Privacy Policy

Cleave is a faith-centred marriage enrichment application designed to help couples grow, communicate, and build covenant-strong marriages.

Cleave is operated by Sagacity Network Ltd, a company registered in England and Wales (company number 15712287), whose registered office is at Pendle Drive, Basildon, SS14 3LT. Sagacity Network Ltd is the data controller responsible for your personal data.

For any privacy-related enquiries, or to exercise your data protection rights, please contact us at hello@cleaveapp.com.

We collect and process the following categories of personal data:

• Account information — email address, first name, and authentication credentials (managed by Supabase Auth)
• Profile data — gender, date of birth, wedding date, and church affiliation (all optional)
• Marriage health data — assessment responses, pillar scores, journal entries, and devotional progress
• Couple interaction data — daily question answers, check-in responses, love notes, and exercise completions
• Subscription data — Stripe customer ID and subscription status (we never store card numbers or bank details)
• Technical data — push notification tokens, device type, and basic usage analytics

• Providing and personalising the Cleave service
• Delivering daily devotionals, couple questions, and personalised content
• Processing payments and managing subscriptions via Stripe
• Sending transactional emails (spouse invitations, account notifications) via Resend
• Delivering push notifications you have opted into (nudges, reminders)
• Generating anonymised, aggregated insights to improve the service

Under UK GDPR, we rely on the following lawful bases to process your personal data:

• Performance of a contract — to create and manage your account and provide the features you sign up for
• Consent — for push notifications, optional profile details, and our processing of special category data (see below); you may withdraw consent at any time
• Legitimate interests — to keep the service secure, prevent abuse, and improve Cleave using anonymised, aggregated insights
• Legal obligation — where we must retain certain records (for example, payment records) to comply with the law

Special category data. Because Cleave is a faith-based service, some data you choose to provide — such as your church affiliation and your responses to faith-related content — may reveal information about your religious beliefs. This is “special category” data under Article 9 of the UK GDPR. We process it only with your explicit consent, which you give by choosing to provide this information and use these features, and which you can withdraw at any time by contacting us or deleting the relevant data.

Your data is stored securely in Supabase, hosted in the EU-West region. All data is encrypted at rest and in transit using industry-standard TLS encryption. We implement Row Level Security (RLS) policies to ensure that each user can only access their own data. Couple data is shared only between linked partners.

We follow security best practices including regular dependency updates, secure authentication flows, and minimal data collection principles.

We use the following trusted third-party services:

• Supabase — database hosting, authentication, and serverless functions (EU-West)
• Stripe — payment processing (PCI DSS Level 1 compliant)
• Resend — transactional email delivery
• Google Fonts — typeface delivery (no tracking cookies)
• Vercel — application hosting and deployment
• HaveIBeenPwned (Pwned Passwords API) — during account creation and password changes, your password is checked against a database of known breached passwords using a secure k-anonymity protocol. Only a partial hash prefix is sent; your actual password is never transmitted.

We do not sell, rent, or share your personal data with any third parties for marketing purposes.

Some of these providers may process data outside the UK (for example, in the United States). Where that happens, the transfer is protected by appropriate safeguards — such as UK adequacy regulations or the International Data Transfer Agreement (or equivalent Standard Contractual Clauses).

Cleave uses minimal browser storage. We store a theme preference in localStorage and use a Supabase session cookie for authentication. We do not use tracking cookies, advertising pixels, or any third-party analytics that track individual users.

Under UK data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct any inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Data portability — receive your data in a structured, machine-readable format
• Object — object to certain processing of your data
• Withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, please email hello@cleaveapp.com. We aim to respond to all requests within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or by calling 0303 123 1113. We would, however, welcome the chance to address your concerns directly before you approach the ICO.

We retain your personal data for as long as your account is active. If you choose to delete your account, all associated personal data will be permanently removed within 30 days. Anonymised, aggregated data may be retained for service improvement purposes.

Cleave is designed for married couples and is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notification. Continued use of Cleave after changes constitutes acceptance of the updated policy.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at hello@cleaveapp.com.