Effective Date: September 4, 2026 Last Updated: October 25, 2026
Washington’s My Health My Data Act, Nevada’s consumer health data law, and Connecticut’s health data provisions require companies handling health-related information to publish a separate policy explaining exactly how that information is handled. This is that policy.
It sits alongside our general Privacy Policy, which covers everything else. Where the two overlap, this document controls for consumer health data.
Reform is operated by Reform LLC, an Illinois limited liability company (“we,” “us,” “our”).
Reform helps people reduce or stop compulsive pornography use. Under these laws, information about that — your progress, your setbacks, your triggers, what you write about it, and even the fact that you use the App at all — is consumer health data.
Some companies in this category argue their way out of these laws. We are not doing that. We have written this policy on the assumption that everything Reform touches is consumer health data and should be treated accordingly.
The most important thing to understand about Reform is that we built it so we would not have your health data in the first place. Nearly all of it never leaves your phone, and we operate no backend server that stores any of it. The exceptions are your subscription record and, only if you choose to watch rewarded ads to earn a free Pro Pass or tap Continue to claim your free Welcome Pass, the data described in Sections 3A, 3B, and 6. What follows explains exactly where the line is.
The following is created by you and stored in a local database on your device. It is never transmitted to us. We have no technical ability to access it, read it, or retrieve it.
| Category | What it includes |
|---|---|
| Recovery status | Quit date, current and historical streak, relapse events you record |
| Check-ins | Daily check-in history and responses |
| Journal content | Journal entries, written reasons for quitting, photos you add |
| Onboarding responses | What you want to change, your triggers, your support system, your definition of success |
| Urge and trigger data | Which trigger you selected during panic/urge support, and when |
| Setback data | Whether you resisted or had a setback during a tracked urge |
| Milestones | Badges and achievements earned |
| Content blocking selection | Which apps and categories you chose to restrict — stored by Apple as a token our code cannot read |
Our position, stated plainly: because this information never reaches us and we cannot access it, we do not collect, receive, process, share, or sell it within the meaning of these laws. We describe it here anyway, in full, so that you know what the App holds on your own device even though we do not have it.
If you delete the App, this data goes with it. We hold no copy, so there is nothing for us to delete on our end and nothing for us to disclose to anyone.
Three categories: your subscription record (this section), which applies to subscribers; ad-pass data (Section 3A), which applies only if you choose to watch ads; and Welcome Pass data (Section 3B), which applies only if you tap Continue on the onboarding screen to claim your free Welcome Pass.
Reform has a Free plan and a paid Pro subscription. The fact that you subscribe to Reform indicates something about your health, because of what the App is for. We therefore treat your subscription record as consumer health data, even though it contains no journal content, no recovery history, and nothing else about how you use the App.
| Category collected | Source | Purpose |
|---|---|---|
| Subscription status, purchase and renewal events, trial status | Apple, via RevenueCat | To confirm you have access to the App you paid for |
| App user identifier, device identifier, device and app version, country | Your device, via RevenueCat | To associate the subscription with your installation |
We collect this because there is no way to operate a paid app without knowing who has paid. Apart from the optional ad-pass data in Section 3A and the Welcome Pass data in Section 3B, we collect nothing else from any user.
Important: because Reform is a health-related app, the fact that a device is running Reform is itself consumer health data. If you choose to watch a rewarded ad, Google (our ad network, Google AdMob) receives your device’s IP address and basic device information and therefore learns that this device is using Reform. This is optional. You can use Reform’s Free plan, or subscribe, without ever watching an ad.
Free users can earn a free 24-hour Pro Pass by watching five rewarded ads. While a pass is active, they can choose to watch five more ads to line up the next 24-hour pass, which starts automatically as the current one ends; only one next pass can be lined up at a time. Subscribers never see ads, and Reform shows no ads anywhere else. Each time you choose to watch an ad, the following is processed:
| Category | Who receives it | Purpose |
|---|---|---|
| IP address, device and OS information, a random device/app-instance identifier, crash and performance data, ad interaction data, and the fact that the request came from Reform | Google (AdMob) | To serve the ad and confirm you completed it. Ads are non-personalized; we do not use your Apple advertising identifier. |
| Your RevenueCat app user identifier, a record of each verified ad reward (including whether it has been used toward a pass), Pro Pass grant and expiry times (including which earlier pass an automatically started pass follows), short-lived rate-limit counters, and technical logs (such as IP address) | Our servers, hosted by Supabase and Cloudflare (processors); RevenueCat for the Pro Pass entitlement | To verify ad completion, grant and expire the pass, and prevent abuse |
Nothing from inside the App — no journal, check-ins, triggers, streak, Screen Time or blocking selections — is sent to Google or stored on our servers. We do not use ad-pass data for advertising, profiling, or sale, and never combine it with data from any other source.
Important: because Reform is a health-related app, the fact that a device runs Reform is itself consumer health data. During onboarding, when you tap Continue on the “What your first week looks like” screen, Apple’s DeviceCheck and then our own server learn this device uses Reform.
During onboarding, when you tap Continue on the “What your first week looks like” screen, this claims a free 24-hour Pro Pass. Installs that had already finished onboarding before this feature existed are not eligible, and only one Welcome Pass is ever granted per device. Tapping it processes:
| Category | Who receives it | Purpose |
|---|---|---|
| A one-time device-verification token, checked against Apple’s own per-device record | Apple (DeviceCheck) | Confirm this is a genuine, distinct device |
| A hashed fingerprint of that token, your RevenueCat app user ID, Pass grant/expiry time, and a salted IP-address hash kept at most 7 days | Our servers, hosted by Supabase and Cloudflare (processors) | Prevent duplicate claims, detect abuse, grant/expire the Pass |
Our claim records are deleted 91 days after you claim, and you can ask us to delete them sooner. Nothing from inside the App is sent to Apple or stored on our servers beyond the above. We never use any of this for advertising, profiling, or sale.
We are stating these as commitments, not as descriptions of current practice.
Two: Apple, via RevenueCat (your subscription and purchase status), and your device, only if you choose to watch a rewarded ad (the data in Section 3A, generated by the ad SDK and our ad-verification backend) or tap Continue to claim your free Welcome Pass (the data in Section 3B).
Everything else Reform touches (your journal, triggers, streaks, and everything else in Section 2) is created by you, stays on your device, and never reaches us — so it is not “collected” within the meaning of these laws at all. We do not obtain consumer health data from data brokers, third-party advertising networks about you, public records, social media, other apps, or any other third party. We do not derive or infer consumer health data from non-health information.
| Recipient | Category received | Role | Restrictions |
|---|---|---|---|
| RevenueCat | Section 3 data | Processor — subscription management | Bound by written contract to process only on our instructions and only to provide the service; may not use it for its own purposes, may not sell it, must delete on our instruction |
| Apple | Purchase and billing data | Independent controller for App Store transactions | Governed by Apple’s own privacy policy |
| Apple (DeviceCheck) | A one-time device-verification token (Section 3B) — only if you tap Continue to claim your free Welcome Pass | Independent controller for device verification | Governed by Apple’s own privacy policy; we receive nothing about the device beyond Apple’s yes/no flag |
| Google LLC (AdMob) | Section 3A ad data, including the fact that the device is using Reform — only if you choose to watch an ad | Independent controller for ad delivery | Non-personalized ads only; we send it nothing from inside the App; governed by Google’s own privacy policy and AdMob terms |
| Supabase, Inc. and Cloudflare, Inc. | Ad reward and Pro Pass records, Welcome Pass claim records, app user identifier, rate-limit counters, technical logs (Sections 3A and 3B) | Processors — hosting our ad-verification and Welcome Pass backend and relay | Bound by written contract to process only on our instructions; may not use it for their own purposes or sell it |
That is the complete list. We have no affiliates. We share consumer health data with no one else, for any reason, except as described in Section 9 (legal process). RevenueCat, Supabase, and Cloudflare are processors acting only on our instructions.
RevenueCat, Supabase, and Cloudflare are processors, which means it acts only on our instructions under a binding written contract, as these laws require. It is not permitted to use your information for its own purposes.
The subscription data in Section 3 is collected because it is strictly necessary to provide the paid service you requested — it is not collected on the basis of separate opt-in consent, because there is no way to provide a paid subscription without it.
Rewarded ads — your consent. Watching a rewarded ad is entirely optional and results in Google receiving data that reveals the device is using Reform (Section 3A). We therefore ask for your consent for that collection and sharing. By tapping “Watch ad” in Reform, after the notice in this policy and in the App, you consent to Reform collecting the Section 3A data and to its disclosure to Google, Supabase, Cloudflare, and RevenueCat for the purposes stated there. This consent is separate from, and not required for, your use of the Free plan or a subscription. Where Google’s own consent form is required by law, you will also see that form before ads load.
The Welcome Pass — your consent. By tapping Continue on the “What your first week looks like” screen, after the notice shown directly above the button and in this policy, you consent to Reform collecting the data described in Section 3B and disclosing it to Apple, Supabase, and Cloudflare for the purposes described there.
Withdrawing consent. Stop watching ads at any time — that ends all further collection. You can change your Google ad-consent choice in Settings → About → Ad Privacy Choices, and you can ask us to delete your ad-pass records at any time (Section 8). Withdrawing never affects the Free plan or a subscription.
For other sharing. We do not share your consumer health data with anyone beyond the recipients in Section 6. If that ever changes, we will request separate, specific consent first. Disclosure to RevenueCat, Supabase, and Cloudflare is a processor relationship, not sharing, and is limited to what is necessary to run the App.
Subscription data. Your subscription record is collected because it is strictly necessary to provide the paid service you requested, so it is not consent-based. There is nothing to opt out of short of cancelling the subscription itself, which you can do at any time (see the Terms of Service, Section 6.5).
You have the following rights regarding consumer health data. We extend them to every user, not only residents of states that require them.
Confirm whether we collect, share, or sell your consumer health data, and get a copy. You can export everything on your device instantly from Settings → Export. For your subscription record, email us.
Get a list of all third parties and affiliates with whom we have shared or sold your consumer health data, including active contact information for each. Section 6 above is that list, and it is current. Here is the contact information the law requires us to give you:
| Recipient | Contact |
|---|---|
| RevenueCat, Inc. | privacy@revenuecat.com |
| Apple Inc. | apple.com/legal/privacy/contact |
| Google LLC (AdMob) — only if you watched an ad | support.google.com/policies/contact/general_privacy_form |
| Supabase, Inc. (processor) | privacy@supabase.com |
| Cloudflare, Inc. (processor) | privacyquestions@cloudflare.com |
Rewarded-ad data is consent-based, and you can withdraw consent at any time — see Section 7. Stop watching ads, change your choice in Settings → About → Ad Privacy Choices, and/or email us to delete your ad-pass records. You can also email us to delete your Welcome Pass claim records at any time; Apple’s per-device flags are held by Apple and we cannot clear them. Your subscription record is necessary to provide the paid service and is not consent-based; there is nothing to withdraw short of cancelling.
Have your consumer health data deleted. When you make a deletion request about your subscription record or ad-pass records, we will:
Two honest limits. We cannot delete your subscription record while your subscription is active, because that record is what tells the App you have access — cancel first, or ask us to delete it after your subscription ends. And we may be required to retain a minimal transaction record for tax, accounting, or dispute purposes; if that applies to your request, we will tell you exactly what is being kept and why.
For everything else: delete the App. All on-device data goes with it. You do not need our permission or our help.
Email support@reformapp.org with “Health Data Request” in the subject line.
We will not ask you to identify yourself. We do not know who you are and we are not going to start now in order to process a privacy request. There is no account. For a request about your subscription record, we will ask you for the app user identifier shown in Settings → About, which lets us find that record without learning who you are. We will never require identity documents.
Timing: we respond within 45 days. If we need more time, we will tell you within that period and may extend once by 45 days.
No charge, and no discrimination — exercising any of these rights will never affect your subscription, your price, or your access.
If we deny a request, we will explain why in writing and tell you how to appeal.
To appeal: reply to our response, or email support@reformapp.org with “Appeal” in the subject line. We will respond within 45 days with a written explanation of our decision.
If we deny your appeal, you may submit a complaint to your state Attorney General:
We require valid legal process before disclosing consumer health data, we will narrow or challenge demands that are overbroad or defective, and we will notify you before disclosing anything unless we are legally prohibited or there is an emergency risk of serious harm.
Practically, there is very little for anyone to obtain. Your journal, check-ins, triggers, and blocking selections are on your device and we hold no copy. A subpoena to us would produce nothing responsive beyond a subscription record and, if you chose to watch ads or claim the Welcome Pass, ad-pass or Welcome Pass records, because we never collected anything else.
We use access controls and encryption in transit for the limited subscription, ad-pass, and Welcome Pass information described in Sections 3, 3A, and 3B. Your app PIN is stored in your device’s secure enclave.
The strongest protection is architectural: the overwhelming majority of your consumer health data is never sent to us at all. It cannot be breached at our end because it is not there.
| Data | Retention |
|---|---|
| On-device data (Section 2) | Held by you, on your device, until you delete it. We hold no copy. |
| Subscription records (Section 3) | As required for tax, accounting, and dispute purposes, then deleted |
| Ad reward and Pro Pass records (Section 3A) | Deleted 90 days after the related Pro Pass expires (or 90 days after the reward if it was never used toward a pass, including a next pass you lined up but that never started) |
| Welcome Pass claim records (Section 3B) | The device-verification fingerprint, your RevenueCat app user ID and the grant/expiry details are deleted 91 days after you claim. The salted IP hash is deleted after at most 7 days. Apple’s two per-device flags are stored by Apple, not us. |
| Rate-limit counters and operational logs | About one hour for counters; short standard provider log periods for security and troubleshooting |
If we materially change how we handle consumer health data, we will notify you in the App before the change takes effect, and we will obtain your consent where these laws require it rather than relying on your continued use. We will not apply a material change retroactively to data already collected without your consent.
Reform LLC An Illinois limited liability company support@reformapp.org
Subject line “Health Data Request” for rights requests, “Appeal” for appeals.