Privacy Policy

Who we are

Unstuck ADHD (this website) and Unstuck (the iPhone app) are run by Eduard Vlase Limited. In this policy, "we", "us" and "our" mean Eduard Vlase Limited.

We decide how and why your personal information is used. That makes us the "controller" under UK data protection law: the UK GDPR and the Data Protection Act 2018.

Company

Eduard Vlase Limited

Company number

16832727

Registered office

Milton Keynes, United Kingdom

ICO registration

ZC141188 (Information Commissioner's Office data protection register)

Email

support@unstuck-adhd.com

The Unstuck app

Unstuck is for adults who find starting things hard. Many people use it while they wait for an NHS ADHD assessment. Some of what you tell the app is about your health. UK law calls this "special category" data and protects it more strongly.

So the app is built to keep your information on your phone. Nothing leaves it unless you choose to back up, or to use Claude.

What stays on your phone

These are stored only on your phone. We can't see them, and they are never sent to our servers:

• your brain-dump draft and your sorted list
• today's one thing, your settings (including the referral chase reminder), and your choices about backup and Claude

These are also stored on your phone, and leave it only if you choose:

• your setup answers, such as where you are in the ADHD journey and the wait you were told
• unstuck moments: the task, why it felt sticky, the step you took and what helped
• daily check-ins: focus, overwhelm, energy and mood
• your "My story" answers
• your journey details: your service, referral date, when you last chased, your assessment date and format, your checklist and the outcome you record
• which lessons you've finished, and when

They are copied to our servers only if you turn on backup. And one more thing leaves your phone only if you choose:

• the words of a brain dump or a task you're stuck on. They are sent to Claude only if you agree to steps and sorting by Claude.

A few more things to know:

• Face ID lock. You can lock the app with Face ID, Touch ID or your passcode. Your iPhone does the check. The app only learns whether it worked.
• Erase everything on this phone (in Me) deletes your answers, journal, check-ins, story, journey details, lesson progress, brain dump and today's one thing from the phone, and signs you out. If you're signed in, you can choose "Erase and delete backup" to delete your backup at the same time. Otherwise it doesn't delete a backup: use "Delete backup" or "Delete account and backup" in Me.
• Deleting the app removes its stored data from your phone. iOS can keep the sign-in session in the Keychain, and the app clears it if you install it again.
• iPhone backups. If you back up your iPhone to iCloud or a computer, iOS may include the app's data in that backup. Apple's terms cover those backups. The app keeps your sign-in session out of them.
• Things you share yourself. Your "My story" PDF and the message drafts only go where you send them, using your own apps. Links to ADHD UK, the NHS and gov.uk open those websites, which have their own privacy policies.
• Dictation. In the brain dump you can tap the microphone and talk instead of typing. The app asks for the microphone and speech recognition only when you first tap it. Apple's speech recognition turns your words into text. If your iPhone can do that on the phone for British English, the audio never leaves it. If it can't, Apple's speech service does it on Apple's servers, under Apple's terms, and the screen tells you so before you start. We never receive the audio, and no recording is kept. The text joins your brain dump, which stays on your phone unless you choose to have it sorted by Claude. If you use your keyboard's own microphone instead, that is Apple's dictation, also under Apple's terms.

Your account (optional)

You only need an account to back up, or to use steps and sorting by Claude. You sign in with a 6-digit code sent to your email or, where the app offers it, with Sign in with Apple.

What we collect

Your email address, an account ID, and when the account was created and last used. With Sign in with Apple, we get the email address Apple gives us (this can be a private relay address that Apple creates) and an Apple account identifier. We don't ask Apple for your name.

Sign-in codes

We store only a scrambled (hashed) copy of each code, filed under a hashed version of your email address, with counters that stop people guessing. A code works once, for 15 minutes. The record is set to delete itself a day after the last code or wrong guess.

Abuse limits

We count how many codes are requested from each internet (IP) address. We store only a hash of the address, never the address itself, and delete it after two hours.

Sign-in emails

Sent by Resend, from hello@unstuck-adhd.com. The subject and text never mention ADHD.

Why

To create your account, keep it secure and stop abuse.

Lawful basis

Contract (UK GDPR Article 6(1)(b)), to give you the account you asked for. Legitimate interests (Article 6(1)(f)) for the security limits.

Where

Accounts are held by Firebase Authentication, a Google service that runs only in US data centres. Our sign-in functions run in London.

How long

Until you delete your account. See How long we keep it.

Backup (optional, only with your consent)

Backup means a new phone doesn't mean starting again. It's off until you turn it on, and signing in doesn't turn it on.

What we store

Your setup answers: the stage of the ADHD journey you chose, your referral month, the wait you were told, your biggest challenge, your first-win task (in your words, up to 120 characters), when you did it and whether it felt easier, and your reminder time (morning, lunchtime or evening). Your journal: each unstuck moment (the task, why it felt sticky, the step you took, whether you used the focus timer, what helped and when) and each daily check-in (focus, overwhelm, energy and mood). Your "My story" answers, in your words. Your journey details: the service you're waiting for, your referral date, when you last chased them, your assessment date and format, your checklist and the outcome you record. Which lessons you've finished, and when. When you finished setting up, when you agreed to back up and to include your journal, and when each item last changed.

Not backed up

Your brain-dump draft and sorted list, today's one thing, the referral chase reminder, and your Face ID and notification settings.

How you agree

Signing in doesn't back anything up. After you sign in, the app tells you what is backed up, and where, and asks you to choose: "Back up answers and journal", "Answers only" or "Not now". The same choice is in Me. With "I already have an account", the app asks whether to bring your backup back ("Bring back answers and journal" or "Answers only"), because backup then carries on from that phone. Your journal, check-ins, journey details, story and lesson progress are only sent if you include them; if you chose answers only, or backed up before the journal was included, Me asks "Back up your journal too?" and sends none of it unless you say yes. Your consent belongs to the account you gave it for. If you sign out, or someone else signs in on the phone, backup stops. If someone else signs in on a phone whose journal was backed up to a different account, the app tells them before they include it.

Why

To keep your plan and journal safe and bring them back on a new phone, and to keep them the same on each phone you use.

Lawful basis

Your consent (Article 6(1)(a)). Because this is health information, your explicit consent (Article 9(2)(a)).

Where

Google Cloud Firestore, in London (europe-west2). Only you can read your backup through the app, and our security rules check every field that is saved.

How long

Until you delete it. Signing out stops new saves, but keeps what is already backed up. To remove it, use "Delete backup" in Me (your account stays), "Delete account and backup", or email us. If you delete an answer in the app while backing up, the backup keeps only a marker that it was deleted, so your other phones delete it too.

Steps and sorting by Claude (optional, only with your consent)

Unstuck can use Claude, an AI made by Anthropic. It sorts a brain dump into today, this week and someday. It also writes tiny first steps, and sometimes a message draft, for a task you're stuck on. This is off until you say yes. You can switch it off at any time in Me, under "Steps and sorting by Claude".

What is sent

The text of your brain dump (up to 4,000 characters) with today's date, so deadlines can be sorted. Or the task you're stuck on (up to 120 characters) and the reason you picked, such as "too big".

How

From the app to our functions in London, then to Anthropic's Claude API. These features are part of the paid plan, and you need an account so that we can check your plan and apply daily limits. We check your account and plan, but we don't send your email address or account ID to Anthropic.

What we keep

Nothing. We don't save the text or the reply on our servers, and we don't write them to our logs. The reply comes back to your phone and is saved there only.

What Anthropic does

We ask Anthropic to process the text in the US, and it stores data from its API in the US. Anthropic deletes what we send, and Claude's replies, within 30 days. If its automated safety systems flag a request, it can keep it for up to 2 years, and the safety scores for up to 7 years. Under its commercial terms, Anthropic may not train its models on what we send.

Your safety

If what you write suggests you may not be safe, the app shows crisis lines instead of steps. We are not alerted, and nobody will contact you. In an emergency, call 999.

Why

To give you the sorting and steps you asked for.

Lawful basis

Your consent (Article 6(1)(a)). Because what you write may include health information, your explicit consent (Article 9(2)(a)).

Changing your mind

Switching it off stops anything new being sent. It can't recall text that was already sent. Anthropic deletes that as described above.

Daily limits and plan checks

What we store

For each account: how many sorts and step requests you've used in the current 24 hours, when that window started, and when you last used one. We also keep a running total across everyone, with nothing personal in it.

Plan check

Before we send anything to Claude, our server checks that your plan is active, using your purchase record (see Purchases in the app). We don't ask any other company.

Why

Fair daily limits (20 sorts and 60 step requests a day), to stop abuse and runaway costs, and to check you have an active plan before we send anything to Claude.

Lawful basis

Contract (Article 6(1)(b)) for the plan check. Legitimate interests (Article 6(1)(f)) for the limits.

Where and how long

Cloud Firestore in London, until you delete your account.

Reminders and notifications

The daily nudge, the focus timer, the referral chase reminder and the reminder 3 days before a free trial ends or a subscription renews are all scheduled on your phone by iOS. We don't run a push notification server, so we don't know when you get them. Their wording never mentions ADHD. You can turn them off in Me or in your iPhone's Settings.

Purchases in the app

Subscriptions and the lifetime purchase are sold through Apple's App Store. Apple is the merchant: it takes the payment and handles billing, renewals, cancellations and refunds, under its own terms and privacy policy. We never see your card details or your Apple ID. We don't use any other company to manage purchases or subscriptions.

Before you sign in

You can buy without an account. Until you sign in, the purchase is held only by Apple, against your Apple ID, and on your phone. Nothing about it reaches us.

Once you're signed in

The app sends the App Store's signed record of your purchase to our server in London. Our server checks Apple's signature, then links the purchase to your account. If you buy while signed in, the app also gives Apple an "app account token" with the purchase, so that it can be matched to your account. This token is a random-looking code worked out from your account ID. It doesn't reveal your account ID or your email address.

What we store

Whether your plan is active, which plan it is (yearly, monthly or lifetime), when it ends, when a free trial ends, whether it will renew, Apple's ID for the purchase (the original transaction ID), and whether it was a real purchase or an Apple test purchase. We also record which account owns each purchase, which product it is and when it was linked. One purchase unlocks one account.

Updates from Apple

When a subscription renews, ends or is refunded, or automatic renewal is switched on or off, Apple tells our server and we update your record. These messages contain details of the transaction, not your name or email address.

What we don't do

We don't use a third-party subscription service. We don't collect device or advertising identifiers, and we don't use advertising attribution.

Why

To give you what you paid for, keep your plan up to date when Apple renews, ends or refunds it, check your plan before we send anything to Claude, and make sure one purchase unlocks one account.

Lawful basis

Contract (Article 6(1)(b)), to give you what you paid for.

Where

Our server and these records are in Google Cloud (Cloud Functions and Firestore), in London (europe-west2).

How long

Until you delete your account. "Delete account and backup" in Me deletes these records too, so you can link the purchase to a new account later. Deleting your account doesn't cancel an App Store subscription: cancel it in your Apple ID settings. Apple keeps its own records of what you bought, under its own privacy policy.

What the app doesn't do

• It has no adverts, analytics or tracking tools, and it doesn't track you across other apps or websites.
• It doesn't use your location, contacts, photos or camera, and it doesn't record audio.
• It doesn't make decisions about you that have legal or similarly significant effects. Claude's sorting and steps are only suggestions.

The website

Visiting the website

Server logs

Like most websites, our server records technical details of each request, such as your IP address, browser, the page and the time. We use them to run and protect the site. Lawful basis: legitimate interests (Article 6(1)(f)).

Essential cookies

Cookies that keep you signed in (sessionid) and protect forms (csrftoken). Your cookie choice is saved in your browser's local storage for 12 months, then we ask again. These are strictly necessary, so they don't need your consent. Lawful basis: legitimate interests (Article 6(1)(f)).

Google Analytics

We use Google Analytics 4, through Google Tag Manager, to understand how the site is used. It records the pages you visit, time on the site, your device and browser, your approximate location, the site you came from, clicks on buttons and links to other sites, scrolling, and shop events such as viewing a product, starting checkout and buying. It uses cookies. Google says Google Analytics 4 doesn't log or store IP addresses. Lawful basis: your consent (Article 6(1)(a), and the Privacy and Electronic Communications Regulations). Google Analytics and Tag Manager only load after you click Accept on our cookie banner. If you click Decline, they don't load. You can change your mind at any time with "Cookie settings" at the bottom of every page; if you switch analytics off, we delete its cookies on our site and stop loading it. Our Tag Manager container only holds Google Analytics tags, and advertising features stay switched off (Google Consent Mode, with advertising storage denied).

Bot protection

Google reCAPTCHA v3 checks that our forms are used by people, not bots. It loads only on pages with a form that uses it (the free e-book form on the home page, the contact page, the newsletter page and the account sign-up page), and elsewhere only when you start filling in the newsletter box at the bottom of the page. Google collects information about your device and how you use the page. The forms need it to work, so we don't ask for consent first. Lawful basis: legitimate interests (Article 6(1)(f)), to keep the site secure.

Code libraries

Some page code loads from cdn.tailwindcss.com and cdnjs.cloudflare.com. Your browser contacts them, so they see your IP address.

Our Cookie Policy lists the cookies in more detail.

Buying guides and courses

Payment

Stripe Checkout takes your payment. Stripe collects your card and billing details. We never see your full card number.

What we keep

Your email address, order number, Stripe payment references, what you bought, the amount, the order status and how many times you've downloaded it. If you're signed in, we link the order to your account.

Emails

Your order confirmation and download link. Then a few follow-up emails about what you bought, each with an unsubscribe link.

Review invitations

Only if you tick the optional box before checkout, we ask Trustpilot to email you once to invite a review. We send Trustpilot your email address, a first name taken from it, and your order number. The box is unticked unless you tick it, and your order is the same either way.

Lawful basis

Contract (Article 6(1)(b)) for your order. Legal obligation (Article 6(1)(c)) for tax records. Legitimate interests (Article 6(1)(f)) for follow-up emails, which you can opt out of at any time. Your consent (Article 6(1)(a)) for review invitations.

How long

Order records for 6 years after the end of the financial year they belong to, for tax.

Free e-book, quizzes and our emails

What we collect

For the e-book: your first name and email address, where you signed up (such as the homepage), whether you downloaded it, and whether you've asked for our emails. For quizzes: your answers and your result, stored without your name or email, so they aren't linked to you. A name and email are optional on quizzes. If you give them, we use them to send your result, and we keep them only if you tick the box for our emails (and then without your answers).

Copies

Free e-book sign-ups are also added to a Google Sheet we use to manage sign-ups. Our emails are sent through Google Workspace (Gmail).

Why

To send you the e-book or your quiz result, and our emails only if you ticked the box for them. You get the e-book and your result whether or not you tick it.

Lawful basis

Your consent (Article 6(1)(a)) for marketing emails, given with a separate, unticked box. Sending the e-book is the service you asked for (Article 6(1)(b)). Quiz answers may say something about your health. We don't store them with your name or email, and we only email your result when you ask us to by giving your email address, which is your explicit consent (Article 9(2)(a)). A copy of that email stays in our sent mail.

Unsubscribing

Every email has an unsubscribe link.

How long

Until you unsubscribe or ask us to delete it.

Your website account

What we collect

Your email address, name, password (stored only as a secure hash), a profile picture if you add one, whether your email is verified, and your two-step sign-in settings (including a phone number, only if you add one).

Google or Facebook

If you sign in with Google or Facebook, we receive your name, email address and profile picture from them. We don't store their access tokens. They know you signed in to our site, under their own privacy policies.

Courses

Your enrolments, lesson progress, time spent, and actions such as playing, pausing and completing a lesson. We also note when you haven't been active for 48 hours.

Lawful basis

Contract (Article 6(1)(b)) to run your account and courses. Legitimate interests (Article 6(1)(f)) to understand how courses are used.

How long

Until you ask us to delete your account. See our data deletion page.

Contacting us

If you use our contact form or email us, we get your name, email address and message in our support inbox (Google Workspace). We use them to reply. Lawful basis: legitimate interests (Article 6(1)(f)).

Who we share data with

We use these companies to run Unstuck. Most act only on our instructions (they are "processors"). Apple, Stripe, Trustpilot, Google and Meta also use some data for their own purposes, under their own privacy policies.

We may also share information if the law requires it, to protect someone's safety, or if our business is sold or reorganised. A buyer would have to keep to this policy.

Data sent outside the UK

Some of the companies above store or process data outside the UK, mainly in the US. When they do, we rely on the safeguards UK law allows. These include UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework, for companies certified under it) and the International Data Transfer Addendum to the EU Standard Contractual Clauses, which our providers include in their data processing terms.

Email us if you'd like more detail.

How long we keep it

Keeping it safe

In the app:

• Your sign-in session is kept in the iPhone Keychain. It can only be read while the phone is unlocked, and it is never copied to backups.
• You can lock the app with Face ID, Touch ID or your passcode.
• Each person can only read and write their own backup, and every field is checked before it is saved.
• Sign-in codes and IP addresses are stored only as hashes, and sign-in attempts are limited.
• Our key for Claude stays on our servers. It is never in the app.
• Our server checks Apple's signature on every purchase before it unlocks anything, and a purchase can only unlock one account.

On the website:

• Every page uses an encrypted connection (HTTPS).
• Passwords are stored only as secure hashes, and you can turn on two-step sign-in.
• Stripe handles card details. They never reach our server.

No system is perfectly secure. If a data breach puts your rights at risk, we'll tell you and the ICO, as the law requires.

Children

Unstuck and unstuck-adhd.com are for adults aged 18 and over. We don't knowingly collect information from anyone under 18. If you think a child has given us information, email us and we'll delete it.

Your rights

UK data protection law gives you these rights. Some depend on the lawful basis we use.

• Access: ask for a copy of the information we hold about you.
• Correction: ask us to fix anything that's wrong or incomplete.
• Erasure: ask us to delete your information.
• Restriction: ask us to pause using your information, for example while we check something.
• Objection: object to uses based on legitimate interests, and to marketing at any time.
• Portability: get information you gave us, under consent or a contract, in a common digital format.
• Withdrawing consent: change your mind at any time. This doesn't affect what we did before.

Doing it yourself in the app

Asking us

For anything else, including your website account, email support@unstuck-adhd.com. To stop our emails, use the unsubscribe link in any of them. To see the cookie banner again, clear this site's data in your browser.

It's free. We'll reply within one month. If a request is complex, we may need up to two more months, and we'll tell you why. We may ask you to confirm who you are, for example by writing from the email address on your account.

We can't see information that is only on your phone, so we can't send you a copy or delete it for you. Use the app for that.

Complaints

If you're unhappy with how we've handled your information, please tell us first, so we can try to put it right.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this policy

When we change this policy, we'll update this page and the date at the top. If a change matters to you, such as a new provider or a new use of health information, we'll tell you in the app or by email before it applies. Where the law requires it, we'll ask for your consent again.

Contact us

Questions about this policy or your information? Get in touch:

• Email: support@unstuck-adhd.com
• Website: unstuck-adhd.com
• Post: Eduard Vlase Limited, Milton Keynes, United Kingdom