Privacy Policy

Last updated: August 22, 2026

Dopa Break exists to protect your attention, and that starts with respecting your data. This policy is written in plain language on purpose. If anything here is unclear, ask us and we will fix the wording.

Who is responsible for your data

Dopa Break is built and run by its founder, a sole trader in Pakistan trading as Dopa Break. That means a single, real person is the data controller for everything described on this page, and that same person reads [email protected] and answers the Contact page. There is no parent company and no data broker in the background.

What data does Dopa Break collect?

Three kinds, and nothing else:

• Your account. Your email address and your name, so you can sign in and so the app can greet you.
• Optional profile details. Age, gender, country, your reason for being here and your goal. Every one of these is optional and the app works without them. They exist so the practice you are offered fits you.
• Your practice records. Training sessions, resets, rituals, meditation sits, attention checks, reflections and check-in notes, reminder preferences, and your timezone so reminders arrive at your local time.

Technical data arrives too, because it cannot not: your device type, browser, and approximate country. Our analytics provider is configured to discard your IP address after working out the country, so we never store it.

Why we are allowed to hold it

Under GDPR language: your account and practice records are processed to deliver the service you signed up for (contract). Security, abuse prevention and basic product analytics rest on our legitimate interest in keeping the app working and safe. Push reminders run on your consent, given when you switch them on and withdrawn when you switch them off.

Does Dopa Break sell my data?

No. We never sell your personal data. We never rent it, and we never share it for anyone else's advertising. We show no ads inside the app. There is no feed, no engagement algorithm, and no interest in keeping you on screen a second longer than your practice takes. Our Learn articles may carry advertising in future; if that ever happens this page will be updated first to say exactly what runs where, and the app itself stays ad-free regardless.

Who can see my check-in notes?

You, and nobody else through the app. Your records are protected by row-level security in the database, which means the database itself refuses to return your rows to any account but yours. Your notes, reflections and check-ins are never sent to any analytics service, and we do not record your screen. We ran session replay briefly during development, found it could capture on-screen text, and turned it off before launch rather than leave it running.

In practice a very small number of people could reach the raw database: the founder, and the infrastructure providers listed below under their own contracts. We read individual records only when you ask us to look at something, or when we have to investigate abuse.

Which companies process your data

Running an app means trusting a few suppliers. Here is the complete list and what each one does:

• Supabase stores the database and handles sign-in. United States.
• Vercel hosts the website and app, and provides basic traffic counts. United States.
• Cloudflare delivers the site quickly and absorbs attacks, and reports aggregate traffic.
• Resend sends the transactional emails: confirm your address, reset your password. Nothing else.
• PostHog counts anonymous product events, such as how many people finished onboarding. Configured with no cookies, no autocapture, no session recording, and IP addresses discarded. United States.
• Google receives nothing unless you choose "Continue with Google" to sign in, in which case Google confirms your email address to us.

Because these providers and the founder sit outside the UK and the European Economic Area, your data is transferred and processed internationally, including in the United States and Pakistan. If that matters to you, this paragraph is the one to weigh.

Where your data lives

Your data is stored with Supabase (our database provider) protected by row-level security, which means your records are technically readable only by your own logged-in account. Progress data (like your meditation program day and your daily check-ins) is kept on your device as well, so the app keeps working offline, and it is also saved to your account so your progress follows you when you sign in on another device. The only things that stay on your device and never leave it are small interface preferences, such as your theme choice or whether you have already dismissed a one-off tip.

Does Dopa Break track me across other sites?

No. There are no advertising trackers and no cross-site profiling. The app stores what it needs to keep you signed in, plus your theme choice, plus the on-device copy of your progress described above. Our analytics runs without cookies and cannot follow you anywhere else.

Reminders and notifications

If you enable the daily reminder, your browser or device stores a push subscription so we can send at most one gentle reminder per day at the time you chose. Turning reminders off deletes that subscription. Browser vendors require us to give them a contact address so they can reach us about push delivery; that address is [email protected].

How long is it kept?

Your account and practice records are kept until you delete your account, then they are gone. Messages sent through the contact form are kept until the conversation is finished. To stop the contact form being abused we store a one-way scrambled fingerprint of the sender's IP address for 24 hours, which cannot be turned back into an address, and it is deleted automatically.

Can I delete everything?

Yes, yourself, in one tap. You can permanently delete your account and every server-side record from Settings, no email required, no retention tricks. Deletion is immediate and irreversible, it removes your profile, all your sessions, checks, reflections, saved state and reminder subscriptions, and it also clears the copy held on the device you deleted from.

Your rights

You can ask us to show you a copy of your data, correct it, delete it, send it to you in a portable file, or stop a particular use of it. Deletion you can do yourself from Settings; for anything else email [email protected] or write through the Contact page and we will reply. If you live in the UK or the European Economic Area you also have the right to complain to your national data protection authority, and you do not have to speak to us first.

How your data is protected

Passwords are hashed and never stored in a form we can read. Everything travels over an encrypted connection. The database enforces row-level security so one account cannot reach another's rows, and the app holds no administrative keys. We audit this rather than assume it: the most recent review was August 2026, and its findings are what produced this version of the page.

Children

Dopa Break is for people aged 13 and over, as set out in our Terms of Use. We do not knowingly collect data from anyone younger. If you believe a child has created an account, tell us and we will delete it.

Is Dopa Break safe to use?

On data, that is what this whole page is for: nothing sold, nothing recorded, everything deletable by you. On the practice itself, Dopa Break is a self-guided wellbeing tool and not a medical device; our Terms of Use set out those limits honestly, and our mission explains why we built it this way.

Changes to this policy

If what we do changes, this page changes first, and the date at the top changes with it. We will not quietly widen what we collect and tell you afterwards.

Contact

Questions about your data? Email [email protected] or reach us through the Contact page, and a human will reply. You can also read more about who builds this.