Privacy notice

Version core-web-v1 · Effective 2026-11-13

UrgeRupt is operated by 180 Counseling Group LLC. It offers voluntary self-help activities. It does not provide counseling, diagnosis, medical treatment, withdrawal care or emergency monitoring. Using it does not establish a counseling relationship.

Eddie Collins handles app support and privacy requests at support@180counseling-group.com. Business mailing address: 180 Counseling Group LLC, Attn: Eddie Collins, 1201 6th Ave W STE 100 Unit #766, Bradenton, FL 34205, United States. Ordinary support has no guaranteed response time and is not monitored around the clock. Applicable privacy-request deadlines still apply.

Public help and account eligibility

You can use public exercises and guidance for supporting someone without an account. The first account release requires confirmation that you are at least 18 and legally able to consent to the account and its data processing where you live. We record the declaration, its version and time. This is not independent age verification; we do not request your birth date or identity document for signup. Child accounts are outside this release.

Information we process and why

Account access: your email, display name or alias, password hash, account dates and session state, privacy acknowledgment and eligibility declaration. These provide account access and record account choices. Core signup does not request a phone number; older accounts may retain a previously entered phone field.
Optional saved information: concern selections; urges, triggers, reflections, actions and activity ratings; saved activities, durations, personal instructions and guide choices; helpfulness preferences; and names or aliases and contact methods for trusted people you add. These display the information you choose to keep, provide history, adjust suggestions and offer manual contact shortcuts. Concern selections are not diagnoses. Some content may reveal sensitive health or habit information.
Security and operation: verification/reset code digests, pseudonymous request-limit records, session versions and minimal independent deletion markers. These protect access, operate the service and prevent erased accounts returning during recovery.
Requests and correspondence: hosting services process technical request information when you visit, including without an account. Support email contains what you send so we can answer your request.

You provide account and saved information. The activity catalog comes from UrgeRupt; the choice to save an activity comes from you. Trusted-contact information comes from the account holder who adds it, not automatically from the contact. Technical/security records are generated through use of the service.

Core mode does not collect new protection/device-test or voluntary pause records, import clinical records, or connect to health trackers. Historical prototype records are not erased merely by selecting core mode; linked records remain covered by full account deletion.

What you choose to save

Four independent categories cover concern selections; urges, reflections and activity ratings; saved activities and personal instructions; and trusted-contact details. Allowing one does not allow the others. Privacy review and account eligibility do not grant these optional permissions. Public exercises do not require saving.

Manage each category in saving permissions.

Withdrawing a category removes its information from the active application, including older records in that category. Removing saved activities also removes linked activity check-ins. Other categories and your account remain available. Allowing saving again does not recover removed records. Archiving an activity retains it and its history; it is different from removal.

Encrypted backups may retain historical copies until expiry. The supported recovery process omits optional concerns, check-ins, activities, contacts and their old permission records, even for accounts that never withdrew. It resets these permissions rather than silently bringing withdrawn information back.

Do not add someone’s contact details without their permission. Contact links open your device’s calling, messaging or email app, if available; UrgeRupt does not place calls or send those messages. Supporter guidance provides no access to someone else’s account.

Relationship with the counseling practice

The operator may recommend UrgeRupt as an optional external resource, including to counseling clients. Under this release’s operating scope, the operator does not review or use their app records in care. The app does not automatically exchange records with the counseling practice, provide a clinical dashboard or give individual records/reflections to sponsors. Do not enter therapy records, diagnoses, banking information, passwords or other information you do not want stored.

Cookies, account email and browser tools

Session and request-security cookies have a browser lifetime of 12 hours, with HttpOnly and SameSite=Lax protections and secure cookies in production. Logging out ends sessions; it does not delete your account or historical provider records. Verification/reset codes expire after 20 minutes and can be used once. The application stores code digests, not readable codes or pending passwords. Expired metadata is cleaned up through application operations; expiry is not immediate deletion from every historical copy. Mail-provider acceptance does not guarantee inbox delivery.

The optional exercise timer runs in the page and does not record an urge or complete an activity. Browser bookmarks and downloaded account files are controlled by your browser/device. Downloading creates a copy you control; UrgeRupt does not create a server export file or email it to you.

Providers and access

Authorized operator access and provider processing support account operation, requests, security and recovery. The core app contains no advertising or analytics SDK or data-sale feature. We do not provide saved account content to advertisers or sell it. Necessary hosting, backup and email processing is described below.

Render: Hosts the website and application database, including account/saved content and technical service records. The service is hosted in Virginia, United States. Processing terms · Security and subprocessors.
Amazon Web Services — Amazon S3: Stores encrypted historical database backups and separate minimal deletion safeguards. The configured AWS region is Ohio/us-east-2. Service and data-protection terms.
Google Workspace: Delivers verification, recovery and any activated account-warning emails, and processes support correspondence. It receives addresses and message contents; you choose what to send to support. Processing terms · Workspace subprocessors.

Providers use supporting services under their terms. A platform-wide subprocessor list does not mean every listed company receives UrgeRupt records. The listed service regions do not establish the location of every provider-managed copy. Information may be processed in the United States and other countries where providers/supporting services operate, with protections different from where you live. Contact us for information about the arrangements and safeguards relevant to your request. These links do not by themselves certify an international-transfer arrangement or worldwide compliance.

Grounds for processing

Where applicable law requires a processing ground, we use account information to provide the account service you request; rely on your separate permission for optional saving, including explicit permission where required for sensitive information; and use necessary security/recovery information for the legitimate interests of protecting accounts, preventing misuse and honoring deletion. For trusted-contact details, the purpose is the contact shortcut you request, limited to the name/alias and contact method, with the person’s permission to be listed. We do not treat the account holder’s checkbox as independent verification of that other person’s consent. Where applicable, we rely on the legitimate interests in providing that limited requested shortcut, subject to that person’s rights. We use support information to respond to your request and comply with applicable obligations. These purposes do not authorize using app records in counseling or advertising. You can withdraw optional permission; withdrawal does not change the lawfulness of earlier processing.

Retention and account deletion

Core account records are kept with the account until you remove them, withdraw the relevant category or delete the account, subject to the distinct records and exceptions below. Use Account settings for password-confirmed deletion, including before accepting an updated notice. Successful deletion removes linked records from the active database. If a request is interrupted, access can remain blocked while the operator resolves it. We retain minimal separate deletion markers to prevent erased accounts returning during recovery.

Automatic deletion for account inactivity is not currently enabled.

Encrypted S3 backups: current versions become eligible for expiration after 30 days; noncurrent versions after 1 day; incomplete multipart uploads after 7 days in the designated backup folder. Versioning and asynchronous processing mean this is not a guarantee all copies disappear within 30 days.
Known manual local backups: eligible for removal after 24 hours only after a newer independent encrypted backup passes verification. Failed checks, recovery/legal holds and processing delays extend retention. This does not inventory every provider-held copy.
Render dashboard logs: the established dashboard retention is seven days with no external log stream configured. This is not a statement about every provider-held security or operational record.
Support correspondence: reviewed for disposal 90 days after resolution, with documented ongoing-incident/legal exceptions. This is manual review, not automatic deletion or a physical-erasure guarantee.
Email/provider records: follow actual provider processing and applicable exceptions. We do not promise immediate deletion of every delivery or historical copy.
Independent deletion markers: kept separately as recovery safeguards while needed to prevent erased accounts returning. They are excluded from backup expiration; no numerical expiry is promised.

Holds and exceptions are limited to their purpose. Removing a row/file does not certify physical media sanitization. No online system can promise absolute security.

Access, correction and other requests

Your account information offers a password-confirmed core-data download and display-name correction. It includes retained core records hidden while saving is off. It does not include support email, provider logs, backups or historical protection/device records. For other access or correction requests, email support@180counseling-group.com. You do not need a new account to make a request.

Depending on applicable law and the information involved, you may have rights to confirm processing, access/copy information, correct it, request deletion, withdraw consent, restrict/object to processing or receive information in a portable form. Rights have conditions and exceptions. We verify ownership or an authorized representative’s authority proportionately before disclosure or changes; we do not use reflections as security questions. Do not send passwords, codes, the downloaded account file or sensitive documents in your initial email.

Eddie Collins handles requests within applicable deadlines, including any permitted extension and required notice. If a request cannot be fulfilled in whole or part, we explain the reason, applicable exceptions and available review/complaint routes. Reply to the same address with “Privacy request appeal” to request reconsideration; this does not imply an independent review team. Where applicable, you may contact the relevant regulator, including through the EEA authority directory or UK ICO complaint service. These do not limit other remedies or make an internal appeal a universal prerequisite.

Changes to this notice

The version and effective date appear above. Material changes to account processing are presented for review through the existing account-notice flow. Optional saving permissions remain separate choices. Declining a new notice does not itself delete your account; public help and account access/deletion remain available.