Privacy Policy
Plain English. Last updated 31 July 2026.
ADHV is built for people who are already carrying enough. We collect as little as we can, we never sell your data, and we never use it to train AI models. Here is exactly what happens to it.
Who we are
ADHV is a trading name of Harry Varvel, the data controller for the personal data described here. We are registered with the UK Information Commissioner's Office under registration reference ZC213841. Contact: harryvarvel@gmail.com. You can also reach us about anything in this policy at that address.
What we collect, why, and our lawful basis
| Data | Why | Lawful basis |
|---|---|---|
| Your email address | To create your account and send magic sign-in links | Contract |
| Tasks, steps, plans, routines, ideas, journal and other things you type | To give you the feature you asked for and let you come back to it | Contract |
| Focus sessions and timing | So the app can learn how long things really take you | Contract |
| Social content: your handle, wins, comments, reactions, messages | To run the Activity Center for you and the people you choose | Contract |
| Daily usage counts; a one-way hash of your IP address when signed out | To apply free limits and prevent abuse. We never store the IP itself | Legitimate interests (protecting the service) |
| Reports, blocks and moderation records | To keep the social spaces safe and meet our online-safety duties | Legitimate interests / legal obligation |
| Plan status and a Stripe customer ID | To give you Pro and manage billing | Contract |
| Error logs (no message content) | To find and fix faults | Legitimate interests |
We do not ask for, and you should not enter, health information, diagnoses, or anyone else's personal details. Some people naturally write about how they're feeling; that text is treated with the same care as everything else, is never sold or used for advertising, and is deleted when you delete it.
Parents Mode — no data about your child
Parents Mode is built so we hold no data about your child on our servers. The optional nickname, the age band, the reward chart and your private “wins about my kid” notes stay only on your device and are never sent to us. We never profile, track, or advertise to children, and the shared-screen kid tools send no analytics whatsoever. It all clears in one tap, and automatically when you sign out or delete your account.
When you ask the parenting coach for a plan, we send only the age band and the words you typed — never a name or any identifier.
Who we share it with (our processors)
We use a small number of carefully chosen suppliers. Each processes data only on our instructions, under a data-processing agreement.
- Supabase — database, sign in, and file storage (EU region).
- Vercel — hosting and serving the app.
- Google (Gemini API) — the AI that generates your steps. Your text is sent to generate a response and is not used to train Google's models under the paid API terms.
- Stripe — payments. Stripe handles your card details directly; we never see them.
- Resend — sending your sign-in emails (EU region).
- PostHog — privacy-friendly, cookieless product analytics, if enabled. No advertising, no cross-site tracking, and nothing at all on kid-facing screens.
We never sell or rent your data, and we don't share it with advertisers. We may disclose data if the law requires it, or to protect someone's safety.
Where your data goes
Data is stored in the UK/EU where possible. Some suppliers are based in the United States; where data is transferred outside the UK it is protected by the UK International Data Transfer Agreement or equivalent standard contractual clauses in that supplier's data-processing agreement.
How long we keep it
We keep your account data for as long as your account exists. When you delete your account, your data is deleted immediately and permanently. Some limited records are kept a little longer where we must: billing records for 6 years (tax law), and moderation reports for up to 12 months so repeat problems can be spotted. Anonymous usage counters roll off after 30 days. Nothing you type is retained by us after you delete it.
Your rights (UK GDPR)
You have the right to:
- see the personal data we hold about you;
- have it corrected if it's wrong;
- have it deleted (“right to be forgotten”);
- get a copy in a portable format;
- object to, or ask us to restrict, certain processing;
- withdraw consent where we rely on it.
The fastest route for most of these is your account page, which has a Delete my account & data button that removes everything straight away. For anything else, email us and we'll respond within one month.
If you're unhappy with how we've handled your data you can complain to the ICO at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first.
Cookies and tracking
We use only strictly necessary cookies — the ones that keep you signed in and remember your theme. We use no advertising cookies and no cross-site tracking. Our analytics, when enabled, run in cookieless mode. Kid-facing screens contain no analytics, no trackers, no external links and no ads.
Keeping it safe
Every table has row-level security so your rows are readable only by you. Files are stored in private buckets and served through short-lived links. Traffic is encrypted in transit. We limit who can access production systems. If a breach ever put your rights at risk, we'll tell the ICO within 72 hours and tell you without undue delay.
Children
ADHV is for adults: you must be 18 or over to hold an account. We don't knowingly collect data from children, and Parents Mode is deliberately designed so that no child data ever reaches us. If you believe a child has created an account, please email us and we'll remove it.
Changes
If we change this policy in a way that materially affects you, we'll tell you in the app or by email before it takes effect.
ADHV is a self-management tool, not therapy or medical advice.