Privacy
last updated · 29 August 2026
Fumbleproof is a texting practice app. This page explains what it stores, what it deliberately does not, and how to get any of it back or deleted. It is written to be read, not to be survived.
Your practice conversations are never stored — not by us, not by anyone. The app keeps the score, not the words. Signed out they never leave your phone at all. With an account — free, Pro or founding — live replies are on, so during a conversation the last few messages go to our server and on to OpenAI to write her answer, and are discarded straight after. If you make an account we store your email and your session results; you can export or delete all of it yourself, from inside the app, at any time. Uploaded real chats are different and are treated differently: the image is sent to OpenAI to be read — that is what produces the review — and is then discarded and never stored by us, and the messages inside it are kept only if you explicitly say yes when saving that partner — so you can replay it later and so we can read it to improve the coach. That conversation is half somebody else’s, which is why we ask rather than assume, and why her name is never part of it: you name her yourself. A separate choice lets you save a conversation with the coach to your account. Its text is saved when you tap Save chat. Coach screenshots are saved only if you also select “Save these screenshots privately with this chat.”
The commercial terms — what Pro costs, how it renews and how to cancel, refunds, and the fair-use cap — live on one page: the agreement. Founding members' terms are kept at /founding. There is no third document.
Who is responsible
Fumbleproof is a service of EFO Commerce, a sole trader (eenmanszaak) registered in the Netherlands, which is the data controller for everything described here.
| EFO Commerce Ruysdaelhof 11 2251 JJ Voorschoten The Netherlands |
Chamber of Commerce (KvK): 89053338 VAT (BTW): NL004690417B41 Contact: [email protected] A real person reads that address. |
What the app stores
If you only do the drills (no account)
Nothing leaves your phone except anonymous counts. Your drill results, your training week and your settings live in your browser's local storage on that device only. Clearing the site's data erases them permanently — there is no copy anywhere else.
Practice conversations need an account. They did not always, and this page said so for longer than it was true.
If you create an account
| What | Why |
|---|---|
| Your email address | It is the entire login — we use a one-time link instead of passwords, so there is no password to store or leak. |
| Session results: which practice partner, the outcome, the grade, the number of messages, and the interest curve the engine calculated | So your log and progress follow you to another device. |
| A list of one-way fingerprints of lines she has already used on you | So she does not repeat herself in your next session. These cannot be turned back into text. |
| Your purchase record, if you buy anything | To know what you paid for and until when: the Google Play reference, and the subscription's state and paid-until date that Google sends us. Your card never touches us. |
| Coach chats you choose to save | Your questions and the coach's answers, including any words the answer quotes from an attached screenshot, follow your account across devices. A coach screenshot stays available for follow-up questions during that visit. If you separately choose to save screenshots with the chat, up to two compressed image copies are stored privately with your account so you can continue on another device. You can remove an individual saved chat, export its text and saved images, or delete them with your account. An unsaved coach chat lasts only for that visit. |
The messages you type in a practice session, and the replies she gives, are never written to any database. Not ours, not anyone's. The scoring and the coaching you see on the replay screen are worked out on your device. What reaches our servers and stays there is the outcome and the numbers — never the conversation.
Whether they are transmitted at all depends on one thing, and we would rather be exact than reassuring:
- Signed out: nothing leaves your phone — the drills run entirely in your browser. Practice conversations need an account, so there is no signed-out conversation to transmit.
- Signed in, free account: live replies are on for you too, up to twelve conversations a month. During those, the last 14 messages of that one conversation go to our server and on to OpenAI to write her answer, then are dropped. If you replay a screenshot review, that context can include messages from the uploaded conversation before the fumble, so the simulated reply follows what was said. This does not create another saved copy of the conversation. Past the live allowance she keeps answering from the written bank, on your phone.
- Pro or founding member: the same thing, with a larger allowance — fifty conversations a month instead of twelve. Used to produce the reply and then dropped: not logged, not saved, not used to train anything of ours.
- After a conversation: the deeper read at the bottom of your replay is written by OpenAI too, and to write it the whole of that finished session goes the same way — both sides, up to about 29 messages, along with the grade, her final interest, and the list of what the engine scored you down for. Same terms: used to write the read, then dropped. Turn live replies off and this stops with it.
The "never stored" half is a property of how the app is built, not a promise about how carefully we behave — no code path writes a practice conversation anywhere except in the two cases below. The first has two halves that are worth separating because they are governed differently. When a screenshot review succeeds, the coach’s write-up is stored with your account straight away, the same way a session result is — where the conversation turned, why, the move, and your own lines quoted back and rewritten. That is your side of it, and it is what makes your reads worth having later. The conversation itself, her messages included, is stored only after you say yes to the question we put in front of you, which comes at your first replay or save, whichever you do first. Saying no still saves the partner, and the replay then lives on that phone alone. Her words are also kept out of the stored write-up: if the coach quotes her in it, that quote is removed before the row is written, because you were asked about the conversation and she was asked about nothing. Your 30 most recent reads are listed under Your reads, each with a remove button, and deleting your account deletes all of them — including any older than those thirty. The transmitting half is a choice you can reverse: email [email protected] and we put you back on the offline partner, at no cost and with nothing else taken away.
The second exception is reporting a reply. The app puts words in a woman's mouth and tells you to learn from her, so when it produces something wrong there has to be somewhere to say so — Google Play requires that route, and it ought to exist anyway. When you tap report on one of her messages, that message is sent to us, along with the reason you picked and anything you chose to type. It is stored so a person can look at what the app produced. Nothing you wrote in the conversation goes with it: her line, and nothing of yours. The confirmation you tap says exactly that before anything is sent, which is the only honest version of an exception — you are told what leaves before it leaves.
If you subscribe to Pro
Pro is paid through Google Play. Google collects what it needs to take the payment, and we never see or hold your card. In the Fumbleproof database we store a record that a purchase happened, its Google Play reference, and the subscription's state and paid-until date, which Google sends us whenever it renews, is cancelled or is refunded. The receipt itself is Google's.
If you bought founding access on the web, one more thing: the Stripe account Fumbleproof bills through is shared with the operator's other business, and that account forwards payment events — including your name, email and billing address — to a Google Cloud function belonging to that business, in the United States. Nothing about your training is in that data, only the purchase. It is a leftover of sharing one payment account, it is being separated, and until it is, it is listed in the table below like every other processor.
Analytics, and what we do about your privacy in it
We measure whether the app works: how many people open it, start a session, finish one, or hit an error. Those events carry the event name and a few properties — never the content of any message.
- Signed out, without your consent, these are stored as pure counts with no identifier attached at all — we can see “twelve sessions started today” and nothing about who.
- Signed in, they carry your account id, whether or not you accepted analytics cookies. That is not a tracking cookie and it goes to nobody else: it is your own activity on your own account, and it is the only way we can answer whether people come back or whether the training actually helps. It is deleted with your account. If you would rather it did not exist at all, email [email protected] and we will delete it on request without touching anything else — this page used to say “train signed out” instead, which stopped being a remedy the day practice started requiring an account.
- With your consent, a random identifier generated in your browser is attached, so we can tell whether the same person came back. It is not linked to your name or email, and it disappears when you clear the site's data.
- Microsoft Clarity records anonymised session replays so we can see where the interface confuses people. Every surface that can contain your words — the chat thread, the coach's quotes, your email address — is masked before recording, so they are not captured.
- The Meta and TikTok pixels tell us whether an ad led to somebody actually using this. TikTok now runs on the marketing page only: it was removed from the app on 4 Sep 2026, because the channel was dropped on 29 August and the pixel had gone on collecting for another week. Inside the app it is Meta and Clarity, and nothing else. They report three things: every time you open the app or the marketing page — a plain page view, with no detail about what you did — and then two moments once, the first time you open a chat and the first time you finish a session. Never what you typed, never who she was, never your grade.
- Both of those two moments are also reported from our server, not from your browser, carrying your IP address, your browser's user-agent string, and Meta's own advertising cookies if your browser has them. The honest reason: ad blockers stop the browser version for a large share of people, and without this we cannot tell which ads work. Your email address, your name and your account are never included, and this stops with everything else if you decline analytics.
Cookies and consent
If you are in the EU or EEA we ask before loading any of the tools above, and nothing is set until you say yes. Decline and the site works exactly the same — you simply become an anonymous number in a counter. Outside the EU they load by default, and you can opt out by clearing this site's data. Everything strictly needed to run the app (your login session, your settings) is not optional and is not used for tracking.
Who else touches your data
| Who | What for | Where |
|---|---|---|
| Supabase | Database and login | EU (Ireland) |
| Cloudflare | Website hosting and email forwarding | Global edge network |
| Google Play (and Google Cloud Pub/Sub) | Takes Pro payments and sends us subscription status changes: renewed, cancelled, refunded | US / global |
| Stripe | Payments (web founding purchases) | US / EU |
| Google Cloud | Receives payment events from the shared Stripe account — see “Paying” above | US |
| Resend | Sends your login email (via Supabase) | EU (Ireland) |
| OpenAI | Writes her replies, the deeper read of a finished session, and answers your coach questions. It also reads screenshots you attach to a coach conversation or upload for review. Coach screenshots are sent again for each follow-up question in that conversation. Review images are sent twice: once to check they can be coached, then to write the review. Review images are not saved; coach screenshots are saved only if you separately choose to keep them with a saved coach chat. See “About the AI” | US |
| Formspree | The waitlist form on the marketing page | US |
| Microsoft Clarity | Anonymised interface analytics | US |
| Meta | Advertising measurement — marketing page and app; also receives one server-sent copy, see “What we never store” | US |
| TikTok | Advertising measurement — marketing page only, removed from the app on 4 Sep 2026 | US |
Transfers outside the EU rest on the European Commission's standard contractual clauses, which these providers offer as part of their terms. We sell your data to nobody, ever, and we do not share it beyond what is listed here.
About the AI
Every account gets live replies now, free included, so the last few messages of a live conversation go to our server and on to OpenAI to write her answer, and are discarded straight after. That used to be founding-only and this page used to say so; it changed on 29 Aug 2026 and this sentence changed with it. Your practice partner is a scoring engine and pre-written lines running entirely on your device — the grade, her interest, every judgement about what you wrote is computed there and stays there. What leaves is only what the sentence above says leaves: the last few messages of a live conversation, to write her next reply, discarded straight after.
If you are a founding member, OpenAI does two jobs and each one sends something. Writing her next reply sends the character you are practising against, how interested she currently is, and the last 14 messages of that one conversation. Writing the deeper read under your replay sends that finished session in full — both sides, up to about 29 messages — together with the grade, her final interest, and the engine's list of what it scored you down for.
In both cases your email address, your name and your account ID are never included, so OpenAI receives the conversation without receiving you. We do not store the transcript on our servers; it is sent, answered, and gone. Both stop together — one request turns off both, and the paragraph below says how to make it. There is no switch for this inside the app today; a person does it by hand, and we would rather say that than imply a toggle you would go looking for.
We do keep one row per live reply, because that is how the per-hour and per-day limits that stop the feature being abused are counted. This sentence used to say the row held only who you are and when — nothing more. That stopped being true when we began recording what the calls cost and how they ended, and it is corrected here on 4 Sep 2026. The row holds your account ID, the time, which conversation it belonged to, how long the request and the reply were, which model wrote it, and one of three words for how it ended — delivered, filtered, or the model failing to answer. It holds nothing either of you wrote. Those rows are deleted with your account, and they are in the export.
You can have the non-AI version at any time by asking us at [email protected], and it costs you nothing — the written partner is the same one everyone else practises against.
How long we keep it
- Your account, session results, saved coach chats and any coach screenshots you chose to keep: until you delete them. You can remove a saved coach chat individually; its saved screenshots are removed with it. Deleting your account removes the rest immediately.
- Payment records: our own record of what you bought is deleted with your account. The invoice itself is held by Google Play or, for web founding purchases, by Stripe for seven years because Dutch tax law requires it — that copy is not ours to erase, and a deletion request cannot reach it.
- Analytics events: purged after twelve months.
- Waitlist emails: until you unsubscribe or ask us to remove you.
Your rights
Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict how we use it, or object to it. Two of those are one tap, no email required:
- Export — the You tab in the app hands you everything we hold, as a file.
- Delete — the You tab erases your account and everything attached to it. It is immediate and it is not reversible.
For anything else, email [email protected] and you will get an answer within thirty days, usually the same day. If we get it wrong, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Why we are allowed to hold it
- Your account and session results — to provide the service you asked for (contract).
- Purchases — contract, plus the legal obligation to keep tax records.
- Analytics and advertising tools — your consent in the EU/EEA; our legitimate interest in knowing whether the product works elsewhere.
- Anonymous counts — not personal data, so no basis is needed.
Adults only
Fumbleproof is for people aged 18 and over, and the app asks before you start. It is not directed at children and we do not knowingly hold data from anyone under 18. If you believe we do, email us and it will be deleted.
Changes
If this policy changes in a way that affects what we do with your data, we will change the date at the top and tell anyone with an account by email before it takes effect.