Back to EvenEffective October 20, 2026 · Version 1.0
Privacy Policy
What Back to Even collects, why, who helps us run it, how long we keep it, and the choices you have.
1. Scope and data controller
This policy covers the Back to Even iPhone app, this website, our support email and the small set of servers the app talks to (together, the “Service”, “we”, “us”).
Controller: the operator of Back to Even is the developer named as the seller on the app’s App Store page. Privacy requests go to back2app@fluagency.com.
Back to Even helps people stop betting. That means you may tell it things you haven’t told anyone, so we designed it to keep almost all of that on your phone. There is no account: we never ask for your name, email or phone number. Back to Even is not a gambling operator, a treatment provider or an emergency service.
2. Personal data we process
| Category | Examples | Where it lives |
|---|---|---|
| Your recovery record | Betting types you chose, weekly stake, reasons, leagues, check-ins, slips, journal, day count, money kept, accountability partner’s name and number, Shield and reminder settings. | Only on your device. Never uploaded to us. |
| Blocked apps and sites | The apps, categories and websites you pick for the Shield. | Apple gives the app opaque Screen Time tokens. We cannot see what they are; they never leave your device. |
| Pip chat (optional) | Your messages, the recent conversation, and a few facts about your run (days without betting, money kept, urges sat out, your reasons, whether you checked in today, the hour). | Sent to our server and an AI model to write Pip’s reply, then discarded. The conversation is saved only on your phone. |
| Purchases | Apple’s signed receipts, product, price, currency, trial and renewal status, refunds, the in-app screen the purchase came from. | Our subscription service (AppRevenue). We never receive your name, Apple ID or card. |
| Device and identifiers | A random customer ID and device ID created by the app, Apple’s vendor identifier (IDFV), device model, iOS version, app version, language, country, IP address, user agent, push token, Firebase app instance ID, tracking-permission status. The advertising identifier (IDFA) only if you allow tracking. | AppRevenue and Google Firebase. The advertising identifier also goes to Meta, only if you allow tracking. |
| Usage and diagnostics | Anonymous events such as “onboarding completed”, “SOS opened” or “check-in”, crash reports and app integrity checks (App Check). | Google Firebase. Events never include your journal, reasons, amounts, partner or blocked apps. |
| Support | Whatever you write to us by email, and your email address. | Our mailbox. |
The app uses your notification permission for reminders and game-time warnings, and Screen Time permission for the Shield. It does not use your location, contacts, camera, microphone or photos. The first time you turn on voice guidance in Calm, the app downloads a recorded voice pack from this website; after that it works offline. The download contains nothing about you.
3. Purposes and legal bases
To provide the Service (performance of our agreement with you): run the Shield, reminders, Calm and SOS, answer you in Pip chat when you ask, unlock and restore your subscription, and answer support email.
Legitimate interests, balanced against your rights: keep purchase and refund records, prevent fraud and abuse (App Check, a daily cap on Pip messages), fix crashes, and count which features help, in aggregate.
Consent or device choice: notifications, Screen Time access, Pip chat and Apple’s App Tracking Transparency prompt are all asked for in context and can be withdrawn in the app or iOS Settings. Declining any of them doesn’t lock you out of the rest of the app.
Legal obligations and claims: keep records the law requires and respond to lawful requests.
Information about gambling can be sensitive. We avoid collecting it on our servers: it stays on your device, and the only part that ever leaves is what you choose to send Pip.
For Türkiye, processing relies on the conditions in Law No. 6698 (KVKK): necessity for the performance of a contract, legitimate interests that do not harm your fundamental rights, legal obligations, the establishment or protection of a right, and explicit consent where required.
4. Pip chat and AI
Pip’s chat is optional and starts only after you agree to it on a consent screen. Each message goes to our server at Cloudflare, which asks an AI model (Cloudflare Workers AI, or Google’s Gemini API if we switch to it) for Pip’s reply. We do not store your messages and we do not use them to train models. Our server keeps only a count of messages per device per day, deleted after two days.
If a message mentions being in danger, Pip shows crisis lines straight away without sending it to the model. Pip is a companion, not a counsellor, and never gives betting tips. Please leave out names, addresses and bank details.
5. Service providers and international transfers
We share only what a feature needs, with these providers:
- Apple: App Store purchases, Screen Time, push delivery.
- Google Firebase: analytics, Crashlytics crash reports, Remote Config, App Check, Cloud Messaging (push), Cloud Functions and Firestore for anonymous events, and hosting for this website.
- Cloudflare: runs AppRevenue (our subscription records) and Pip’s chat server, including Workers AI.
- Google Gemini API: only if we switch Pip to it, and only for Pip messages.
- Meta: measures whether our ads led to installs and purchases. The app tells Meta only that it was installed and opened, that onboarding was completed, that the plans screen was viewed, that a purchase started, and the product and price of a purchase. Never anything about your betting or recovery. The advertising identifier (IDFA) is included only if you allow tracking when iOS asks; you can turn it off any time in Settings → Privacy & Security → Tracking.
- Schedule sources: our schedule service (ScoreX) and ESPN’s public scoreboard receive the league and date for game-time warnings, and your IP address like any web request. Nothing about you.
- Authorities or professional advisers: only when legally required or reasonably necessary to protect rights, safety or the Service.
These providers may process data outside your country, including in the United States and the European Economic Area. Where required, transfers rely on adequacy decisions, standard contractual clauses or another lawful mechanism.
We do not sell or rent personal data, and we never share anything about your betting or recovery with advertisers.
6. Retention and deletion
- On your device: kept until you delete it with Settings → Delete my data or delete the app.
- Pip messages: not stored on our servers. The per-device daily counter is deleted after two days.
- Anonymous events: deleted after 13 months. Aggregate counts with no device link may be kept longer.
- Purchase records: kept while your subscription is active and afterwards for as long as tax, accounting and refund rules require.
- Crash reports: kept by Firebase Crashlytics for 90 days.
- Support email: kept while needed to resolve your request, then deleted.
Delete my data erases everything on the device and asks our server to delete every event sent from it. To have your purchase record removed too, email us from the address you’d like us to reply to; we may keep what the law requires.
7. Your choices and legal rights
Privacy Choices lists the practical steps. You can:
- turn notifications, Screen Time access and tracking on or off in iOS Settings;
- turn Pip chat off, or delete the conversation, in Settings → Pip;
- erase all app data with Settings → Delete my data;
- ask for access, correction, deletion, restriction, objection or portability, or withdraw consent, where the law gives you that right;
- under KVKK Article 11, learn whether and how your data is processed, who it was shared with, and ask for correction, deletion and compensation where the law provides;
- complain to your data-protection authority, such as Türkiye’s Personal Data Protection Authority (KVKK) or your EEA or UK supervisory authority. California residents have the rights described in the CCPA; we do not sell or share personal data for cross-context behavioural advertising unless you allow tracking.
Send requests to back2app@fluagency.com. Because there is no account, include the ID shown under Settings → About if you can, so we can find your records. We will reply within the time the law requires.
8. Security and age
We use encrypted connections, App Check to keep other software away from our servers, verification of Apple’s signed receipts, least-privilege credentials and access controls on our admin tools. No system is perfectly secure; tell us if you suspect misuse.
Back to Even is for adults aged 18 and over. We do not knowingly collect data from children and will delete it if we learn we have.
9. Changes and contact
We will update this policy when features, providers or laws change. Material changes will be shown in the app or on this site before they take effect where required. The date at the top marks the current version.
Privacy contact: back2app@fluagency.com
Also see: Privacy Choices · Terms of Use · Support