Privacy Policy

1. Controller

The controller responsible for processing personal data (as defined by the GDPR) is:

David Kerscher
Beethovenstraße 11
85101 Lenting, Germany
Email: David@juststop.app

2. What data we collect

2.1 Launch-list email (website)

If you enter your email in the signup form on this site, we store it to send you a single launch announcement. We use double opt-in: after you submit, we email you a confirmation link, and your address only joins the list once you click it. We do not use it for anything else, and we do not share or sell it. The email is stored in our backend (see §3, Supabase).

• Purpose: One-time launch notification.
• Legal basis: Art. 6(1)(a) GDPR — your consent, given by submitting the form and clicking the confirmation link we email you.
• Retention: Until you unsubscribe, or 24 months after launch — whichever comes first.

2.2 Account (app & browser extension)

If you create a Just Stop account, we process your email address and password. Passwords are never stored in plain text — they are hashed and managed by our authentication provider (Supabase Auth).

• Purpose: Create and secure your account; sync your settings across devices.
• Legal basis: Art. 6(1)(b) GDPR — performance of our service to you.
• Retention: Until you delete your account.

2.3 Your block settings & activity (app & extension)

So your protection works across devices, we store, linked to your account: the categories and custom sites you block, your daily-access pass state, a log of blocked attempts (the blocked domain and a timestamp) that powers your stats, and a presence signal from the browser extension (a "last seen" timestamp used to detect whether the extension is active).

• Purpose: Deliver the blocking service, sync it across your devices, and show you your own progress/stats.
• Legal basis: Art. 6(1)(b) GDPR (service), and — because using a gambling-recovery tool may reveal information about your health — your explicit consent under Art. 9(2)(a) GDPR, given when you create your account and enable blocking.
• Retention: While your account is active; deleted when you delete your account.

2.4 Accountability allies (optional)

If you add an "ally," we store the email address you provide for that person and, when you request an unlock, we send them an email with approve/deny links. Please only add an ally who has agreed to this. The ally can ignore the email and is not enrolled in anything.

• Purpose: Let a trusted person approve or deny your unlock requests.
• Legal basis: Art. 6(1)(a)/(b) GDPR — your request to use the feature.
• Retention: Until you remove the ally or delete your account.

2.5 Stays on your device — NOT collected by us

Some data is processed only locally on your computer and is never transmitted to us:

• Payment self-exclusion details (card numbers, IBAN, the contact info you enter for self-exclusion requests) — stored only in the app on your PC, used solely to fill the request you choose to send yourself.
• Which window/app is in the foreground — the app checks this locally to detect whether you are using a browser without the extension. This check happens on your device and is not sent to us or stored.

2.6 Server log files

Our hosting providers automatically process minimal access data when you use the site or app — including your IP address, browser/client type, the resource requested, and a timestamp. This is standard and necessary to deliver any online service.

• Purpose: Security, uptime, and technical fault analysis.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in a secure, functioning service.
• Retention: Typically up to 14 days, then deleted, per the providers below.

2.7 Cookies and local storage (website)

We use exactly two storage items. No analytics, advertising, tracking, or third-party cookies.

• js_consent_v1 (cookie, strictly necessary) — records your choice on our cookie banner. Lifetime: 12 months. Legal basis: Art. 6(1)(f) GDPR — needed to remember your consent decision.
• jstheme (localStorage, functional, opt-in only) — remembers light/dark mode. Only stored if you accept "Functional." Legal basis: Art. 6(1)(a) GDPR — your consent.

Change your cookie preferences anytime via "Cookie settings" in the footer.

3. Processors & recipients

We share data only with service providers who process it on our behalf under a data-processing agreement (Art. 28 GDPR). We do not sell data, and we use no advertising networks.

• Supabase (Supabase Inc.) — backend database, authentication, and storage of your email, account, and block settings. Our project is hosted in the EU region (Frankfurt, Germany). Privacy: supabase.com/privacy.
• Hostinger (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus) — hosts this website. Privacy: hostinger.com/legal/privacy-policy.
• Hostinger Email (Hostinger International Ltd.) — delivers the emails sent from David@juststop.app (launch notification, ally approval requests, and the self-exclusion requests you choose to send). Same provider/privacy terms as the website host above.

International transfers: Supabase Inc. is a US-based company, but your data is stored on EU-based infrastructure. Where any provider may process data outside the EU/EEA, this is covered by an Art. 28 data-processing agreement and the European Commission's Standard Contractual Clauses (Art. 46 GDPR).

4. Health-related data

Just Stop is a harm-reduction tool for gambling. The fact that you use it, and your block/activity data, may indirectly reveal information about your health (a "special category" under Art. 9 GDPR). We therefore process this data only on the basis of your explicit consent, keep it to the minimum needed to provide the service, never use it for profiling or advertising, and never share it beyond the processors listed above. You can withdraw consent and delete this data at any time by deleting your account.

5. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15): Ask us what data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate data.
• Right to erasure (Art. 17): Request deletion of your data.
• Right to restriction (Art. 18): Limit how we process your data.
• Right to data portability (Art. 20): Receive your data in a portable format.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time, without affecting past processing.
• Right to lodge a complaint (Art. 77): Complain to a supervisory authority. For Germany, find your responsible state authority at bfdi.bund.de.

To exercise any right, email David@juststop.app. We aim to respond within 30 days.

6. Security

Traffic to this website and between the app and our backend is encrypted with HTTPS/TLS. Your account and settings are stored on Supabase's EU-based infrastructure with access controls (row-level security) so each account can only reach its own data. We apply reasonable technical and organizational measures, but no system can guarantee absolute security.

7. Children

Just Stop is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a minor has provided us data, contact us and we will delete it.

8. Changes to this policy

If we materially change how we handle personal data, we'll update this page and the "last updated" date. For substantial changes affecting people on our launch list or with accounts, we'll also notify by email.