Allin — GDPR

Item	Status	Owner
Done
Consent screen — 3 separate toggles	Built	—
Settings → Privacy (revisit consent)	Built	—
Analytics/ads gated behind consent	Built	—
Amplitude stopped receiving email	Live	—
Account deletion, hardened	Built	—
Anthropic disclosed as a processor	Documented	—
DPIA + ROPA	Filed	—
iOS privacy manifest	Filed	—
Supabase, Amplitude, Apple DPAs	Confirmed	—
Retention window	Decided — 180 days	—
Website pricing	Already correct	—
Crisis screen, ForceUpgrade, referral/review prompts	Built	—
Built, not yet live
Erasure fan-out to Amplitude/Customer.io	Not deployed	Marie — go to deploy
Consent audit trail (record what was granted)	Not deployed	Marie — go to push
Pseudonymization, Stage 1	Not deployed	Marie — go to push
Redacted admin views	Not applied	Marie — go to apply
Data export + dormant-account finder	Not deployed	Marie — go to deploy
Corrected Privacy Policy	Not published	Isabel to publish
Compulsory — open
DPAs: Customer.io, Meta, RevenueCat, Anthropic	Open	Marie
ICO registration	Not checked	Isabel
Publish the corrected Privacy Policy	Open	Isabel to publish, both sign off
Pick the age-gate approach	Open	Isabel + Marie
Confirm App Store age rating	Not checked	Isabel
Desirable — open
Pseudonymization, Stage 2 + 3	Drafted	Marie — watched window
Encryption at rest	Backend built	Marie — review iOS side
Different legal domain
Marketing claims — 2 items need wording	Open	Isabel

Edge function — a small piece of Allin's own server code. Migration — a saved database change; writing one doesn't apply it. Branch — a safe copy of the code; nothing on it affects real users until it's pushed and deployed. Committed, not deployed — finished and saved, not yet switched on. Database view — a limited window onto real data, for seeing patterns without seeing private text. Pseudonym — a random token standing in for an account, so data groups by "same person" without revealing who. RLS — database rules on who can see which rows.

Replaced one bundled "allow tracking and reminders" toggle with three independent, revocable choices: reminders, analytics ("improve the app"), advertising. Open question for Isabel: there's no separate decline button — leaving every toggle off and tapping "continue" is the decline path, same button either way.

The permanent version of the same two toggles, inside Settings, for changing your mind later.

AnalyticsClient/MetaAdsClient check stored consent before sending anything — not send-first-hope-they-opt-out-later.

Removed the Segment mapping that forwarded email as a User Property. The only item on this page confirmed live in production, not just committed.

A failed deletion used to fail silently, leaving the account fully live while the app acted like it had succeeded. Now surfaces the failure instead. Also: consent now clears on delete (not on plain sign-out), so it can't carry over to the next person on that device.

recommend-plan was documented as "FTS only, no LLM" — wrong. The live app calls Claude/Anthropic on every plan generation (FTS is the fallback). Now disclosed in the DPIA, ROPA, and privacy policy draft; a signed DPA with Anthropic is the top open item as a result.

Both complete, kept current as processors changed (Anthropic added). Living documents — comment directly in the Doc.

Apple's own submission requirement — corrected to match actual ATT-gated tracking behavior.

Processor	Status	What's left
Apple	Done	Covered by the Developer Program License Agreement.
Supabase	Done	Auto-incorporated into its Terms — confirmed directly in the dashboard, no signature needed.
Amplitude	Done	Same auto-coverage, confirmed at their Trust Center.
Customer.io	Found	Needs actual signing (not automatic) — Marie, from her other account.
Meta	Not started	Marie — paused deliberately, not blocked.
RevenueCat	Blocked on login	Marie — also needs a new v2 API key while logging in.
Anthropic	Blocked on login	Marie — platform.claude.com needs its own separate login.
Segment	Not checked	Lower urgency — never receives special-category text.

Marie's decision: 180 days of inactivity, matching Segment's own retention for the same account. dormant_accounts() identifies accounts past this cutoff — identification only, no auto-delete yet.

join-allin.com states £69.99/year, matching the real App Store price — re-checked live 2026-08-19. A real mismatch once (confirmed 2026-08-14), fixed on the site since; no action needed.

Four smaller shipped pieces, grouped together: Crisis support — UK users now see Shout (text) alongside Samaritans (call), region-resolved from device locale. ForceUpgradeView — restyled to match the app's real design tokens, copy unchanged. Review + referral prompts — both use Apple's native system UI, not a custom screen; only the referral message text is Allin's own (placeholder, needs Isabel + Marie sign-off).

For any future feature reading someone's own history through a model ("we've mapped your subconscious"): send only content, never an identifier, in either direction — identity stays Allin's own side. If a future feature needs cross-call memory, the correlation key is the pseudonym, never the real account id.

All five items below are built and safe to ship, but none satisfy anything legally until they're actually protecting a real user.

Account deletion only removed Allin's own rows before — never told Segment/Amplitude/Customer.io. This function fans erasure out to all three, non-fatal per-processor failure.

record_consent_granted was never wired to a real table — the call has been silently failing since the granular screen shipped. Confirmed directly against the live database: 0 of 112 real users have any consent recorded. Fix is built: a proper table plus matching functions for both the initial grant and later Settings changes.

Additive schema only — a mapping table + trigger stamping every new check-in with a random token, nothing existing can break. Stages 2/3 (below, Desirable) are what actually deliver the protection.

Three SQL views exposing only coarse metadata (truncated id, mood-shift direction — never free text or email), plus a restricted login role. Doesn't stop a privileged/owner login — that's what pseudonymization is for.

export-user-data returns everything Allin's own tables hold, as JSON, via a new "download my data" row in Settings. dormant_accounts() just identifies accounts past the 180-day cutoff — no deletion or notification yet.

The live page is publicly readable and currently false. Corrected text is ready; not yet located in the Squarespace editor.

See the processor table above for exactly what each needs.

UK controllers must register with the ICO and pay the annual fee (~£40–60/year). Publicly checkable — one of the more commonly enforced gaps precisely because it's easy to spot.

Two sources: the Children's Code applies to any service children are likely to reach, and Allin's own Terms already promise 16+ with zero enforcement behind it. Three options: rely on the App Store rating alone (weakest); self-declared birthdate, hard-block under-16 (recommended — matches what the Terms already claim); full parental-consent flow for 13–15 (most engineering).

Separate from the age-gate above — Apple's own content questionnaire in App Store Connect. Worth confirming it still reflects the crisis-support content and emotional-distress themes now in the app.

Marie's call: go all the way, not stop at Stage 1. Stage 2 backfills every row; Stage 3 drops the real account id and tightens RLS to pseudonym-only, with a safety check that refuses to run if Stage 2 isn't complete. Needs a full backup first, and a paired one-line iOS change applied at the same moment Stage 3 runs.

AES-256-GCM, key exists only as an Edge Function secret, never in Postgres. New rows would populate an encrypted column alongside the existing plaintext one. Deliberately not done yet: switching the iOS app to actually call these functions instead of writing to the table directly — that's the single most-used code path in the app, so it gets its own dedicated review.

Everything else on the claims register is sourced and safe; two claims need Isabel's exact wording call.

ICO registration

Privacy Policy — review, sign off, publish

Marketing claims — 2 items need wording

Pick the age-gate approach (with Marie)

Sign off on the consent screen + release branch (with Marie)

Confirm the App Store age rating still matches the content

Execute the Customer.io DPA from your other account · check Meta Business Manager's DPA status · log into RevenueCat to check DPA status + generate a new v2 API key · log into platform.claude.com to check Anthropic's DPA status · deploy the 5 built-not-live items above · schedule pseudonymization Stage 2/3's maintenance window · review the encryption iOS integration · age-gate approach (with Isabel) · sign off on the consent screen + release branch (with Isabel)