Privacy Policy

Nightshore · Last updated 13 September 2026

Nightshore helps people recover from compulsive pornography use. That makes almost everything the app holds sensitive, and the app is built accordingly: there is no advertising, no analytics, no tracking, and no sale or sharing of your data with data brokers.

Who we are

Nightshore is the data controller for everything described here. Our postal address is Prime Apartments, 483 Green Lanes, London N13 4FG, United Kingdom, and the fastest way to reach us about anything on this page is support@nightshore.app.

We have not appointed a data protection officer. Data protection enquiries go to that email address and are answered by the team responsible for the app.

You do not need an account

Nightshore creates an anonymous account on first launch. It has no name, no email address and no phone number — just a random identifier that your data is stored against. We cannot identify you from it.

You may optionally link an email address so your progress survives a lost phone. If you do, we store that address and use it only to let you sign back in. Nothing else.

What we store

• Your recovery record — streak and start date, slips you log, urge triggers, Panic sessions, evening check-ins, reflections and letters you write, and the journeys you write.
• Your answers to onboarding and profile questions.
• Your progress — experience, level, badges you have earned, and which course lessons you have finished.
• Your community activity, if you use it — see below.
• Your age confirmation — the yes/no result of the 16+ question asked on first launch, and when you answered it. We do not keep the year you entered.
• Subscription status — whether Premium is active. Payments are handled by Apple; we never see your card details.
• Your email address, only if you chose to link one.

Ember, the AI companion

Premium includes an AI companion called Ember. Your conversation is stored on your device, not on our servers — we keep only a count of how many messages you have sent today, so we can apply a fair-use limit of 50 a day.

When you send a message, it goes through our server to Anthropic, which runs the model that replies. So that the reply is about you rather than generic, we read context from your account at the moment the reply is written and send it along. That is this list and nothing else — the same list the app shows you before you first open Ember:

• your streak, the urges you have survived, and the date of your last slip;
• your recovery insights — the lines drawn from your check-ins, Panic sessions and slips;
• your answers to onboarding, check-in and profile questions, and the questions themselves;
• your journeys;
• the last 20 messages in that conversation, and the one you just wrote.

None of it is kept afterwards. We do not store the message, the reply, or the context we assembled to produce it.

Your conversation is used by one other feature, and only one: if you press "Build my set", recent messages from it are sent along with that request. See the next section.

Ember is not a therapist, a doctor or a crisis service.

"Build my set"

Premium includes a button that builds your Panic set for you. It sends a short description of your account to the same company, Anthropic, which chooses which of our written journeys suit you and in what order.

What we send is this and nothing else:

• where and when your urges usually happen, and what usually sets them off, as categories rather than sentences — plus counts of your Panic sessions, check-ins and slips, and how many days it has been since the last one;
• the interests you ticked, from our fixed list;
• the list of journeys we could give you;
• up to five of your own community posts — the ones you wrote, from the last 30 days, shortened, and never one that has been hidden after reports.
• up to ten recent messages from your Ember conversation, if you have used Ember and accepted its consent screen — shortened, and sent from your device.

Only posts you wrote yourself. Nobody else's post, and no reply you left on somebody else's post, is ever included. Your Ember messages are sent from your phone, because that is the only place they exist — we hold no copy, as described above. Nothing is sent from Ember if you have never used it, if you did not accept its consent screen, or if you have cleared the conversation.

Nothing else you write is sent. Not your journeys, not a Beacon, not a letter to yourself, and not what you wrote after a slip. Nothing is kept afterwards: not what we sent, and not the answer.

Community

Nightshore has a community feed. It has no profiles, no handles and no way to follow anyone. Other people never see who wrote a post. Posts are stored against your account internally, which is why deleting your data deletes your posts with it.

If you use it, we store the post and the event behind it, any line of text you add, the reactions and replies you leave, any report you make, and anyone you block. Posts, the text on them and your replies are visible to other people using Nightshore.

Nothing here goes away on its own, and you are the only one who can take a post down. Community → Your posts → Remove this post takes it out of the feed for everyone immediately and deletes the words — we keep no copy and there is no undo. Deleting all your data still removes everything, and is described under Deleting everything. Write anything here as though it is staying, because it is until you remove it.

What stays behind when you remove a post. We keep a small internal record that a post of that kind existed, when, and any reports made against it. It holds none of your words and it is never shown to anyone. It is there for two reasons: so that removing a post cannot be used to get around the sharing limits, and so that removing a reported post does not erase the report. Replies other people wrote under the post are not deleted either — they are somebody else's words, not ours or yours to destroy — but nobody can reach or read them once the post is gone.

You can also delete a reply you wrote, and you can rewrite the line on one of your own posts or take the words off it. We keep no record of what a line said before — no version history, no edit time, and no way for anyone, including us, to recover the earlier wording.

Reporting and blocking are described in the terms. Both are recorded against your account — a report so that reports can be counted, and a block so we know whose posts to keep out of your feed. Neither is ever shown to the person on the other end of it.

If you have unlocked the Beacon — one sentence written for somebody in their first week — we store that sentence against your account until you remove it in the app. It is shown to people in their first week once we have approved it, and stops being shown 30 days after you write it. Removing it in the app deletes it.

Anything you write here is genuinely public within the app, and stays that way until you take it down. Please do not put anything in it that you would not want another person using Nightshore to read, or that you would mind still being there in a year.

Reminders

If you turn on the evening check-in reminder, it is scheduled by your own device — the reminder and its text never leave your phone, and we are not told whether it was shown or opened. You can turn it off in Nightshore, or in your device's notification settings.

Site blocking

If you turn on site blocking, Nightshore installs a DNS configuration profile that routes your device's DNS lookups through NextDNS, which is what performs the filtering.

Be aware of what this means: while site blocking is on, NextDNS receives the DNS queries your device makes — not only for adult sites, but for every domain your device looks up, including in other apps. Turning site blocking off in Nightshore removes the profile and stops this.

The course by email

Our website offers the course by email, one lesson a day. If you type an address into that form, we store it until you unsubscribe, and we send you nothing until you click the confirmation link in the first email. Every email after that has an unsubscribe link; using it stops the sending and keeps only a record that you asked us to stop, so a later form submission cannot re-add you.

That address is never linked to the app. The list holds no app identifier, the app holds no email, and nothing joins the two. Your answers to the quiz on the same page are never sent to us at all — they stay in your browser. The emails themselves are delivered by Resend.

So that we can tell which lessons are worth their place, Resend reports back whether each email arrived and whether the link in it was clicked, and we keep that: the lesson number, the delivery result, and whether its link was clicked. That record is filed against the individual email, not against your address, and it holds no location, no device and no IP address. The link in a lesson passes through Resend on its way to our site, which is how a click is counted. There is no open tracking — no invisible image in the email.

Who else processes your data

• Supabase — database and authentication hosting.
• RevenueCat — subscription status.
• Anthropic — Companion replies, and "Build my set" (see both above).
• NextDNS — DNS filtering, only while site blocking is on.
• Sentry — crash reports (see below).
• Resend — the course by email, only if you asked for it on the website (see above).
• Cloudflare — hosts the website and counts its visits, without cookies.
• Apple — payments and app distribution.

The app uses no advertising or analytics services, and we do not track you across other apps or websites. Our website uses Cloudflare Web Analytics to count visits: it sets no cookie, stores no identifier and fingerprints nothing — it tells us how many people read a page, not who.

Two honest details about that list. Because these services are reached over the internet, each one necessarily sees your device's IP address in order to answer the request — that is true of any app and we do not do anything further with it. And your subscription record at RevenueCat is filed under the same anonymous identifier your Nightshore account uses, which is how a restored purchase finds its way back to you.

When the app crashes

If Nightshore crashes, a report is sent to Sentry so we can fix it. That report contains the technical details of the failure — where in the code it happened, your device model, your iOS version and the app version.

It does not contain anything you wrote or did. We deliberately do not attach your account identifier, so a crash report cannot be traced back to you or to your recovery record. The app also switches off the parts of the crash reporter that would otherwise record a trail of your activity: no screenshots, no screen recording, no log of which screens you visited or what you tapped, and no record of the requests the app made.

Deleting everything

Open Settings → Delete my data in the app. This permanently deletes your account and every row associated with it, in our database and on your device. It is immediate and cannot be undone — there is no recovery period, and we have no way to restore it for you.

That includes everything you put in the community feed — your posts, the lines of text on them, your replies, your reactions, your reports and your blocks. They hang off your account and go when it goes, including the record left behind by any post you removed yourself.

Two things sit outside that database and are not removed by it: your subscription record with RevenueCat, and any crash report already sent to Sentry (which carries no account identifier, so there is nothing in it to find you by). Deleting your Nightshore account also does not cancel an active subscription — cancel that in your Apple account settings.

How long we keep things

Everything, until you delete it. Nothing in Nightshore is deleted on a timer — not your recovery record, and not what you write for other people either. A recovery history is only useful over time, so it is kept until you remove it.

One thing stops being shown on a clock, which is not the same as being deleted: a Beacon stops being shown 30 days after you write it. It stays on your account until you remove it in the app.

Two things remove data: Settings → Delete my data, which removes all of it, and Community → Your posts → Remove this post, which deletes that post's words. There is no third — no nightly job, no expiry, nothing that quietly tidies up behind you.

How we protect it

Your data is encrypted in transit and at rest. Every table in our database is protected by row-level security, and your recovery record is readable only by your own account — there is no query, from the app or from anywhere else, that returns another person's streak, slips, check-ins, reflections, letters, journeys or answers.

The community feed is the deliberate exception. What it hands to another person is only the moment, the line of text if you added one, the reactions and the replies — never the account behind them, and never anything else on your account.

Where your data is processed

The providers listed above operate in the United States, so your data may be processed outside the UK and the EEA. Where that happens we rely on the UK International Data Transfer Agreement and the EU Standard Contractual Clauses.

Your rights

We process this data to provide the app to you under our agreement with you, and — for the sensitive parts, which is most of it — on the basis of your consent, which you can withdraw at any time by deleting your data.

Depending on where you live, you may have rights to access, correct, export or erase your data, and to object to or restrict its processing. Deletion is available directly in the app; for anything else, email us at support@nightshore.app.

You also have the right to complain to a data protection supervisory authority. Ours is the UK Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk, helpline 0303 123 1113. If you are in the EEA, you may also complain to your own local authority.

Age

Nightshore is for people aged 16 and over. The app asks for your year of birth on first launch and will not let you continue if you are under 16; it keeps only the yes/no answer, not the year.

The app creates its anonymous account before that question is answered, so an account that answered "under 16" does exist. It holds that answer and nothing else — the gate is where the app stops, so there are no onboarding answers and no recovery record behind it. We do not knowingly collect anything further from anyone under 16. If you believe we have, email us and we will delete it.

Changes

If this policy changes materially, we will update the date at the top and note the change in the app.