Clarmo Privacy Policy
Version 1.3. Last updated: October 8, 2026.
Clarmo is an app to help you quit porn. To help, it needs to keep very personal things: how each day went, your urges, what you write in your journal and in the chat. This policy explains what we keep, why, who it is shared with and how to delete it. We wrote it to be understood; if anything is unclear, write to [email protected].
1. The essentials
- Clarmo is only for people aged 18 or over.
- Your health and sex-life data (check-ins, urges, journal, SOS sessions, chat) is only stored with your explicit consent, which we ask for before you pay.
- We do not sell your data, show ads, or use analytics or tracking tools.
- The AI is optional. The chat and notes run on a model by Anthropic only if you accept it separately; Anthropic does not use your data to train its models.
- You can delete your account in the app at any time, and everything on our servers goes with it.
2. What we process and why
2.1 Your account
- Email (or Apple’s anonymous address if you use “Hide My Email”), your account ID and how you sign in (Apple, Google, or email and password). We never see your password; our authentication provider stores it encrypted.
- The name you type at the start, to greet you. If you sign in with Apple or Google, we do not keep your photo or your full name from that account: we discard them as soon as they arrive. We only keep your email and the ID that signing in needs.
- Your phone’s language and time zone, to speak your language and count your days and the renewal notice correctly.
- If you sign in with Apple, an Apple token used only to revoke Clarmo’s access to your Apple account when you delete yours, as Apple requires.
Why: to create and run your account and provide the service.
2.2 The opening questionnaire
Your answers to the first questions (age, how long, how often, triggers, how it affects your life and intimacy, your motivation). They are used only on your phone to tailor the plan and the wording.
They are never sent to our servers or to the AI. They are deleted from your phone when you subscribe or sign out; if you leave sign-up halfway, they stay only on your phone until you uninstall the app.
2.3 Your progress
- Daily check-ins: day type (clean, slip or relapse), mood, feelings, urge intensity, what was going on or what helped, and anything you write under “Other”.
- Journal: the text you write in the check-in.
- SOS sessions: when you open them, the intensity at the start and the end, the tool and exercise you used, and whether it helped.
- Your goal (full commitment or gradual reduction) and the achievements you earn.
Why: to track your streak, show your stats, recommend SOS tools and give the AI context to help you.
2.4 The chat and Clarmo’s notes
- Chat conversations: what you write and what Clarmo replies.
- Weekly notes Clarmo writes on your stats.
- An AI usage log: when it was used, what it cost and a code derived from your IP address with a secret key (a “keyed hash”; we do not store the IP), only to enforce usage limits and prevent abuse. That code is deleted after 2 days.
More in How Clarmo’s AI works (clarmo.app/ai).
2.5 Your subscription
Your subscription status (active, expired, billing issue), the plan and renewal dates, which we receive from RevenueCat. We never see or store your payment details: Apple or Google handle the payment.
We also keep proof that we sent you the legally required notice before renewal (when it was sent and for which renewal), without storing your email address in that record.
2.6 Support and bug reports
If you write to us from Contact support or Report a bug, we keep the topic, your message and technical details of the phone (app version, operating system, model and language) so we can answer or fix it. We reply to your account email. If your message tells us something about your health or sex life, we use it only to answer you, under the same explicit consent as in section 3.
2.7 Crash reports
If the app crashes, a technical report goes to Sentry (version, system, where in the code it failed) without your identity, your IP, or the content of what you wrote.
2.8 What stays on your phone only
Your PIN and lock settings, which reads you marked as read, whether you took the PIED test (the result is never stored anywhere), notification preferences and your chosen language. Reminders are local notifications: your phone schedules them without any server, and they never show personal details on the lock screen.
2.9 What we don’t do
No ads, analytics, tracking cookies, location, contacts or photos. You can turn on screenshot blocking inside the app in Profile → Privacy & lock.
2.10 This website
Our website, clarmo.app, uses no cookies, analytics or tracking tools, and has no forms. Our hosting provider, Cloudflare, processes your IP address only to show you the pages and to protect the site from attacks, based on our legitimate interest in keeping it working and secure (Art. 6(1)(f) GDPR).
3. Legal basis
| Data | Legal basis |
|---|---|
| Account, subscription, support | Performance of the contract (Art. 6(1)(b) GDPR) |
| Progress, journal and SOS (health and sex-life data), and anything about them you tell us in a support message | Your explicit consent to process your data (Arts. 9(2)(a) and 6(1)(a) GDPR) |
| Chat and AI notes (the same data, processed with AI) | Your separate explicit consent for the AI, which is optional (Arts. 9(2)(a) and 6(1)(a) GDPR) |
| Pre-renewal notice | Legal obligation (Art. 6(1)(c) GDPR; Art. 97.1.p of the Spanish consumer protection law) |
| Minimal proof of your consent after you delete your account (section 5) | Legal obligation to be able to demonstrate consent and handle claims (Arts. 5(2), 7(1) and 6(1)(c) GDPR; Art. 32 of the Spanish data protection act, LOPDGDD) |
| Security, usage limits and crash reports | Legitimate interest in keeping the service safe and working (Art. 6(1)(f) GDPR). You can object (section 6) |
Before paying you see two unticked boxes: one to process your data, needed to use Clarmo, and an optional one for the AI. There you also confirm you are 18 or over. We record on our server what you accepted and what you did not, the version of the text and the date, before anything is charged.
Clarmo does not profile you for commercial purposes and makes no automated decisions with legal effects on you.
Withdrawing consent
You can withdraw it at any time, without affecting what was processed before.
- Consent for the AI: turn it on or withdraw it at any time in Profile → My data & consent. When withdrawn we stop sending your data to the AI; the chat and notes turn off and the rest of the app works as before.
- Consent to process your health data: Clarmo cannot work without it, so withdrawing it means deleting your account (section 6).
4. Who it is shared with
We do not sell or hand over your data. Only these providers process it, on our behalf and under contract:
| Provider | Purpose | Where |
|---|---|---|
| Supabase | Database, authentication and server functions | Frankfurt (EU) |
| Anthropic | The AI model behind the chat and notes | United States |
| RevenueCat | Subscription management. It receives your account ID (never your email or health data) and, from the store, your Clarmo purchase history, your store country and the IP address you buy from | United States |
| Resend | Sending email (password reset, renewal notice). It keeps sent emails for 30 days | United States |
| Sentry | Crash reports, without your identity | EU |
| Hostinger | Support and privacy mailbox | EU company (Cyprus) |
| Cloudflare | Hosting of the website clarmo.app. It processes your IP address to serve the pages | United States (worldwide network) |
Apple and Google act as independent controllers when you pay in their stores or sign in with their account; their own privacy policies apply.
We have a data processing agreement with each of them (Art. 28 GDPR).
Transfers outside the EU
Anthropic, RevenueCat and Resend are in the United States, and Supabase and Sentry are companies based outside the EU even where they store data here. Every transfer relies on the European Commission’s Standard Contractual Clauses (Decision 2021/914), which are part of the agreement with each provider. Resend and Sentry are also certified under the EU-U.S. Data Privacy Framework. Cloudflare, in the United States, is certified under it too, and its data processing agreement includes the Standard Contractual Clauses. If any data from the Hostinger mailbox leaves the European Economic Area, the clauses cover it too. We have assessed each of these transfers in writing.
5. How long we keep it
- While you have an account. Deleting it erases your data from our database at once (section 6), except the minimal proof below.
- Minimal proof after deletion: we keep separately, locked and for 3 years, only what is needed to prove what you agreed to: the account ID, a code derived from your email (not the email), which consents you gave and when, your statement that you are an adult, the deletion date and the renewal notices sent. No health data.
- If you stop subscribing: if your subscription ends and you do not use Clarmo again for 24 months, we delete your account. We email you 30 days before.
- If you delete your account while the subscription is still active: deleting the account does not cancel the subscription and the store will keep charging it. So that we can send you the legally required notice before the next renewal, we keep your email, the store, the plan, the date of that renewal and your last payment until that renewal has passed (plus 7 days), and then delete them. No health data.
- Chat conversations: you can delete each one in the app whenever you like.
- Unfinished accounts: if you created an account but never subscribed, we delete it automatically after 30 days of inactivity.
- Support messages: 12 months after we answer them. Bug reports you send from the app: 6 months.
- Backups: deleted data may remain in our provider’s backups until they expire, at most 7 days.
- Sign-in logs at our authentication provider (which may include your IP): deleted after 7 days.
- Anthropic may keep what we send for a limited time for safety and abuse prevention: it deletes it within 30 days, unless its automated systems flag a possible breach of its usage policy. In that case it may keep those conversations for up to 2 years and its safety systems’ scores for up to 7 years, and for that retention Anthropic acts as a controller in its own right, under its own privacy policy.
- Sent emails at Resend: 30 days.
- Crash reports at Sentry: deleted after 30 days.
6. Your rights
You can access, correct and delete your data, object to or restrict its processing, ask for a portable copy, and withdraw consent.
- Download a copy of your data: in the app, under Profile → My data & consent → Download my data. You get a file with everything on our servers about your account, in a format you can take to another service.
- Delete your account and all your data: in the app, under Profile → Delete account. It is erased at once, except the minimal proof in section 5. Deleting your account does not cancel your subscription: do that in Apple’s or Google’s subscription settings.
- Anything else (correct, restrict, ask what we hold): write to [email protected] from your account email, or use Profile → Contact support → Privacy. We reply within one month.
Right to object. You can object at any time, on grounds relating to your particular situation, to what we process on the basis of legitimate interest (security, usage limits and crash reports). Write to [email protected] and we will stop unless there are compelling legitimate grounds that override yours or we need it to defend a legal claim.
If you think we have mishandled your data, you can complain to the Spanish Data Protection Agency (www.aepd.es) or the authority in your country.
7. Minors
Clarmo is only for people aged 18 or over. If you say at the start that you are under 18, we delete the account right away and do not keep your answers (if there is no connection, it is deleted automatically within 30 days). If we learn some other way that an account belongs to a minor, we delete it too.
8. Security
Your data is encrypted in transit and at rest. Each account can only read its own data, with rules enforced in the database itself. On your phone you can protect Clarmo with a PIN or Face ID / fingerprint, and turn on screenshot blocking in Privacy & lock. If a breach affects your data, we will tell you and the authority within the legal deadlines.
9. Who is responsible
The data controller is Victor Orengo Pavia, tax ID 23869756B, address Calle Sant Lluís 35, 1st floor, 08012 Barcelona, Spain (“Clarmo”, “we”).
Privacy contact: [email protected]. Everything else: [email protected].
10. Changes
If we change this policy in a significant way, we will tell you in the app before the change applies. The version and date are at the top.