Privacy Policy

Cleave is a faith-centred marriage enrichment application designed to help couples grow, communicate, and build covenant-strong marriages.

Cleave is operated by Sagacity Network Ltd, a company registered in England and Wales (company number 15712287), whose registered office is at Pendle Drive, Basildon, SS14 3LT. Sagacity Network Ltd is the data controller responsible for your personal data.

For any privacy-related enquiries, or to exercise your data protection rights, please use our privacy contact form. If the form is unavailable, email hello@cleaveapp.com.

We collect and process the following categories of personal data:

• Account information — email address, first name, and authentication credentials (managed by Supabase Auth)
• Profile data — gender, date of birth, wedding date, and church affiliation (all optional)
• Marriage health data — assessment responses, pillar scores, journal entries, and devotional progress
• Couple interaction data — daily question answers, check-in responses, love notes, and exercise completions
• Subscription data — Stripe customer ID and subscription status (we never store card numbers or bank details)
• Order and delivery data — if you buy from our shop, your name, email address, delivery address, and order details. Payment is handled by Stripe (we never store card numbers); to fulfil a physical order, your name and delivery address are shared with our print partner, Printify, as described below
• Referral data — if you invite friends using your personal invite code, we record which existing member invited a new member, so we can attribute and recognise your sharing
• Newsletter & marketing data — if you subscribe to our newsletter (including from our blog, even without an account), your email address and subscription status
• Feedback data — if you submit feedback or a suggestion through the in-app feedback form, we store your message, its category, and your email address if you choose to provide one, so we can follow up
• Contact enquiry data — if you use our contact form, we store your name, email address, message, topic and preferred reply method. If you choose WhatsApp, we also store the number you provide and the time you consented to a WhatsApp reply. A pseudonymous network identifier is retained with the enquiry to prevent form abuse
• Technical data — push notification tokens, device type, and first-party usage analytics (in-app activity events linked to your account, used to improve the service)

Cleave is built around your connection with your spouse, so some information is visible to your linked spouse only— for example, when you were last active in the app, and your status when using an in-the-moment tool like Send a Pause. This is never visible to anyone else.

• Providing and personalising the Cleave service
• Delivering daily devotionals, couple questions, and personalised content
• Processing payments and managing subscriptions via Stripe
• Fulfilling and delivering shop orders, including passing the delivery details of physical orders to our print and delivery partners
• Sending transactional emails (spouse invitations, account notifications) via Resend
• Sending our newsletter and occasional marketing emails via Resend, where you have opted in — you can unsubscribe at any time using the link in every email
• Delivering push notifications you have opted into (nudges, reminders)
• Measuring how features are used so we can improve Cleave

Under UK GDPR, we rely on the following lawful bases to process your personal data:

• Performance of a contract — to create and manage your account and provide the features you sign up for
• Consent — for push notifications, newsletter and marketing emails, optional profile details, and our processing of special category data (see below); you may withdraw consent at any time
• Legitimate interests — to keep the service secure, prevent abuse, and improve Cleave using first-party usage analytics
• Legal obligation — where we must retain certain records (for example, payment records) to comply with the law

Special category data.Because Cleave is a faith-based service, some data you choose to provide — such as your church affiliation and your responses to faith-related content — may reveal information about your religious beliefs. This is “special category” data under Article 9 of the UK GDPR. We process it only with your explicit consent, which you give by choosing to provide this information and use these features, and which you can withdraw at any time by contacting us or deleting the relevant data.

Your data is stored securely in Supabase, hosted in the EU-West region. All data is encrypted at rest and in transit using industry-standard TLS encryption. We implement Row Level Security (RLS) policies to ensure that each user can only access their own data. Couple data is shared only between linked partners.

We follow security best practices including regular dependency updates, secure authentication flows, and minimal data collection principles.

We use the following trusted third-party services:

• Supabase — database hosting, authentication, and serverless functions (EU-West)
• Stripe — payment processing for subscriptions and shop orders (PCI DSS Level 1 compliant)
• Printify — print-on-demand fulfilment for physical shop orders. When you buy a physical item, your name and delivery address are shared with Printify and its print and delivery providers for the sole purpose of producing and posting your order
• Resend — transactional email delivery
• Anthropic (Claude API) — if you use the AI love-letter feature, the couple's own daily-question answers are sent to Anthropic's API to generate a personalised letter woven from your own words. Anthropic processes this text only to generate the response and, under its standard commercial API terms, does not use it to train its models.
• Google Fonts — typeface delivery (no tracking cookies)
• Vercel — application hosting and deployment
• HaveIBeenPwned (Pwned Passwords API) — during account creation and password changes, your password is checked against a database of known breached passwords using a secure k-anonymity protocol. Only a partial hash prefix is sent; your actual password is never transmitted.

We do not sell, rent, or share your personal data with any third parties for marketing purposes.

Some of these providers may process data outside the UK (for example, in the United States). Where that happens, the transfer is protected by appropriate safeguards — such as UK adequacy regulations or the International Data Transfer Agreement (or equivalent Standard Contractual Clauses).

Cleave uses minimal browser storage. We store a theme preference in localStorage and use a Supabase session cookie for authentication. We do not use tracking cookies, advertising pixels, or any third-party analytics that track individual users.

Under UK data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct any inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Data portability — receive your data in a structured, machine-readable format
• Object — object to certain processing of your data
• Withdraw consent — withdraw consent at any time where processing is based on consent

Many of these are available directly in the app — you can export a copy of your data or permanently delete your account at any time from your Profile settings. For any other request, use our privacy contact form; we aim to respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or by calling 0303 123 1113. We would, however, welcome the chance to address your concerns directly before you approach the ICO.

We retain your personal data for as long as your account is active. You can delete your account at any time from your Profile settings; doing so removes your personal data and the couple content you shared (your spouse keeps their own account). Where any data cannot be removed immediately, it is permanently deleted within 30 days. Newsletter subscribers can unsubscribe at any time using the link in every email. Aggregated, non-identifying data may be retained for service improvement.

Cleave is designed for married couples and is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notification. Continued use of Cleave after changes constitutes acceptance of the updated policy.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please use our privacy contact form. If the form is unavailable, email hello@cleaveapp.com.