SoffiSoffi Privacy Policy
Last updated 24 October 2026.
Soffi is a self-care companion app. We collect as little as we can, keep your private writing private, and never sell your data or show ads.
1. Who we are
The data controller is Farooq Abdul Khaliq (sole proprietorship, trading as Soffi), Via Imbrecciata 48, 60024 Filottrano (AN), Italy, VAT number IT03029030420. Contact: efak621@gmail.com.
2. Who can use Soffi
You must be at least 14 years old, or older where the law of your country requires it (for example 15 in France, 16 in Germany, the Netherlands and Ireland). The app checks your date of birth once and stores only an age range (for example "14–15"), never your birth date. If you are under 18, weight-change goals are hidden and purchases follow Apple's Family Sharing and Ask to Buy rules.
3. What we collect, why, and on what legal basis
| Data | Where it is kept | Why | Legal basis (GDPR) |
|---|---|---|---|
| Account: an anonymous ID, and your email if you add one | Our servers (EU) | To keep your companion and progress safe across phones | Contract (Art. 6(1)(b)) |
| Age range and the time you confirmed it | Our servers (EU) | To apply the minimum age | Legal obligation (Art. 6(1)(c)) |
| Your companion, habits, goals, completions, quests, inventory, garden decorations | Our servers (EU) and your phone | To run the app and sync your progress | Contract |
| Mood check-ins (a 1–5 rating) | Your phone; our servers only if you turn on mood backup (off by default). Turning it off deletes the copies on our servers | Insights about your own week | Explicit consent (Art. 9(2)(a)) |
| Journal text and mood notes | Your phone only, unless you turn on "Encrypted journal backup". Backups are end-to-end encrypted: only your devices hold the key, we cannot read them | Your private writing | Explicit consent |
| Activity sessions (breathing, meditation, focus, walks, sleep sounds — type and duration) | Our servers (EU) | Growth of your companion, your history | Contract |
| Steps, distance and active energy from Apple Health | Read on your phone only. We store only that you reached your step goal that day, never the numbers | Step goal and movement goals | Explicit consent (Apple Health permission) |
| Screen Time (only if you use app pauses, screen-free time or focus locking) | On your phone only. Apple gives Soffi anonymous tokens for the apps you choose — we never learn which apps they are or how you use them, and nothing is sent to us | Locking the apps you chose for the time you chose; you can unlock early at any time | Your choice (Apple Screen Time permission), not sent to us |
| Motion sensor steps during a verified walk | On your phone only. Used to confirm a walk happened; only the completed habit and walk duration are synced | Verified walks | Contract |
| Mindful minutes written to Apple Health | Apple Health on your phone | So your meditations appear in Health | Explicit consent |
| Friends: your friend code, the name you choose for friends, your companion's name, species and stage, friend requests and blocks, kind notes (preset phrases only), in-person meetups (date only) | Our servers (EU) | The friends feature, and preventing unwanted contact | Contract |
| Field Guide finds and daily gifts (which item, when) | Our servers (EU) and your phone | Your collection and Stars | Contract |
| Purchases (Apple transaction IDs, product, status) | Our servers (EU); payment details stay with Apple | To give you Soffi Plus | Contract; legal obligation for financial records |
| Device ID generated by the app, app version, technical sync logs | Our servers (EU) | Reliable sync, security, abuse prevention | Legitimate interest (Art. 6(1)(f)) |
We do not collect your location. Meeting a friend in person uses a direct phone-to-phone connection (Bluetooth / local Wi-Fi) while both of you have the Meet screen open; no location is sent to us.
Some things never leave your phone: the Face ID journal lock, reminder and "daily hello" settings, and your Screen Time choices. Like any app's data, what Soffi keeps on your phone can be part of your phone's own backup (iCloud Backup or a computer), which Apple or you control; journal entries in it stay encrypted with a key held in your phone's Keychain.
We do not use advertising, advertising IDs or third-party analytics, and we never use your data to train AI models.
4. Who processes your data for us
- Supabase Inc. — database, sign-in and sign-in emails, hosted in the EU (AWS, Stockholm, Sweden), under a data processing agreement.
- Apple — App Store purchases, Sign in with Apple, Apple Health and (if you choose) iCloud Keychain for your journal key. Apple's own privacy policy applies to those services.
- Vercel Inc. — hosts our website (not the app's data). It processes visitors' IP addresses to deliver the pages.
Your app data is stored in the EU. Supabase Inc. and Vercel Inc. are US companies, so their staff may access data from the US for support or security; these transfers are covered by the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.
5. How long we keep it
- Your account data: until you delete your account. Deletion in the app (You → Privacy & data → Delete account) removes your data from our servers immediately.
- Purchase records: kept without your identity for as long as tax law requires (in Italy up to 10 years).
- Technical sync logs: 45 days. Security audit logs: up to 400 days, pseudonymised.
- Guest accounts that never added an email and have not been used for 180 days are deleted automatically. Data on your phone is not affected.
6. Your rights
You can access, export, correct and delete your data at any time. Export and deletion are built into the app (You → Privacy & data). You can withdraw consent (for example for mood sync or the journal backup) in the app at any time; this does not affect what was done before. You can also object to processing based on legitimate interest, ask us to restrict processing, and complain to your data protection authority — in Italy the Garante per la protezione dei dati personali (garanteprivacy.it).
7. Security
Data is encrypted in transit (TLS) and at rest. Each person can only reach their own records (row-level security). Journal backups are end-to-end encrypted on your device. Access to production systems is restricted and logged.
8. Not a medical service
Soffi supports everyday self-care. It is not a medical device and does not diagnose or treat any condition. If you are in crisis, call your local emergency number (112 in the EU) or use the help numbers in the app (Need help now?).
9. Changes
If we change this policy in a way that matters, we will tell you in the app before the change applies.
10. Contact
efak621@gmail.com · Farooq Abdul Khaliq, Via Imbrecciata 48, 60024 Filottrano (AN), Italy · VAT IT03029030420