleted within 24 hours.

Signing in with Apple, Google or Facebook. Apple's sign-in uses your iPhone's own system screen. Google and Facebook sign-in open in your phone's browser. No Google or Meta code runs inside the Vibrise app. The company you sign in with knows that you signed in to Vibrise, under its own privacy policy.

When Premium ends. Premium features close, the app signs you out and you leave your Team. We keep your account (email, username and picture choice) so you can continue if you come back. If you do not return to Premium within 12 months, we delete the account. You can delete it yourself sooner at any time, even after Premium has ended (section 11).

5. Team

Team is an optional Premium feature that puts you in a small group of people on the same journey. You join only by ticking a consent box, and nothing is shared with a Team before you do. The consent record (which version of the text you agreed to, and when) is kept with your account.

What the server receives when you join a Team:

• Your stage, one of three broad bands based on how many days you are into your current run (the first three weeks, up to about two months, or beyond). It is sent once, when you join the waiting list, and never updated. It is used only to match you with people at a similar stage, and it is never shown to anyone.
• Your time zone, so your teammates share a similar day.
• Your Focus Points from the previous day, sent once a day as a single number. Focus Points are the points the app gives for recovery activities. They are used to work out your team's score.
• What you post in the team chat, described in full below.
• Your settings in Team: who you have blocked, whether you have muted Vibrise's own messages, and any reports you make.

Nothing about your recovery is sent to Team on its own. Your streak, moods, urges, journals and relapses never reach Team automatically. Something reaches your team only when you send it yourself, as described next.

What you choose to share with your team

Team messages are chosen from Vibrise's own set of messages: you cannot type free text. But some of them say something personal about your recovery, and once you send one, it has left your phone. It is stored on our server and every member of your team can see it, with your username and picture. These are the things you can share:

• How you are doing. Check-in messages such as "Feeling strong today", "Keeping my head up", "Tough day, but I'm here." or "Could use some encouragement". After a Mood Check-in or a Morning or Evening Journal, the app may offer Tell My Team with the message that matches the mood you just gave already picked. Only the message you send is posted, never your mood answer, a score or anything you wrote, but the message itself tells your team roughly how you feel.
• A streak milestone. When you reach a milestone day (for example Day 7 or Day 30) for the first time, you can share it. Your team then sees that day number, which shows how long your current streak was at that moment.
• A badge. You can share a badge you earned, such as a recovery milestone or a number of urges you have overcome. Your team sees which badge it is.
• A request for support. At the end of Get Help, if the urge is still there, you can ask your team for support. They see "Could use the team's support". They never see what happened or why, but they do learn you are going through a hard moment.
• Everything else you post: greetings, encouragement and congratulations to others, your replies to support requests, and emoji reactions.

Sharing is always your choice and always one tap at a time. Your teammates can see what you shared for as long as it is in the chat (section 10), and we cannot control what another person does with something they have seen, such as taking a screenshot. When you send a support request, Vibrise also posts a private Get Help card in the chat that only you can see.

What your teammates see: your username, your picture, what you post in the chat, and the team's combined score. They do not see your own Focus Points or any other number about you. Other teams see only team names and their scores on the leaderboard.

Leaving a Team withdraws your consent, stops the daily upload and deletes your daily numbers. Points you gave to a day the team has not finished counting stay in the team's score as one total with no name attached, and that total is deleted when the day is counted. What you already posted stays in that team's chat until the team ends or you delete your account. Joining a Team again asks for your consent again.

Team data sits on our server so your team can see it. We do not read team chats as a routine. We look at Team data only to review a report or to fix a problem.

6. Reports and safety

You can report a teammate. A report holds who made it, who it is about, the reason (one of a fixed list), the team and the time. The person you report is not told. Reports are reviewed by the founder, usually within 24 hours. The email alert he receives contains only the report's number and reason, never a name.

A member removed after a report is banned from Team for at least 7 days. To make the ban hold, we keep a coded fingerprint of that person's email address (not the address itself) until the ban ends and the team they were removed from no longer exists.

7. Purchases

Premium is bought through Apple's App Store or Google Play. They handle the payment, and we never see your card or payment details. Our server needs to know whether your Premium is active, because accounts are part of Premium. If we use a subscription service to check this, we will name it in this policy before it is used.

8. What we never do

• We do not sell your personal data, and we do not share it for advertising.
• We do not show ads, and there are no advertising or tracking tools in the app.
• We do not use analytics tools in the app. If we ever add any, we will update this policy first and explain exactly what they collect.
• We never receive your journals, moods, urges or recovery history. The only parts of your recovery that reach us are the Team messages you choose to send (section 5).

9. Companies that process data for us

We give each company only what it needs for the job listed.

10. How long we keep data

11. Deleting your account

Go to Settings, then Delete My Account, and confirm with a new email code or the same Apple, Google or Facebook sign-in you used to create it. This works even after your Premium has ended. If you cannot get into the app, email support@vibrise.app from the address on your account and we will delete it for you.

Deletion happens at once. There is no waiting period and no way to undo it. Your username, picture, consent, Team membership, daily numbers, messages, reactions, blocks and the reports you made are all deleted. Your messages are removed from every team you were in. Your teammates see that you left, and the notices that you joined and left stay in the chat with no name.

Two things are kept, by design:

• reports other members made about you, kept as a record with your name removed and deleted 12 months after the report was closed
• if you are under a Team ban, the coded fingerprint of your email (section 6), so deleting an account cannot be used to skip a ban

Lettermint keeps its copies of sign-in emails for up to 28 days after they were sent, and we cannot shorten that. If your address is on its do-not-send list, tell us and we will remove it.

Deleting your account does not touch your phone. Your recovery data stays on your device until you use Clean Start or delete the app.

12. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you, and give you a copy of it
• correct data that is wrong
• delete your data
• stop or limit a use of your data you object to
• withdraw a consent you gave, such as Team (leaving the Team does this)

Most of your data is on your phone, so you already have it: Download My Data gives you a copy, and Clean Start erases it. For anything on our server, email support@vibrise.app. We answer within 30 days, and we may ask you to confirm that the account is yours first.

You can also complain to a data protection authority. In Türkiye this is the Personal Data Protection Authority (KVKK). In the European Union or the UK, it is the authority in your country.

13. Legal bases and transfers

We use your data only on these grounds, under Türkiye's Personal Data Protection Law (KVKK) and, where it applies, the EU and UK GDPR:

• To provide what you asked for: your account, sign-in and library downloads.
• Your explicit consent: Team. Because Vibrise is a recovery app, being in a Team can say something sensitive about you, so we share nothing before you tick the consent box, and you can withdraw at any time by leaving.
• Our legitimate interest in keeping Vibrise safe: device checks, abuse limits, reports and bans, and this website's security logs.
• Legal obligations, when the law requires us to keep or disclose something.

We are based in Türkiye. Our server is in Germany, and some of the companies in section 9 are in the USA, so your data may be processed outside the country where you live. We send them only what their job needs.

14. Security

Your recovery data is encrypted on your phone and kept out of cloud backups. On our server, the app cannot read or write tables directly: every request goes through a checked function that confirms who you are and what you may see. Sign-in codes, bans and abuse counters are stored in coded form, not as plain email addresses. No system is perfectly secure, but we built Vibrise so that the most sensitive data never reaches us at all.

15. Age

Vibrise is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If you believe someone under 18 has an account, email us and we will delete it.

16. This website

This site is hosted by GitHub Pages. It uses no cookies, no analytics and no tracking, and it loads nothing from other websites: its fonts are stored on the site itself. GitHub records the IP addresses of visitors in its server logs for security, under its own privacy statement. If you email us, your message reaches our inbox at Google Workspace.

17. Changes and contact

When we change this policy, we update the date at the top. If a change affects what leaves your phone or who receives it, we will tell you in the app before it takes effect.

Questions or requests: support@vibrise.app, or write to Yusuf Efe Temiztürk at the address in section 1.

Back to Vibrise