Privacy Policy
Sunbreak for Android · last updated 1 August 2026
Sunbreak is a mood tracker that adapts to what you are tracking — bipolar, depression, anxiety, or no diagnosis at all. It works completely offline with no account. If you choose to create one, some of what you write is copied to a server so your other devices can read it. This page says exactly which parts, and what happens to them.
The short version
- No account is required, and without one nothing you write leaves your phone.
- There is no analytics, no advertising, no tracking and no crash reporting. None of these exist anywhere in the app.
- Nothing is ever sold, and nothing is shared with anyone except the people you explicitly invite.
- Your safety plan and your PIN never leave the device, whether or not you have an account.
- You can delete your account and everything on the server from inside the app, or by asking here.
Without an account
This is how the app behaves until you deliberately set up sync. It is the default and most people never change it.
Your check-ins, notes, tags, medications, dose records, safety plan and settings are written to this app's own private storage on your phone. No copy is sent anywhere. The app has no way to read that storage from outside the device, and neither do we — there is no server holding it.
The trade-off is that the data is yours to lose. If you uninstall the app or lose the phone, it is gone. The export screen makes a full backup you can keep somewhere else.
With an account
An account exists to do two things: keep your days on more than one device, and let you show some of them to someone you trust. It is optional, it is off until you set it up, and signing out leaves every entry on your phone.
What we hold about you
Your email address, and nothing else that identifies you. There is no name, no phone number, no date of birth, no location and no device identifier. Signing in is a one-time code sent to that address; there is no password.
What syncs
| What | Fields |
|---|---|
| Check-ins | Date, the time you recorded it, mood (−5 to +5), energy, irritability, anxiety, hours slept, sleep quality, and the note you wrote for that day |
| Tags | Name, category, emoji, whether archived, whether it offers the safety plan |
| Medications | Name, dosage, the times of day you take it, colour, whether you are still taking it, and any notes you added |
| Dose records | Which medication, which day and scheduled time, whether it was taken or skipped |
| Which tags are on which day | The links between the two |
What never syncs
Your safety plan, your PIN and app-lock setting, your app settings, and your choice of what you are tracking. These stay on the device, always. If you delete the app they are gone even if everything else is still in your account, so export a copy if you want to keep them.
What sharing creates
If you invite someone, the app also stores:
- The invitation itself — a code, the access level you chose, and when it was created, used or revoked. The code stops working after three days or once it has been used, whichever comes first.
- A summary, but only if you shared at summary level. It holds counts and averages over a window of days: how many days you logged, your mean mood, a stability score, your current streak, how many days fell in each zone, how many were mixed, mean hours slept, the date of your last check-in, and whether an early-warning reading is currently raised. It contains no individual day and no note. That distinction is the whole point of the two levels, and the code enforces it rather than relying on the wording.
- A one-time link, if you make one for an appointment. This stores a generated PDF of your clinical summary in a private area, plus the address and its expiry. The link works for 48 hours and you can end it sooner. Nobody can reach the file without that link, and it is not indexed or listed anywhere.
Someone you have invited sees only what their access level allows, and only for as long as you allow it. Revoking takes effect immediately.
Where the data is held
On Supabase, which provides the database, the sign-in and the file storage. Supabase acts as a processor on our behalf and does not use your data for its own purposes.
The project is hosted in the European Union, in Supabase's Paris region.
Emails containing your sign-in code are delivered by Resend on our behalf, from their EU region. They receive your address and the message itself; they do not receive anything else about you.
Every table is protected by row-level security that denies access by default. A signed-in account can reach only its own rows, plus rows explicitly shared with it. This is enforced by the database, not by the app.
How long it is kept
- Your entries — until you delete them or delete your account. Deleting a day marks it deleted and syncs that deletion to your other devices, so they do not bring it back; the marker is removed with the rest when the account goes.
- Invitation codes — three days, or until used.
- Appointment links and the PDF behind them — 48 hours, or until you end them.
- Exported files — these are built on your phone and handed straight to the share sheet. A copy sits in the app's cache for one hour and then clears itself. They are never uploaded.
What the app asks your phone for
- Notifications — for the reminders you switch on. The text is deliberately vague and never names a mood, a number or anything from a note, because other people read lock screens.
- Run at startup — so reminders survive a reboot.
- Vibration — for those same reminders.
- Internet and network state — used only by sync and sharing. With no account, the app makes no network requests at all.
The app does not ask for location, contacts, the camera, the microphone, or access to your files beyond the ones you pick yourself when importing or exporting a backup.
Children
Sunbreak is not directed at children and we do not knowingly hold data from anyone under 16. If you believe a child has created an account, write to hello@sunbreakapp.com and it will be removed.
Your choices
- Use it without an account. Nothing is lost by doing so; every feature except sync and sharing works the same.
- Get a copy. The export screen produces a full JSON backup, a spreadsheet, and a readable clinical summary — all built on the device.
- Stop sharing. Revoke any invitation at any time, from Sync & Sharing.
- Sign out. The device stops sending and receiving. Every entry stays on the phone.
- Delete everything. See deleting your account.
If you are in the UK, the EU or another region with equivalent law, you also have the right to access, correct, export, restrict or object to our handling of your data, and to complain to your data protection authority. In practice the app already gives you direct access to all of it; write to hello@sunbreakapp.com if you need something the app cannot do.
Changes
If this policy changes in a way that affects what leaves your phone, the app will say so rather than quietly updating this page. The date at the top always reflects the current version.
Who controls this data
The data controller is Robertas Gaigalas, Mogiliovo g. 4, Klaipėda, Lithuania.