This policy explains what data Sippa processes about you, what it uses it for, who receives it, how long it is kept and how you stay in control of it. It describes the application as it actually works. The Hungarian version is the authoritative one; this is a faithful translation.
1. Who controls your data
The controller is the operator of the Sippa application:
Name: Györkös Balázs e.v. (sole trader)
Registered seat: 7634 Pécs, Bajmi dűlő 28., Hungary
Sole trader registration number: 6143550
Tax number: 63368101-1-22
Email: hello@sippa.io
Data protection officer: none appointed. One is not required, because we do not process data on a large scale (Article 37 GDPR). Send data protection questions to hello@sippa.io.
2. Why this policy matters more than most
Sippa tracks your alcohol consumption. What you record about it, together with your height, weight and sex, is health data under Article 9 GDPR. That is a special category of personal data, so the law sets a stricter condition for processing it than for ordinary data.
We therefore process this data solely on your explicit consent (Article 9(2)(a) GDPR). We ask for it during setup, with a separate checkbox. You can withdraw it at any time (see section 7), without affecting the lawfulness of processing carried out before the withdrawal.
We do not sell your data and do not use it for advertising. We use no analytics or advertising tracking.
3. What we process
3.1 Account data
- first and last name
- email address
- password, stored only as a one-way hash: we neither know nor can recover your password
- chosen language and currency
- date of birth, to enforce the minimum age of 18
- country: after you register we pre-fill it from where you connect (Cloudflare derives the country from your IP address; we do not store the IP address for this), and you confirm or change it during setup or in your profile. We also store whether the value was pre-filled by us or set by you.
- the nickname you give the Sippa character, if you give one
- the time and version of your consents and acceptances (health data, terms of use, pregnancy mode, offers by email)
- if you sign in with Google or Apple: the account identifier the provider gives us, your email address, the profile picture link Google sends (stored, but not displayed), and for Apple sign-in a token we use to revoke Sippa's access at Apple when you delete your account
3.2 Health data (special category)
- sex, height and weight
- drink entries: the type, name, quantity, unit, volume and strength of the drink, when you had it, and if you add them: its price, your note, who you were with (alone or with others) and your mood
- the close of the day: whether it was alcohol-free or you drank, the "alcohol-free tomorrow?" intention, and your daily note if you write one
- your own goals: weekly unit cap, number of alcohol-free days a week, streak goal
- if you switch it on: the fact and start date of a pregnancy or of trying for a baby (pregnancy mode)
- values computed from the above: alcohol units, daily, weekly and monthly totals, daily zones (moderate, high, excessive), streaks, alcohol-free days, money spent and calories, the sobriety forecast (estimated from your weight and sex) and the morning message
- weekly and monthly reports: the figures of the closed week or month and the observations drawn from them (for example which day carried the most), the written summary by AI if you switched it on, and when you first opened the report from the link in the email
3.3 Motivation data
Experience points, level, badges, personal records, the points log, weekly quests and monthly challenges. These are computed from your journal, so we treat them exactly like health data.
3.4 Subscription data
If you buy a Sippa+ subscription: the product (monthly or yearly), the expiry, whether it renews, whether you are in a trial, whether there is a billing issue, which app store you bought it in, whether and when you subscribed at the early-bird price, and the subscription's events (such as start, renewal, cancellation, with their time). Your account is represented towards RevenueCat by a random identifier. We neither see nor store card details.
3.5 Settings
Whether reminders are on and at what time, and the switches for the report emails, the written summary and offers. Reminders are sent by your phone as its own notifications; we use no external push service for them.
3.6 Technical data
- a session cookie and a sign-in token, so you do not have to sign in every time
- IP address and browser identifier in the server logs, for operations and security
- days of use: on which day you used the app, on which surface (web, iOS, Android) and with which version. One record per day, containing nothing about your drinking.
- at registration, the Cloudflare Turnstile verification token, to filter out automated sign-ups
3.7 If you write to us
The content of your email and our reply. If you make a complaint, we keep the complaint and our answer as consumer protection law requires (see section 10).
4. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account, signing in (by email, Google or Apple) | account data, technical data | Performance of a contract: Art. 6(1)(b) GDPR |
| Enforcing the minimum age | date of birth, country | Performance of a contract: Art. 6(1)(b) GDPR |
| The core service: the journal, totals, goals, the sobriety forecast, the morning message and feedback | health data | Explicit consent: Art. 9(2)(a) GDPR |
| Motivation features: points, levels, badges, quests, challenges | motivation data (computed from the journal) | Explicit consent: Art. 9(2)(a) GDPR |
| Weekly and monthly reports and observations in the app | health data | Explicit consent: Art. 9(2)(a) GDPR |
| Weekly and monthly email about your report (on by default; one tap turns it off in your profile or at the bottom of every email) | email address, first name, the report's figures and one observation | Explicit consent: Art. 9(2)(a) GDPR |
| Written summary by AI (Sippa+; off by default, produced only after you switch it on yourself) | the report's aggregated figures (see the Anthropic row in section 8) | Separate explicit consent: Art. 9(2)(a) GDPR |
| Pregnancy mode: adapting goals and messages (any alcohol counts as over the limit) | the fact and start date of the pregnancy | Separate explicit consent: Art. 9(2)(a) GDPR |
| Sippa+ offers and news by email (off by default) | email address, first name, language, subscription state | Consent: Art. 6(1)(a) GDPR |
| Managing and verifying the Sippa+ subscription | subscription data | Performance of a contract: Art. 6(1)(b) GDPR |
| Country-specific content: helplines, the national rules for drink units and drinking age | country | Performance of a contract: Art. 6(1)(b) GDPR |
| Preventing abuse and automated sign-ups | IP address, verification token | Legitimate interests: Art. 6(1)(f) GDPR |
| Security, debugging, operations, backups | technical data; in the backup, all stored data | Legitimate interests: Art. 6(1)(f) GDPR; health data in a backup stays under the same consent as the original |
| Aggregate statistics to improve the service (such as users per country), in a form that cannot be traced back to individuals | country, account and usage data, subscription events | Legitimate interests: Art. 6(1)(f) GDPR |
| Support: if you ask for help, we look up your account data in the operator's admin panel (name, email, country, language, subscription, last day of use). Nobody sees health data there, only aggregates that cannot be traced back to individuals. | account data, days of use, subscription data | Legitimate interests: Art. 6(1)(f) GDPR |
| Logging admin actions (who changed what on which account, and when) | the action, the admin's IP address | Legitimate interests: Art. 6(1)(f) GDPR |
| Handling complaints and data protection requests | the complaint or request and our reply | Legal obligation: Art. 6(1)(c) GDPR |
Where we rely on legitimate interests, our interest is running and improving the service securely and reliably. You can object to it (see section 11).
5. What happens if you do not provide your data
No law requires you to provide any of this data. To enter into the contract, however, we need your email address (or Google or Apple sign-in) and your date of birth: without them we cannot open an account or check the minimum age.
Without consent to the processing of health data you cannot log a drink or a day, because the journal itself is health data. Height, weight and sex are optional; without them the sobriety forecast does not work, or works less precisely. Pregnancy mode, the written summary and offers are each a separate, voluntary choice: if you do not switch them on, only that feature is missing.
6. Profiling and automated decisions
The app evaluates your entries automatically to give you feedback: it computes daily zones, trends and patterns (such as which weekday carries the most), writes observations from them, and if your journal shows heavy drinking over several days, it shows you where to find support. Under the GDPR this is profiling. Its only purpose is to help you see your own data more clearly, and it rests on your explicit consent.
We do not take any decision about you based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). Nothing is refused to you and no price is personalised on this basis. The heavy-drinking pattern is not stored as a label: it is computed only when it is needed to show the support information.
7. Withdrawing consent
You can withdraw each consent as easily as you gave it. Withdrawal does not affect the lawfulness of earlier processing.
| What you consented to | How to withdraw | What happens |
|---|---|---|
| Processing of health data (the journal) | Profile → Privacy and help → Delete account, or write to hello@sippa.io | The journal cannot work without it, so withdrawal means deleting your account and all your data. You can download your backup first, free of charge. |
| Pregnancy mode | Profile → Body details → the pregnancy mode switch | The mode switches off and goals and messages return to normal. |
| Written summary by AI | Profile → Notifications → the "Written summary by AI" switch | From the next report on we send nothing to Anthropic. Summaries already written stay in your reports. |
| Weekly and monthly report by email | Profile → Notifications, or the unsubscribe link at the bottom of the email | We send no more report emails; the reports stay available in the app. |
| Sippa+ offers and news by email | Profile → Notifications, or the unsubscribe link at the bottom of the email | Offers stop at once and we erase the time of your consent. |
8. Who receives your data
We use the following providers to run the service. Processors may handle your data only on our instructions and under the data processing terms we have with them (Article 28 GDPR). Apple and Google act as independent controllers for sign-in and in their app stores, under their own privacy policies.
| Provider | What it receives | Why |
|---|---|---|
| Vultr: The Constant Company, LLC (319 Clematis Street, Suite 900, West Palm Beach, FL 33401, USA); the server runs in Warsaw, Poland | all stored data | hosting the server and the database |
| Ploi (Amperestraat 16J, 3861 NC Nijkerk, the Netherlands; KvK: 94117233) | access to the server, and so technically to the data stored on it | managing the server and deploying new versions |
| Neon, LLC (part of the Databricks group, USA); the data is in Frankfurt, Germany | a backup copy of the whole database | off-site backup with a second provider |
| Cloudflare, Inc. (USA) | all traffic to sippa.io (IP address, technical request data); at registration, the Turnstile verification token | serving and protecting the traffic, deriving the country from the IP address, filtering out automated sign-ups |
| Resend: Plus Five Five, Inc. (USA) | email address, first name and the content of the email (such as your report's figures) | delivering system emails, report emails and, if you asked for them, offers |
| RevenueCat, Inc. (USA) | if you buy Sippa+: your random identifier and the subscription details (product, purchase and expiry time, app store, country, currency). No name, email address or health data. | managing and verifying the App Store / Google Play subscription |
| Anthropic, PBC (USA) | Only with Sippa+, and only if you switched the written summary on: the report's aggregated figures. For the weekly recap: units this week and last week, your own weekly cap, drinking and alcohol-free days (also for the week before), your own alcohol-free-day goal, your current and longest alcohol-free streak, and the week's heaviest day (weekday name and units). For the weekly and monthly report: the first day of the week or month, units for this and the previous period, the number of alcohol-free, moderate, high and excessive days, how the period ranks among your lightest, and which weekday carried the most. Alongside: the language and the report's internal number, from which only we can find the account. No name, email address, note or individual entry. | writing the report's written summary with the AI model Claude |
| Apple Distribution International Ltd. (Ireland), as an independent controller | for Apple sign-in: your Apple identifier and email address (or Apple's relay address); on account deletion, the revocation request | signing in with Apple; in the App Store, Apple handles the purchase, the payment and refunds |
| Google: Google Ireland Ltd. and Google LLC | for Google sign-in, we receive your Google account identifier, email address, name and profile picture link; when fonts load, Google receives your IP address | signing in with Google; displaying the site's fonts (Google Fonts) |
Under its commercial terms Anthropic may not train models on customer content, and by default it deletes API inputs and outputs within 30 days. Its terms allow longer retention where needed to enforce its usage policy or required by law.
We disclose data to an authority or court only where the law requires it.
9. Transfers outside the European Union
Your data is stored in the EU (Warsaw, Frankfurt). Several of our providers are, however, US companies or belong to a US parent, so your data may be transferred to, or be accessible from, the United States. In those cases we rely on these safeguards:
| Provider | Safeguard |
|---|---|
| Vultr (The Constant Company, LLC) | the European Commission's Standard Contractual Clauses (SCCs, Art. 46 GDPR) |
| Neon, LLC | EU-U.S. Data Privacy Framework (DPF), adequacy decision (Art. 45 GDPR) |
| Cloudflare, Inc. | EU-U.S. Data Privacy Framework (DPF) |
| Resend (Plus Five Five, Inc.) | EU-U.S. Data Privacy Framework (DPF) |
| RevenueCat, Inc. | Standard Contractual Clauses (SCCs) |
| Anthropic, PBC | Standard Contractual Clauses (SCCs) |
| Google LLC | EU-U.S. Data Privacy Framework (DPF) |
| Apple | In the EU the controller is Apple Distribution International in Ireland; Apple's own transfers are covered by Standard Contractual Clauses. |
You can ask for information about these safeguards, or a copy of the SCCs, at hello@sippa.io.
10. How long we keep it
- Account data, journal, goals, settings, motivation data: for as long as your account exists. You can delete your account in the app at any time (Profile → Privacy and help → Delete account). Deletion is immediate and permanent: your data leaves the live database at once and cannot be restored.
- Weekly and monthly reports: for 24 months from the start of the period, or until you delete your account, if sooner.
- Backups: the server makes a local backup every three hours, and a copy goes to Neon that every run overwrites. Backups are kept on a 14-day rotation, so deleted data disappears from the backups within 14 days at the latest. Backups are used only to recover from an outage.
- Server logs: 14 days.
- Subscription events: events tied to an account live as long as the account. On deletion they are detached from it, and events that can no longer be tied to an account are deleted after 90 days. On deletion we also ask RevenueCat to erase the customer record. Apple or Google keep records of your purchases under their own rules.
- Consent to offers: until you withdraw it, or for as long as your account exists.
- Admin action log: 2 years.
- Complaints and our replies: 3 years (Hungarian Consumer Protection Act, section 17/A).
- At Anthropic: the figures sent for the written summary, by default for up to 30 days (see section 8).
We issue no invoices, because the Sippa+ fee is collected by Apple or Google; they keep the accounting records.
11. Your rights
- Access: you can ask for a copy of the data we hold about you.
- Rectification: you can correct most of your data yourself in the app; we correct the rest on request.
- Erasure: you can delete your account and all your data yourself, instantly, in the app.
- Restriction: you can ask us to restrict processing.
- Portability: anyone can download their full backup (a JSON file: profile, goals, entries, alcohol-free days, reports) free of charge, without a subscription: Profile → Your data → Download backup. The CSV export is a Sippa+ convenience; you do not need it for portability.
- Objection: you can object to processing based on legitimate interests.
- Withdrawing consent: at any time, as described in section 7.
Send your request to hello@sippa.io. We answer free of charge within one month at the latest. We may extend this only where justified, by up to two further months, and we tell you so within the first month. If we need to confirm it is you, we ask for an email from the address on your account.
12. Where to complain
If you feel we have breached your data protection rights, please write to us first; we may be able to put it right quickly. You can also complain to the supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), the Hungarian data protection authority
1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Web: naih.hu
If you live in another EU country, you can also turn to the data protection authority where you live. You can also go to court: in Hungary you may bring the claim before the regional court of your place of residence.
13. Security
Passwords are stored with one-way encryption and the connection is encrypted (HTTPS). Only the application can reach the database, the backup directory is readable only by the operator's system user, and the admin panel requires two-factor authentication and shows no health data. Even so, no system can be considered one hundred per cent secure. If a breach affecting your data is likely to put you at high risk, we will tell you without undue delay.
14. Cookies and local storage
The web app uses a session cookie to keep you signed in, and the mobile app keeps its sign-in token on your phone. These are necessary for the service to work and need no separate consent. We use no analytics or advertising cookies. Fonts are loaded from Google Fonts, so your browser connects to Google when they load.
15. Children
The service is only for people aged 18 or over. We do not knowingly process data about anyone under 18. If we find any, we delete it.
16. Changes to this policy
If we change this policy materially, we tell you in the app or by email before the change takes effect. If a change needs new consent, we ask for it separately. Earlier versions are available on request.