Sit Out Need help now?

Sit Out · Legal

Privacy Policy

Effective October 1, 2026 · Version 1.0

Sit Out helps adults stop betting on sports. What you log in it is personal, so the app is built to keep it on your phone. This policy explains exactly what happens to your information in the Sit Out app for iPhone and Android, and on this website.

Sit Out is made by Kafra Technologies LLC (“Kafra”, “we”, “us”). If anything here is unclear, email hello@kafra.tech.

The short version

  • No account needed. Everything you enter stays on your phone unless you turn on backup & sync.
  • Health information gets health-level protection. Your urges, slips, check-ins, notes and money answers are stored on our servers only if you give explicit consent on a separate screen.
  • Analytics only if you say yes, and never your entries, amounts, betting details or anything from the help screen.
  • No ads, no ad trackers, no data brokers. We don’t sell or share your data, and no AI service reads it.
  • Delete everything any time, in the app or by email.

1. Who we are

Kafra Technologies LLC, a US company, decides how and why your personal information is used in Sit Out. In legal terms we are the “controller” under the GDPR, and the “business” or “regulated entity” under US state laws.

We haven’t appointed a representative in the European Union or the United Kingdom. Before Sit Out is offered there, we will appoint one, as Article 27 of the GDPR and the UK GDPR require, and list their contact details here.

2. What stays on your phone

Sit Out works without an account and without an internet connection. By default, everything you enter is stored only in the app’s database on your phone:

  • your quit date, bet-free streaks, best run and milestones;
  • your setup answers: the sports and kinds of betting you did, how often, your estimate of what betting cost you per week or month (and in which currency), what else it has cost you, when urges hit, whether you’ve tried to stop before, your age range, and an optional goal for the money you keep;
  • your reasons for stopping and your vow, including the signature you draw;
  • check-ins (urge level, mood, whether you sat a game out, optional notes), Timeouts (when you started one, how strong the urge was, how it ended) and slips (when, and optionally the amount, what triggered it and a note);
  • the game times you choose, your daily check-in time and your notification settings;
  • the country you pick for help numbers, and your privacy choices.

This information never reaches us, so we can’t see it and don’t “collect” it in the legal sense. You control it in the app: Settings › Export my data saves a copy as a file that you decide what to do with, and Settings › Reset all data erases it. The signature you draw stays on your phone even if you turn on backup & sync.

3. What leaves your phone, and why

Only the following ever leaves your phone. Each item says when it happens and who receives it.

Whenever the app connects to one of these services, the service sees your device’s IP address, as every internet service does. We don’t use it to work out where you are.

Crash reports. Sit Out has no crash-reporting tool of its own. If you’ve allowed your phone to share diagnostics with app developers, Apple or Google may send us crash reports. They contain technical details about the crash, not your entries.

Help links. Numbers and links on the “Need help now?” screen open your phone app or browser. When you contact a helpline, that organization’s own privacy practices apply. Sit Out doesn’t record or report which number you chose.

4. Your health information

What you log in Sit Out says something about your health and well-being, and so can the simple fact that you use Sit Out. We handle all of it as health information:

  • “special category” data under the EU and UK GDPR (Article 9);
  • “consumer health data” under Washington’s My Health My Data Act and similar laws in Nevada and Connecticut (see our Consumer Health Data Privacy Policy);
  • “sensitive personal information” under California law.

In practice:

  • It stays on your phone unless you choose backup & sync.
  • Before anything is stored in the cloud, Sit Out shows a separate consent screen that lists what will be stored, where (Google Firebase, United States), for how long, and how to delete it. You can tap “I agree” or “Keep everything on this phone”. Keeping it on your phone doesn’t limit anything else in the app.
  • It is never sent to analytics, never used for advertising or marketing, never sold, never shared with third parties and never used to train AI.

Legal bases (EU, UK and Swiss users)

What we doLegal basis
Backup & sync, and the account that comes with itYour explicit consent: GDPR Art. 6(1)(a) and Art. 9(2)(a). Providing the service you asked for: Art. 6(1)(b).
Usage analyticsYour consent: Art. 6(1)(a), and Art. 9(2)(a) because using Sit Out can reveal health information. The same consent covers storing and reading the analytics ID on your device.
Subscriptions and purchase recordsPerforming our contract with you: Art. 6(1)(b). Keeping records the law requires: Art. 6(1)(c).
Bug-fix update checksOur legitimate interest in keeping the app working and secure: Art. 6(1)(f). Only technical data and a random ID are involved.
Emails and privacy requestsAnswering you: Art. 6(1)(b) or (f). Handling requests to exercise your rights: Art. 6(1)(c).
Age checkA legal obligation where an age-assurance law applies: Art. 6(1)(c); otherwise our legitimate interest in keeping Sit Out for adults: Art. 6(1)(f). The result stays on your phone.
This websiteOur legitimate interest in running a secure website: Art. 6(1)(f).

Withdrawing consent

  • Analytics: turn off Settings › Privacy › Help improve Sit Out. The app stops sending events right away.
  • Backup & sync: delete your account in Settings › Account › Delete account to remove everything stored in the cloud, or email us and we’ll delete your cloud data.

Withdrawing doesn’t affect what happened before, and it never affects your subscription or the features you can use.

5. Usage analytics (“Help improve Sit Out”)

During setup, Sit Out asks whether you want to help improve it. Neither answer is pre-selected. If you choose Not now, the analytics software is never started. If you choose Allow, the app sends PostHog only these events:

  • that you turned analytics on;
  • the app was opened (app version, platform, language, days since install);
  • which setup step number you viewed or finished, never your answers;
  • whether you allowed notifications;
  • that the subscription screen was shown (and from where in the app), which plan you picked, and whether a trial, purchase or restore went through;
  • which tool you opened (breathing, delay, log, plan or widget setup) and roughly how long you spent in it (under a minute, 1 to 5 minutes, over 5 minutes), never how it ended;
  • that you saved an entry, not what kind of entry or what it said;
  • how many game times you’ve set, never which sports, days or times;
  • that you viewed a milestone, not which one;
  • that you added a widget (and its size), signed in (and with which provider) or deleted your account;
  • neutral screen names such as “home” or “settings”.

Events are tied to a random install ID, never to your email or account. They also carry your plan, platform, language and the week you installed the app, plus basic technical details that PostHog’s software adds (device model, system and app version, screen size, time zone). We set PostHog to discard IP addresses, so it can’t work out where you are. When analytics is on, PostHog may also choose which layout of the subscription screen you see; every layout shows the same plans, prices and terms.

Never sent: anything you type, amounts of money, streak length, urge levels, moods, triggers, slips, sports, teams or leagues, check-in times, notification text, your name or email, and nothing at all from the “Need help now?” screen. There is no session recording (screen replay).

You can change your answer any time in Settings › Privacy. It never affects what you can use in Sit Out.

6. Subscriptions and purchases

Subscriptions are sold by Apple (App Store) or Google (Google Play). They take the payment; we never see your card or bank details. Through RevenueCat, the service we use to manage subscriptions, we receive what you bought, the price and currency, the dates, the renewal status and the store country. RevenueCat knows you by a random app user ID, not your name or email, and we never send it anything you log.

When you subscribe, the app also keeps a short record of what you agreed to: the version of the subscription screen, the price shown, your language, the time and the store’s transaction ID. It contains no health information.

Apple and Google handle purchases and their sign-in options under their own privacy policies (Apple, Google). Your purchase appears in your App Store or Google Play purchase history and on their receipts under the app’s name. If you use Sign in with Apple or Google sign-in, they know you signed in to Sit Out.

7. Who processes your data

These companies process personal information for us. They may use it only to provide their service to us, under contracts that require them to protect it at least as well as this policy does.

Our email provider hosts our support inbox (hello@kafra.tech). Apple and Google are not our processors: when you buy a subscription, sign in with them, or the app asks the store for an age signal, they act under their own privacy policies.

8. What we never do

  • Sell your personal information, or share it for targeted (“cross-context behavioral”) advertising.
  • Show ads, or include advertising, attribution or social-media tracking tools. We don’t use your phone’s advertising ID and don’t track you across other companies’ apps or websites.
  • Give your data to data brokers, insurers, employers, lenders or anyone in the gambling industry.
  • Send your data to AI services. If that ever changes, we’ll ask your permission first.
  • Record your screen.
  • Collect your location, contacts, photos or browsing history, or use geofencing.
  • Make automated decisions about you that have legal or similarly significant effects.

9. International transfers

Kafra is a US company, and our providers store data in the United States. If you’re in the EU/EEA, the UK or Switzerland, your data is transferred to the US under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework where the provider is certified (Google and PostHog are), and under the European Commission’s Standard Contractual Clauses, with the UK Addendum and Swiss amendments, in our data processing terms with our providers. You can ask us for a copy of the safeguards that apply.

10. How long we keep data

DataHow long
On your phoneUntil you erase it (Settings › Reset all data), delete your account and choose to erase this phone too, or delete the app.
Backup & sync data and your accountWhile your account exists. Deleted right away when you delete your account.
Usage analyticsDeleted within 30 days after you delete your account, or when you ask us. Otherwise kept for up to 7 years, the standard retention of our analytics provider. Events never contain your entries.
Subscription records at RevenueCatWhile you have an account or a subscription. Deleted within 30 days after you delete your account, apart from the minimal records below.
Minimal purchase records (store transaction ID, plan, price, dates; no health information)Kept by our subscription provider (RevenueCat) and by Apple or Google for up to 3 years after your last purchase, because tax and automatic-renewal laws require purchase records. The app also keeps a note of the price and terms you saw when you subscribed, on your phone only.
Emails and records of privacy requests24 months after the request is closed, unless the law requires longer.
BackupsCopies in our providers’ backup systems are deleted on their normal schedules, and within 6 months at most.
Update checks (Shorebird)Kept by Shorebird under its own policy. They contain only technical data and a random install ID.

11. Deleting your data

  • In the app: Settings › Account › Delete account. Your account and everything stored in the cloud are deleted right away; your analytics history and subscription-service record follow within 30 days. If you used Sign in with Apple, we also revoke Sit Out’s access to your Apple account. The app then offers to erase the data on your phone too.
  • Without the app: email us from your account’s email address. Step-by-step instructions: Delete your account.
  • No account? Your data is only on your phone. Use Settings › Reset all data, or delete the app.

Deleting your account doesn’t cancel a subscription. Cancel it in the App Store or Google Play first (see how to cancel).

12. Your rights

Wherever you live, you can ask us to:

  • confirm whether we hold personal information about you, give you access to it and send you a copy;
  • correct it (you can edit most of it in the app yourself);
  • delete it;
  • give you your data in a portable format (JSON, the same format as Settings › Export my data);
  • stop or restrict a use of your data, or object to it;
  • withdraw any consent you gave.

Using these rights will never count against you. To make a request, email hello@kafra.tech, ideally from the email address on your account. To make sure it’s really you, we may ask you to confirm the request from that address before we act on it. It’s free. We reply within 30 days. If a request is complex and we need more time, as the law allows, we’ll tell you why within those 30 days. You can use an authorized agent; we’ll ask for proof that they act for you and may check with you directly.

Data that exists only on your phone isn’t held by us, so you manage it directly in the app.

EU, UK and Switzerland: you can also complain to a data protection authority, for example where you live or work. EU authorities are listed by the European Data Protection Board; in the UK, contact the Information Commissioner’s Office. We’d appreciate the chance to fix the problem first.

Appeals (US): if we decline your request, reply to our decision with “Appeal” in the subject line. We’ll answer within 45 days and explain our decision. If we still decline, you can contact your state attorney general.

13. US state privacy notice

This section gives the details that California and other state privacy laws ask for. We apply it to everyone in the US, whether or not a particular law applies to us.

We don’t collect precise geolocation, biometric information, audio or video recordings, or inferences about you. In the past 12 months we have not sold or shared personal information, as California law defines those terms, and we don’t sell or share the information of anyone under 16. We use sensitive personal information only to provide the services you ask for, so there is nothing for a “Limit the use of my sensitive personal information” request to limit. We honor Global Privacy Control signals, although there is nothing to opt out of.

If you live in another state with a privacy law (for example Colorado, Connecticut, Virginia, Oregon or Texas), you have similar rights: to access, correct, delete and get a copy of your data, and to opt out of the sale of your data, targeted advertising and profiling. We don’t do any of those three. Residents of Washington, Nevada and Connecticut have additional rights over consumer health data, described in our Consumer Health Data Privacy Policy.

14. Adults only, and age checks

Sit Out is only for adults 18 and older. During setup you confirm that you’re 18 or older. Where the App Store or Google Play offers an age signal (Apple’s Declared Age Range or Google Play Age Signals, which some US state laws require apps to check), the app asks for it the first time you open it and uses the answer only to decide whether to show an adults-only screen. The answer stays on your phone. It is never sent to us, to analytics or to anyone else, and never used for advertising or profiling.

If the store says you’re under 18, Sit Out explains that it’s for adults, collects nothing, and keeps the “Need help now?” screen available. We don’t knowingly collect personal information from anyone under 18. If you think a minor has created a Sit Out account, email us and we’ll delete it.

15. Discretion and security

On your phone

  • Neutral notifications and widget. By default, reminders and the home-screen widget use neutral wording, like “Your daily check-in” or “Day 23”, with no betting words, team or league names, or amounts. You can turn on Show details in Settings if you want more.
  • Lock screen. On Android, Sit Out notifications are hidden on a secure lock screen. On iPhone, if you hide notification previews, a neutral placeholder is shown.
  • App switcher. The Log is blurred when you switch apps, so your entries don’t show in the app switcher.
  • Reminders are scheduled on your phone. This version doesn’t use a push notification service, so no push token is created.
  • Phone backups. If you back up your phone with iCloud or Google, that backup may include Sit Out’s data. Those backups are stored in your Apple or Google account, under your control, and we can’t access them.
  • Anyone who can unlock your phone can open Sit Out, so use a screen lock.

On our side

Data is encrypted in transit (HTTPS) and at rest on Google’s servers. Cloud data is protected by access rules that let only your signed-in account read or write it. Access to our provider accounts is limited to the people who run Sit Out.

If a security breach affects your information, we’ll tell you without unreasonable delay and no later than 60 days after we discover it. We’ll also notify regulators as the law requires, for example the US Federal Trade Commission under its Health Breach Notification Rule, and EU or UK data protection authorities within 72 hours.

16. This website

This website (sitout-app.web.app) is hosted on Firebase Hosting by Google. It has no cookies, no analytics and no tracking scripts. To deliver pages and protect the site from abuse, Firebase Hosting processes standard request data: your IP address, browser details and the pages you request. We don’t keep or analyze it. Our pages load two typefaces from Google Fonts, so your browser connects to Google’s font servers, which see your IP address (see Google’s Fonts privacy FAQ). Links from this site to other websites, including helplines, don’t tell them which page you came from.

17. Changes to this policy

When we change this policy, we’ll update the date at the top and record the change below. For material changes, especially any new use of your health information or any new recipient, we’ll tell you in the app before they take effect and, where the law requires, ask for your consent again.

Version and dateChange
1.0 · October 1, 2026First version.

18. Contact us

Kafra Technologies LLC
Email: hello@kafra.tech

See also: Terms of Use · Consumer Health Data Privacy Policy · Delete your account