Effective Date: September 4, 2026 Last Updated: October 25, 2026
If you are in Washington, Nevada, or Connecticut, or you want to know specifically how we handle health-related information, please also read our Consumer Health Data Privacy Policy, which is a separate document required by law in those states.
Reform (the “App”) is operated by Reform LLC, an Illinois limited liability company (“we,” “us,” “our”). We are the controller of the limited information described in this policy.
This policy explains what the App collects, what it does not, who receives it, and what control you have. It applies to the Reform iOS app. Reform is currently available only in the United States.
The rest of this policy is the detail behind those statements.
The following is stored in the App’s local database on your device. Except as described in Section 5 (widget) and Section 10 (export), it is not transmitted to us or to anyone else, and we have no technical means of accessing it.
| Category | What it includes |
|---|---|
| Recovery tracking | Quit date, streak history, check-in history, grace/forgiveness usage, relapse events you log |
| Journal and reflection | Journal entries, written reasons for quitting, photos you add |
| Onboarding responses | What you want to change, your triggers, your support system, your definition of success |
| Trigger and urge data | The trigger you selected when using panic/urge support, and timestamps |
| Achievements | Badges and milestones earned |
| Setbacks | Whether you resisted or experienced a setback during a tracked urge |
| App lock | Your app PIN, if you set one — stored in the device’s secure enclave (Keychain), never on our servers |
We do not collect this information. It is created by you, stored by the App on hardware you control, and never sent to us. If you delete the App, it is deleted with it, except to the extent it is contained in a device backup you control (Section 10).
Much of what Reform handles relates to sexual and mental health. Under several laws this is sensitive personal information and consumer health data, and we treat it that way.
We use this information for one purpose only: providing the features you asked for. We do not use or disclose it for advertising, profiling, marketing, or any purpose you would not expect. Because we limit it to those purposes, the right to restrict use of sensitive personal information under California law is satisfied by default — there is no secondary use to restrict.
Our Consumer Health Data Privacy Policy covers this in the specific detail Washington, Nevada, and Connecticut law requires.
If you add the Reform widget, your current streak count and last check-in date are written to an App Group container — a storage area iOS keeps private to Reform and its widget extension. This stays on your device. It is not transmitted anywhere. It exists so the widget can display your streak and so the widget’s check-in and urge-support buttons can pass that action back to the App.
Reform’s content blocking uses Apple’s Screen Time frameworks (Family Controls, Managed Settings, Device Activity), applied by you, to your own device, at your own direction.
We never learn which apps or sites you chose to block. Apple’s design represents your selection as an opaque token that our code cannot read or reverse. We know that a selection exists. We do not know what is in it.
No information about which apps you use, which sites you visit, or how you use your device is transmitted off your phone. Where the App receives device activity events from Apple’s framework in order to apply or refresh a restriction, those events are processed entirely on your device and are not transmitted to us or retained beyond what is needed to keep the restriction working.
This information is never used for advertising, never shared with data brokers, and never shared with anyone for any purpose other than delivering this feature to you.
(Separately from privacy: content blocking has real limitations, including that it can be turned off at the operating system level outside the App. Those limitations are described in our Terms of Service.)
Reform has a Free plan and a paid Pro subscription, sold and billed by Apple. You can also earn a temporary 24-hour Pro Pass by watching rewarded ads, which can renew if you choose to watch more ads (Section 8A).
We never receive your payment card information. Apple handles payment entirely.
We use RevenueCat to determine whether your subscription is active. To do that, RevenueCat receives:
We use those timestamps to understand how many people reach each step of the purchase flow, so we can improve it. They are attached to the same app user identifier as your subscription record, and we do not use them for advertising or sell them.
RevenueCat does not receive your journal entries, recovery data, Screen Time information, or any content from inside the App. RevenueCat is the only server-side data relationship Reform has for subscriptions and purchase-flow measurement; the Pro Pass records in Section 8A and the Welcome Pass records in Section 8B are the only other server-side records.
One thing worth naming: the fact that you subscribe to Reform is itself information about you, because of what the App is. We treat your subscription record with the same care as the rest of your data, and RevenueCat is contractually restricted to processing it only to provide the service to us and to let us measure our purchase flow.
We advertise Reform on Meta's platforms (Facebook and Instagram) to reach people who might be looking for an app like this. To measure whether those ads are working, we use Meta's advertising SDK in its Limited Data Use mode. Each time you open the App, it sends Meta a single event containing: our App ID, a client token tied to the app itself (not to you), the App's version and build number, your device model, your OS version, and a timestamp.
This event does not include your Apple ID for Advertisers (IDFA), your device's vendor identifier (IDFV), an Android advertising ID, or any other identifier that could be used to recognize you across apps or follow you around the internet. We do not request App Tracking Transparency permission for this, because we collect none of the identifiers that permission exists to govern. Nothing from inside the App — no journal entries, check-ins, triggers, Screen Time selections, or subscription status — is included in this event or reaches Meta in any other way.
Meta uses this limited, non-identifying information, combined in aggregate with similar signals from other advertisers, to measure how our ads are performing and to help us understand which of our ads led to app installs. We do not receive anything back from Meta about you individually. This use is governed by Meta's Privacy Policy as well as this one.
Please read this before you watch an ad. Because of what Reform is, the fact that a device is running Reform is itself sensitive. When you choose to watch an ad, Google learns that this device is using Reform. If you do not want that, do not watch ads — nothing in the App requires it. By tapping “Watch ad,” you acknowledge this section and agree to the data use it describes. We do not show you ads you did not ask for, and you can stop at any time.
How it works. Free users can earn a free 24-hour Pro Pass by watching five rewarded video ads. While the pass is active you have Pro features, including content blocking. While a pass is active, you can choose to watch five more ads to line up your next 24-hour pass. If you have done that, then during the last few minutes of your current pass we automatically start the next 24 hours, so your Pro features carry on without a gap. You can repeat this each day if you choose, but you can line up only one next pass at a time. If you have not lined one up, Pro features and blocking turn off when your pass ends unless you subscribe. Nothing is charged and no payment method is involved. Subscribers never see ads. Reform shows no ads anywhere else.
What Google receives. Ads are served by Google AdMob through Google’s Mobile Ads SDK. Each time you choose to watch an ad, including ads you watch to line up a next pass, the SDK loads and plays the ad and Google may receive and process: your device’s IP address, device and operating system information, a randomly generated device or app-instance identifier, crash logs and performance data, and information about how the ad was shown and interacted with. Google also necessarily learns which app the request came from — Reform. We configure the SDK to request non-personalized ads only and the lowest content rating (G). We do not use App Tracking Transparency and do not give Google your Apple advertising identifier (IDFA). We do not send Google anything from inside the App — no journal entries, check-ins, triggers, streak, Screen Time selections, or subscription status. Google’s handling of the information it receives is governed by Google’s Privacy Policy and AdMob’s terms, and Google acts as an independent controller for that data.
Consent and choices. Where required by law (for example, in the EEA, UK, and some U.S. states), the App shows Google’s consent form before ads load, and you can review or change your choice at any time in Settings → About → Ad Privacy Choices. If you decline, ads may not load and you will not be able to earn a Pro Pass; every other feature continues to work.
How we verify and deliver the pass. When you finish an ad, Google sends a signed confirmation to our server. To make that work and prevent abuse, we operate a small backend (Supabase for the database and functions, and Cloudflare as a relay) that stores:
Our server, relay, and database providers also process technical data such as your IP address in ordinary operational logs. These records contain nothing from inside the App and are never used for advertising, profiling, or sold. Retention is described in Section 13.
Meta and Google are separate. The Meta event in Section 8 and the Google ad activity in this section are independent. We do not combine them, and Reform does not give either company data from the other.
By tapping Continue on the “What your first week looks like” screen, you consent to the data use described below. This is shown directly above that button, with a link to this policy.
How it works. During onboarding, when you tap Continue on the “What your first week looks like” screen, on a new install, this claims a free 24-hour Pro Pass. Tapping Continue there is what triggers everything below; nothing happens until then. Pro features, including content blocking, then work for that first day the same way they do for a subscriber. Installs that had already finished onboarding before this feature existed are not eligible, and only one Welcome Pass is ever granted per device, no matter how many times you tap.
Separately, Apple’s DeviceCheck gives every app two small per-device flags (“bits”) stored on Apple’s own servers, independent of anything we store. When you tap, our server checks whether the first flag is already set for your device; if not, it sets that flag (the second is unused) before granting your pass. This is what recognizes a device that already used its one free day, even after a reinstall. Apple tells us nothing else about the device.
Our own server logs include your redacted app user identifier and the outcome of the request (granted, already claimed, rate-limited, and similar), never your raw IP address or the raw device-verification token. Our hosting providers, Supabase and Cloudflare, generate their own standard request logs as part of running any server; we don’t control those, and they may include IP addresses under the providers’ own policies.
We never use any of this for advertising, profiling, or sale, and it is entirely separate from the Meta (Section 8) and Google AdMob (Section 8A) activity above; none of it is shared between these three.
Reminder notifications are scheduled locally on your device by iOS. Scheduling and displaying them does not transmit anything about you to us or anyone else.
A note on lock screens. Notification text can appear on your lock screen where someone else might see it. If that is a concern, you can turn on discreet notifications in Settings, which uses neutral wording, or configure iOS to hide notification previews until unlocked.
If you back up your device to iCloud or a computer, your local Reform data may be included, like any other app’s data. That is standard iOS behavior and it means your data survives a device upgrade. We do not control it and cannot access it. It is governed by Apple’s policies, or your backup software’s. You can exclude Reform from iCloud backup in iOS Settings.
You can export everything at any time from Settings → Export — a PDF summary or a complete JSON file. The file is generated on your device and leaves it only if you send it somewhere yourself. We never receive a copy.
We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not disclose it to data brokers. We have never done any of these things and we do not intend to.
We disclose the limited information described in Sections 7, 8, 8A, and 8B only to:
| Recipient | What they receive | Why | Restriction |
|---|---|---|---|
| RevenueCat | Subscription and device identifiers, and purchase-flow timestamps (Section 7) | Subscription status and purchase-flow measurement | Contractually bound as a processor; may not use it for its own purposes |
| Apple | Purchase and billing data | Sale, billing, and delivery of the App | Independent controller under Apple’s own privacy policy |
| Apple (DeviceCheck) | A one-time device-verification token (Section 8B) — only if you tap Continue to claim your free Welcome Pass | Confirm this is a genuine, distinct device; one free Welcome Pass per device | Independent controller under Apple’s own privacy policy |
| Meta Platforms, Inc. | App ID, client token, app version/build, device model, OS version, timestamp (Section 8) — no persistent identifiers | Measure ad performance | Processed under Meta's Limited Data Use terms |
| Google (AdMob) | IP address, device and OS information, random device/app-instance identifier, crash and performance data, ad interaction data, and the fact that the request came from Reform (Section 8A) — only if you choose to watch an ad | Serve and verify rewarded ads and confirm you earned the Pro Pass | Non-personalized ads only; independent controller under Google’s own privacy policy |
| Supabase and Cloudflare | RevenueCat app user identifier, ad reward and Pro Pass records, rate-limit counters, and technical logs such as IP address (Section 8A) | Host our ad-verification backend and relay | Contractually bound as processors; may not use it for their own purposes |
| Our own server (Supabase and Cloudflare) | A hashed fingerprint of the device-verification result, a salted IP-address hash, and your RevenueCat app user ID, only if you tap Continue to claim your free Welcome Pass (Section 8B) | Prevent duplicate free-pass claims, detect abuse | Contractually bound as processors |
We have no other recipients. If that ever changes, this table changes first, and we will notify you under Section 20.
| Information | Retention |
|---|---|
| On-device data (Section 3) | Until you delete it or delete the App. We hold no copy. |
| Subscription records (Section 7) | As long as required for tax, accounting, and dispute purposes, then deleted |
| Ad reward and Pro Pass records (Section 8A) | Deleted 90 days after the related Pro Pass expires (or 90 days after the reward if it was never used toward a pass, including a next pass you lined up but that never started) |
| Rate-limit counters (Section 8A) | About one hour |
| Welcome Pass claim records (Section 8B) | The device-verification fingerprint, your RevenueCat app user ID and the grant/expiry details are deleted 91 days after you claim. The salted IP hash is deleted after at most 7 days. Apple’s two per-device flags are stored by Apple, not us. |
| Server and relay operational logs | Kept by our hosting providers for their standard short log-retention periods, used only for security and troubleshooting |
| Records of subscription terms | Consumer-protection law requires us to be able to show what subscription terms were presented to subscribers, and that agreement to them was affirmative. We keep records of the terms displayed in each version of the App, and the dates each version was available, for three years, or one year after a subscription ends, whichever is longer. These records describe what was shown to subscribers generally. They contain no journal entries, no recovery data, and nothing else about you. |
Delete individual entries in the App, or delete the App to remove all of it. There is no account and no server-side copy of your recovery data — deleting the App removes everything of yours that exists.
Your subscription record is held by Apple and RevenueCat and is governed by Section 13. If you want that record deleted, email us; note that we cannot delete it while a subscription is active, because it is what tells the App you have access.
Ad reward and Pro Pass records on our servers (Section 8A) are deleted automatically on the schedule in Section 13. To have them deleted sooner, email us with the app user identifier shown in Settings → About. Data held by Google is governed by Google’s policies; you can manage Google’s ad data at Google My Ad Center.
You can ask us to delete your Welcome Pass claim records at any time; Apple’s per-device flags are held by Apple and we cannot clear them.
We use reasonable technical and organizational measures, including access controls and encryption in transit, for the limited information described in Sections 7, 8, 8A, and 8B. Your PIN, if you set one, is stored in the device Keychain.
No system is perfectly secure and we cannot guarantee absolute security. Because virtually all Reform data never leaves your device, your device’s own security — passcode, Face ID, the App’s PIN lock — is the most important protection for your information.
If a breach affecting your information occurs, we will notify you and any regulator as required by applicable law, without unreasonable delay.
We think you should know exactly where you stand here, because for an app like this it matters.
We cannot produce what we do not have. Your journal entries, check-ins, triggers, and blocking selections are on your device. If we received a subpoena tomorrow demanding a user’s journal, we would have nothing responsive, because we never collected it. That is a deliberate design choice, not an accident.
For the limited information we do hold (Sections 7, 8, 8A, and 8B):
We extend the rights below to every Reform user, regardless of where you live. Some are required by law in some states; we have chosen not to make you check.
| Right | What it means | How to use it |
|---|---|---|
| Know / access | Find out what we hold about you and get a copy | Settings → Export, or email us |
| Delete | Have your information deleted | Delete the App, or email us about your subscription record |
| Correct | Fix inaccurate information | Edit it in the App, or email us |
| Portability | Get your data in a usable format | Settings → Export (JSON) |
| Opt out of sale, sharing, targeted advertising, or profiling | Not applicable — we do none of these things. There is nothing to opt out of. | — |
| Limit use of sensitive information | Satisfied by default — see Section 4 | — |
| Non-discrimination | We will never deny service, change your price, or degrade your experience because you exercised a privacy right | — |
How to make a request. Email support@reformapp.org. Most rights are exercisable directly in the App without contacting us, and that is usually faster.
Verification. We do not know who you are, and we are not going to start collecting identifying information in order to process a privacy request. There is no account to verify. For a request about your subscription record, we will ask you for the app user identifier shown in Settings → About, which lets us locate that record without learning your identity. We will never ask you for identity documents, and we will never require you to give us more personal information than we already have.
Timing. We respond within 45 days. If we need more time, we will tell you within that period and may take up to 45 additional days.
Authorized agents. You may use an authorized agent, who must provide written proof of authorization.
Appeals. If we decline a request, we will tell you why, and you may appeal by replying to our response or emailing support@reformapp.org with “Appeal” in the subject line. We will respond to an appeal within 45 days with a written explanation. If we deny your appeal, we will give you a link to submit a complaint to your state Attorney General.
The California Consumer Privacy Act applies to businesses meeting revenue or volume thresholds that Reform does not meet, so we are not a “business” subject to the CCPA. We extend CCPA-equivalent rights to you anyway, as described above. For transparency, here is the statutory mapping:
| CCPA category | Do we collect it? | Source | Purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Device/app identifiers, for subscription verification and Pro Pass delivery. If you watch ads, Google also receives a random device/app-instance identifier and IP address. A hashed device-verification fingerprint and a salted IP hash, only if you tap Continue to claim your free Welcome Pass (Section 8B). | Automatic (RevenueCat, Google AdMob SDK); on your tap (Apple DeviceCheck, our server) | Verify entitlement; serve and verify rewarded ads; one free Welcome Pass per device | RevenueCat, Google, Supabase, Cloudflare |
| Commercial information | Subscription and purchase records | Apple | Verify entitlement | RevenueCat, Apple |
| Internet or network activity | Limited — app-open events (device model, OS version, app version, timestamp; no browsing history, no persistent identifier) sent to Meta to measure ad performance, and up to four purchase-flow timestamps (subscription screen shown, declined, special offer shown, trial started) sent to RevenueCat to measure our purchase flow. If you choose to watch a rewarded ad: ad request and interaction data sent to Google AdMob (Section 8A), and a signed reward confirmation recorded on our server. Otherwise we operate no backend server for app usage. Network calls are Apple StoreKit, RevenueCat, Meta, Google AdMob, and our Pro Pass backend. | Automatic (Meta SDK, RevenueCat, Google AdMob SDK) | Measure ad effectiveness and purchase-flow performance; serve rewarded ads; deliver the Pro Pass | Meta, RevenueCat, Google, Supabase, Cloudflare |
| Geolocation | No — we never collect location, precise or approximate, beyond country from Apple | — | — | — |
| Sensitive personal information | Health and sexual-health-related data, stored on your device only | You | Provide the App | Not disclosed |
| Biometric information | No | — | — | — |
| Inferences / profiles | No — we build no profiles | — | — | — |
Do Not Sell or Share My Personal Information: we do not sell personal information, and we do not share it for cross-context behavioral advertising: AdMob ads in Reform are non-personalized only and Google does not receive data from inside the App. We therefore provide no sale/share opt-out. You can still review or change your ad consent in Settings → About → Ad Privacy Choices. If that ever changes, we will provide one before it does.
Shine the Light (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their direct marketing purposes.
Reform is a native iOS app and does not use web tracking technologies, cookies, or cross-site tracking. (The Google Mobile Ads SDK may use on-device storage for ad delivery and fraud prevention; see Section 8A.) We do not track you across other apps or websites, and we do not permit anyone else to. Because we do no tracking at all, there is no behavior for a Do Not Track or Global Privacy Control signal to change. We do not request App Tracking Transparency permission, because we do not track you and do not collect the identifiers it governs — including through the Meta attribution in Section 8 and the non-personalized Google rewarded ads in Section 8A. Apple DeviceCheck (Section 8B), used only if you tap Continue to claim your free Welcome Pass, does not use IDFA either; it checks device genuineness via Apple’s own mechanism, not identity, and does not track you across apps or sites.
Nevada residents may submit a request that we not sell covered information. We do not sell covered information. You may still submit a request to support@reformapp.org.
See our separate Consumer Health Data Privacy Policy, which contains the disclosures those states require, including the right to a list of every third party that has received your consumer health data.
Reform requires users to be 18 or older and is not directed at anyone under 18. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it promptly. Contact support@reformapp.org if you believe this has happened.
If Reform is ever acquired, merged, or its assets sold, information could transfer to a successor. We commit to the following, and we intend these to bind any successor:
Our commitment not to sell your data is not contingent on who owns the company.
We may update this policy. For material changes — anything that expands what we collect, how we use it, or who receives it — we will notify you in the App before the change takes effect, and where the change requires your consent under applicable law, we will ask for it rather than assume it. Otherwise we will update the “Last Updated” date.
We will not apply a material change retroactively to information already collected without your consent.
Reform LLC An Illinois limited liability company support@reformapp.org
For privacy requests, put “Privacy Request” in the subject line. For appeals, “Appeal.”