Skip to content
Sprout

Privacy policy

Last updated 11 November 2026

The short version: on iPhone, iPad and Android, everything you put into Sprout stays on your device. In the browser, you can take a test without an account and nothing is stored on our server; once you create an account, we store what you save on our server in the United States, encrypt the most personal parts, and use it only to run Sprout for you. There are no ads, we count visits with Google Analytics, and we never sell your data or share it beyond the companies that help us run Sprout (listed below). You can download or delete everything at any time.

Who we are

Sprout is provided by Template OÜ, who is responsible for your data (the “controller”). You can reach us at hello@sproutbuddyapp.com.

Sprout on iPhone and iPad

The app has no account and sends nothing to us. Your name, check-ins, notes, test answers and results, and practices are saved only on your device. If you use iCloud Backup, Apple includes them in your encrypted device backup, under Apple’s privacy policy.

  • Apple Health is off unless you turn it on. Then the app saves check-ins to Health as State of Mind and reads State of Mind from other apps. This stays between the app and Health on your devices.
  • Reminders are scheduled on your device.
  • Subscriptions are handled entirely by Apple. We never see your name, email address or payment details.
  • Crash reports: if you’ve agreed to share analytics with app developers, Apple may send us anonymous crash reports, without anything you entered.
  • Deleting: Settings › Delete all my data removes everything, including what the app saved to Health.

Sprout on Android

The Android app works like the iPhone app: it has no account and sends nothing to us. Your name, check-ins, notes, test answers and results, and practices are saved only on your device.

  • Backups: the app leaves this data out of Google’s cloud backup, so it isn’t uploaded to your Google account. If you move to a new phone with a cable or a direct phone-to-phone transfer, Android can copy it across, straight between your two devices.
  • Health services: the Android app doesn’t connect to any.
  • Reminders are scheduled on your device.
  • Subscriptions are handled entirely by Google Play. We never see your name, email address or payment details; Google tells the app only whether your subscription is active (Google’s privacy policy).
  • Crash reports: the app has no analytics or crash-reporting code of its own. If you’ve agreed to share usage and diagnostics with app developers, Google may send us anonymous crash reports, without anything you entered.
  • Deleting: Settings › Delete all my data removes everything the app has saved.

Sprout in the browser

You can look around and take tests without an account. While you take a test, your answers stay in your own browser (in a cookie that’s deleted when you close it), not on our server. To see your result and to keep check-ins, a journal and results between visits, you create a free account, and then we store them on our server.

What we store

  • Your account (if you make one): your email address, a scrambled form of your password that can’t be turned back into the password, or the fact that you sign in with Google or Apple and the identifier they give us.
  • Your settings: first name, goals, reminder time, time zone and region.
  • What you save: check-ins (mood, feeling words and notes), reflections, test answers and results, unfinished tests, and practices you’ve done. Notes, reflections, test answers and results are encrypted on our server.
  • Your subscription, if you have one: its plan and status. Stripe handles the payment; we never see your card details.
  • Sign-in records: when you last signed in, and the browser and IP address used for each signed-in session, to keep your account safe.

Your mood, answers and results are health information, which the law protects specially. We store them only because you agree to it, with the notice you see when you create your account (or before your first save, if you signed up with Google or Apple) (GDPR article 9(2)(a)). We use your account and subscription details to provide the service you asked for (article 6(1)(b)), sign-in records to keep accounts secure (article 6(1)(f)), and keep billing records because tax law requires it (article 6(1)(c)).

Who else handles it

We use a few companies to run the web app. Each handles only what it needs, under a data processing agreement:

  • Our server provider, in the United States, where your data is kept.
  • Stripe processes payments for Sprout Plus (Stripe’s privacy policy).
  • Amazon Web Services sends our emails and stores encrypted backups, in the United States.
  • Cloudflare runs our domain’s DNS and forwards email sent to hello@sproutbuddyapp.com to our inbox.
  • Bugsnag (error reports) and Scout (performance monitoring) help us fix problems. They are set up never to receive your notes, answers, results or email address.
  • Google or Apple, only if you choose to sign in with them.
  • Google Analytics counts visits, to see how people find and use Sprout. It gets the address and title of each page you open, your browser and device, and your approximate location, never what you type or save, your answers or your results. It also counts two moments, with no detail attached: that a test was started (not which one) and that an account was created (and whether with email, Google or Apple).

Our server and several of these companies are in the United States, so if you use the web app from the EU, the UK or Switzerland, your data is transferred there. Each transfer is protected by the EU–US Data Privacy Framework (with its UK and Swiss extensions) where the company is certified, and otherwise by the European Commission’s standard contractual clauses.

Emails

We send emails about your account (confirming your address, resetting your password) and your subscription. Reminder emails (a daily check-in, and retests) go only if you’ve chosen them, and every one has a link to stop them. Reminder subject lines never mention a test or how you feel.

Cookies

Google Analytics sets its own cookies to count visits. Our own cookies are strictly necessary and come only once you start a test, go through the welcome steps or sign in: one that holds your answers until you create an account and protects forms (deleted when you close the browser), and one that keeps you signed in. There are no advertising cookies.

How long we keep it

  • Your account and everything in it, until you delete it.
  • Sign-in records end with the session: 30 days after your last visit. Server logs, which include IP addresses, are kept for 14 days.
  • Backups are kept daily for 30 days and monthly for six months, so deleted data disappears from them within six months.
  • Billing records are kept by Stripe for as long as tax law requires.

Your rights and choices

You can see and change your details in Settings, download everything (Settings › Download my data), and delete everything (Settings › Delete my account). Deleting also withdraws your consent. You also have the right to object to or restrict how we use your data, and to complain to a data protection authority, such as the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). For anything else, email hello@sproutbuddyapp.com.

Sharing

Nothing is shared unless you choose Share. You see the exact text first. The link in it only names the test, for example /tests/anxiety-test; it never includes your answers or your score.

Children

Sprout is meant for people aged 18 and over, and isn’t directed at children.

Changes

If Sprout starts handling data differently, we’ll update this policy and the date at the top before the change takes effect, and tell account holders by email about important changes.