Version: 1.9 · Effective date: October 29, 2026 This is a translation for convenience. The Portuguese version (https://www.stopaposta.com.br/privacidade) governs in case of any conflict.

Privacy Policy: Stop Betting

What changed in this version

Website and cookies: the website now asks for your consent before using the Meta Pixel, only to measure how our ads perform (§7). Without your acceptance, nothing from Meta is loaded. The app still sends no data to ad networks.
Ads: the app does not show ads today and does not send data to ad networks (§7). Google AdMob is no longer listed as an active provider, and the option to watch an ad to earn messages with the AI no longer exists.
SMS on Android: since October 7, 2026, Stop Betting is no longer the default SMS app on Android and does not request SMS, contacts or call permissions. On Android the message filter works only by reading notifications, and it is optional. Nothing changes on iPhone.
Blocking by numeric address (IP): §3 now describes how the accessibility service reads the page text locally when the address opened is an IP number.

1. Who the controller is

The controller of your personal data, as defined in art. 5, VI, of the LGPD (Law 13.709/2018), is G DA SILVA C ROCHA DESENVOLVIMENTO DE SOFTWARE & TECNOLOGIA (trade name GROCHA Tech), CNPJ 38.323.551/0001-69, reachable by email at contato@grochatech.com.br.

The Data Protection Officer (DPO, the "encarregado" under art. 41 of the LGPD) can be reached at the same email, contato@grochatech.com.br, and by phone/WhatsApp at +55 (19) 98847-2424, the official channel for data subjects.

This Policy applies to the website www.stopaposta.com.br, to the guardian's web dashboard and to the Stop Betting apps for Android and iOS. A betting-blocking app, by its nature, processes potentially sensitive personal data related to gambling habits and relapse protection. For that reason, this Policy explains specifically how each protection mechanism works and what it sees.

2. What data we collect and why

Data	Purpose	Legal basis (LGPD)
Account (name, email or phone, and a hashed password when you sign in with email and password)	Create and secure your account	Performance of contract (art. 7, V)
Device (platform, protection level, integrity status, last heartbeat)	Keep protection running and detect attempts to turn it off	Performance of contract
Device and app integrity signals, only "yes" or "no" (USB debugging, wireless debugging, developer options, a debugger or instrumentation tool attached to the app, app signature, installation from an official store, root/jailbreak indication, automatic date/time and app-removal restrictions turned on, Screen Time on iPhone turned on or revoked). The name of whoever installed the app does not leave the device	Detect attempts to turn off or circumvent protection and warn	Performance of contract (art. 7, V)
App verification by the server: on Android, a summary of the Play Integrity verdict (app recognized, device level, licensing, version); on iOS, App Attest data (key identifier and public key of the app's key, counter, production or test environment). The Play Integrity token is not stored	Confirm that the app is the original from the store and has not been tampered with	Performance of contract (art. 7, V) and legitimate interest in the security of the service (art. 7, IX)
Integrity events while protection is active: which Settings screen or action was blocked (one reason from a fixed list, such as uninstalling, clearing data, debugging, date and time), screen capture or recording attempt (type and time; no image, only with the lock), app removed (detected by the probe in §3) and incomplete setup (the list of permissions that were missing)	Warn the guardian, show you what happened and allow support	Performance of contract (art. 7, V); consent when linking the guardian (art. 7, I) for the notice to them
App installation identifier and push notification token	Deliver notices and prevent the same device from being both the protected person and the guardian (§3)	Performance of contract (art. 7, V) and legitimate interest in the integrity of the guardianship link (art. 7, IX)
Internal record of critical alerts (identifiers, type, reason, time and which team member marked it as seen)	Support and security of the service	Performance of contract (art. 7, V) and legitimate interest (art. 7, IX)
Attempts to access a betting site/app (domain or app, date, time, channel)	Show your history and, if you authorize it, show it to the guardian	Performance of contract; consent for sharing with the guardian
Hostname of an unknown domain (never the full URL or the content)	Let the Sentinel classify in real time whether it is betting	Specific consent, explained during onboarding
Device location (precise, including in the background), only when you turn on location sharing with the guardian	Show your guardian your current position and today's route, and alert them when you enter or stay near a place where betting is possible	Specific, highlighted and revocable consent (art. 7, I, and art. 8)
Risk places that you or your guardian mark on the map	Include that place in your protection's alerts	Consent (same purpose as location)
Guardian (name, contact details, relationship)	Link the person who holds the key to your protection	Consent
PGSI screening (9 questions about gambling habits)	Personalize your experience, sensitive health data	Specific and highlighted consent (art. 11, I)
Banking-app notification matching a known betting-operator payee (Android, optional)	Alert you and, if you authorize it, the guardian about a Pix payment for betting	Specific, highlighted and revocable consent (art. 11, I)
Messages and notifications analyzed by the message filter (optional, on the device only)	Hide, filter or delete betting advertising messages	Consent; performance of the service you turned on
Conversations with Stop Betting AI (on Android)	Respond to you when the urge hits	Consent; default retention of 30 days, with an option not to store
Community messages	Moderation and abuse prevention	Consent; performance of contract (moderation)
App usage and crashes	Keep the app working (Firebase Analytics/Crashlytics)	Consent (telemetry opt-in)
Access logs (IP address, date and time)	Security and legal compliance	Compliance with a legal obligation (art. 7, II; art. 15 of the Marco Civil da Internet, the Brazilian Internet Civil Framework)
Subscription data (store receipt, status)	Bill and unlock paid features	Performance of contract

We do not collect: CPF or an identity document to create an account, bank balance or statements, any image or video of your screen, the Screen Time passcode (§3), the content of pages you visit, the text of your messages (it never leaves the device, §3), or the content of notifications that do not match the betting pattern. Without location sharing turned on, Stop Betting does not access your location.

3. How each protection mechanism works, and what it sees

Local DNS filter (serverless VPN, Android VpnService and iOS NEPacketTunnelProvider): runs entirely on your device. It decides whether to block or allow a domain lookup by comparing it against a signed list; it does not inspect the content of your traffic and does not send your browsing to us: only the hostname of an unknown domain goes to the Sentinel. Allowed lookups are resolved directly from your device: on iOS, always by a public DNS resolver: Cloudflare (1.1.1.1/1.0.0.1) or Google Public DNS (8.8.8.8); on Android, by your Wi-Fi/mobile network's own DNS when it provides one, falling back to those same public resolvers when it does not. In neither case does that lookup pass through our servers, and we do not keep a history of the allowed sites you visit.
Commitment on DNS filter (VPN) data: the data the filter handles, such as domain lookups, blocked attempts (§2) and protection events, is not sold, not used for any purpose other than running the protection described in this policy, and not disclosed to third parties. It only reaches another person when you yourself authorize it (your guardian, §4) or under a court order or a request from a competent authority (§6). It never goes to advertisers, to the advertising SDK or to marketing partners. The Sentinel analyzes the public content of an unknown domain, without any data that identifies you. Allowed lookups are resolved by your own device, directly with the public DNS resolver described above, without passing through us.
Sentinel: when you access a domain that is neither on the local list nor among the popular domains kept on the device, we send only the hostname to our server, which classifies whether it is betting and returns the verdict within seconds, with a global cache: whoever first accesses a new domain protects everyone.
Accessibility service (Android): reads the name of the app in the foreground, the address bar of supported browsers and the title of system Settings screens, only to detect and close betting apps/sites and to prevent protection from being turned off without the guardian. Only when the address opened is an IP number (no site name), it reads the visible text of that page, on the device itself, to know whether it is a betting site. That text never leaves the device; only the ip:port goes to the Sentinel. It does not read the content of other pages or what you type outside the address bar, and none of this is sent to us beyond the record of the blocked attempt.
Device Admin / Device Owner (Android, Lock with Guardian and Fortress): adds an extra step (Device Admin) or makes protection part of device management (Device Owner, Fortress Mode, only after a factory reset with your explicit full-screen consent) to make uninstalling harder without going through the guardian.
Pix detection (Android, optional, NotificationListenerService): reads only notifications from banking apps that match payee names of known betting operators. You turn this on manually, with highlighted consent because it involves sensitive data, and can turn it off whenever you want.
Message filter (paid-plan feature, optional): on Android, the same NotificationListenerService hides betting advertising notifications (SMS, WhatsApp, Telegram and other apps); on iOS, Apple's message filter extension sends betting SMS from unknown senders to the filtered folder. Apple does not let this extension access contacts, iMessage or the network. Classification happens on the device: the text of messages is never sent to us or to the guardian, and reports show only the number of filtered messages.
Location sharing with the guardian (paid-plan feature, optional): see §4.
Family Controls / Screen Time (iOS): uses Apple's .individual authorization to apply the shield to betting apps/domains. With the lock active, it also turns on three system restrictions that apply to the whole device: no removing apps, no installing apps, and keeping date and time automatic. The Screen Time passcode is set by you (or by the guardian) in the iPhone's Settings, and Stop Betting never sees that passcode: we keep only the date on which it was confirmed to have been set and the iOS version. If the Screen Time authorization is turned off, Stop Betting records it and warns the guardian. We do not access the content of your device usage beyond what the shield requires.
Settings Guard (Android): while protection is active, the accessibility service recognizes system screens that could turn it off (uninstalling, clearing app data, VPN, accessibility, debugging, date and time, among others) and closes the screen. We keep only the reason (from a fixed list), the date and the time, so you and the guardian can see what happened. We do not read the content of those screens.
App integrity verification: to know whether the app in use is the original from the store, the device generates a proof and our server checks it. On Android this is Play Integrity: the server sends the token to Google to be decoded and keeps only a summary of the verdict, not the token. On iOS this is App Attest: the attestation is generated by Apple's service from the device, and the server keeps the key identifier, the public key, the counter and the environment, not the receipt. We also read local tampering signals (debugger, instrumentation tool, app signature, installation source, root/jailbreak indication) as "yes" or "no". None of these signals reads your files, messages or apps.
Screen capture and recording: the app protects its own screen content. On Android it blocks captures and hides the thumbnail in the recent apps list; on iOS it covers the content with a privacy cover during screen recording or mirroring and in the app switcher. With the lock active, the app records that a screen recording (Android 15 or later, and iOS) or a screenshot (iOS) happened, with type and time, and warns the guardian. No image of the screen is taken, sent or stored. Not every capture can be prevented on iOS, which only notifies after it happens.
Guardian's device separate from the protected person's device: on every request the app sends an installation identifier (generated by the app itself, unrelated to your phone number or IMEI), and the server compares it with those of the protected person's devices and with the notification token, to prevent the same person from being both the protected person and their own guardian on the same phone. If that happens, the invitation or action is refused and the guardian is warned.
Removed-app probe (with the lock active): if the device goes silent for a few minutes, the server sends a content-free notification message through Firebase (FCM). If the system replies that the app is no longer installed, we warn the guardian. We use this for no other purpose.
Guardian real time: when something new appears in the timeline, the guardian's app or dashboard receives only a content-free "nudge" and fetches the data again, already filtered by the level of detail you chose.
Permission setup: you can continue without granting a permission ("Seguir sem isto", meaning "Continue without this"), after a confirmation that says what stops working. If you leave the setup with permissions missing, the device records the list of what was missing and the guardian sees that protection is incomplete, so they can offer help. Notifications are optional.

4. Guardian, alerts and location

If you have a linked guardian, they receive: integrity alerts (protection turned off, app removed, device compromised, attempt to circumvent, attempt to record the screen, incomplete setup), unlock requests and the summary you authorize. You choose how much detail of your attempt history the guardian sees. The guardian never sees an image of your screen.

The guardian must use their own device: Stop Betting refuses the invitation or action of anyone using the same phone as the protected person (§3).

Our support team also sees the critical integrity alerts of people with a lock or Fortress, in an internal dashboard and an internal email without name, email or device model (only identifiers, type, reason and time), to provide support and investigate fraud. Access is restricted and logged.

The guardian is a person you choose, not our representative. What is shown to them is their responsibility, and we have no way of controlling what they do with that information outside Stop Betting (for example, a screenshot). The guardian is also a data subject: we process their name, contact details and use of the app or dashboard under the same rules of this Policy, and they have the same rights set out in §9.

Location sharing. It is off by default and only you, the protected person, can turn it on, after a screen that explains exactly what the guardian sees and after giving specific consent and the system location permission (including "always"/background, so it works with the app closed). While it is on:

the device you choose sends your position to our server. On Android, continuously, every few minutes (more frequently near a risk place). On iPhone, when you move (about 500 meters), when you enter or leave risk places, and while the app is open; the iPhone does not keep a continuous background service;
your guardian sees, in the app or on the web dashboard, your current position and today's route on the map;
when you enter or stay for a few minutes near a place where betting is possible (lottery outlet, bingo hall, gaming house, jogo do bicho spot, casino or a place marked by you or the guardian), the guardian receives an alert;
On Android, a persistent notification on your device tells you that your location is being shared. On iPhone, there is no persistent notification: the use appears under Settings > Privacy & Security > Location Services, where you can revoke the permission, and the app shows the sharing status.

The risk-place database comes from OpenStreetMap, from a list curated by our team and from the places you or your guardian mark. A marked place applies only to your protection and is seen only by you and your guardians; our team may review it so that it applies to everyone, without any data identifying who marked it.

You can turn off location sharing at any time in the app or revoke the permission in the device settings; turning it off notifies the guardian, like the rest of the protection. If the subscription ends, sharing pauses and the guardian sees only "sharing paused". Location is never used for advertising or sent to advertisers.

5. Stop Betting AI and Community

On iPhone there is no AI chat and no facilitator in the Community; there, AI is used only to moderate and transcribe Community messages.

On Android, before using chat, a screen explains the data sent and recipients and lets you explicitly authorize or decline. Only after your decision is recorded for your account do your messages and conversation history pass through GROCHA Tech's AI gateway to OpenAI, exclusively through its commercial API. We add days since your last relapse or protection start, today's number of gambling attempts and requests for guardian help, whether you have a guardian, protection level, language, and local date/time. We do not add your name, email, phone number, GPS location or payment data; any personal data you write is also sent. This may reveal sensitive recovery information and is used to generate contextual replies.

Community requires a separate decision before entering a room. Message text and room context (previous messages and quotes) may be sent to the same providers for moderation and facilitator replies (on iPhone, moderation and transcription only). Audio you choose to record is sent through the gateway to OpenAI for transcription; the transcript is moderated and the audio is not published. Other participants see only your nickname and published message.

You can decline and use other app features. In Settings → Privacy you can review the disclosure and revoke chat (on iPhone, only if you authorized it earlier) and Community permission separately. Revocation blocks new AI transmissions and excludes your messages from subsequent room analysis context. A transmission already started before revocation may finish. The AI conversation is confidential: your guardian has no access to its content. It is used only to generate the reply and check for signs of risk. We do not use it for study, research or improving the app. There are two notice exceptions, and neither carries your words: if the AI identifies risk and you have authorized sharing risk events with your guardian, they receive only a notice that the chat or Community indicated risk (see the Community paragraph below); and if you tap "Call my guardian now", they receive a notice that you asked. The AI only proposes that button; you decide, by tapping. This confidentiality is not the professional secrecy of clinical care: Stop Betting AI is not a psychologist and does not replace treatment. In an emergency in Brazil, call 188 (CVV) or 192 (SAMU). Stop Betting keeps chat history for 30 days by default; account deletion and erasure requests follow §8.

Community messages are anonymous to other participants (no real name, no image), moderated by AI and by humans before and after publication, with internal logging for safety and legal compliance. If you authorized sharing risk events with your guardian and a crisis is detected in your Community messages, they receive the same notice as for the chat: only that you used words that indicate risk on Stop Betting, without your words and without saying which channel.

6. Who we share data with

We share the minimum necessary, only with providers that process data on our behalf and under our instructions, under contract and a duty of confidentiality:

Google Cloud: hosts our servers and database, in the São Paulo region.
Cloudflare and Google Public DNS: public DNS resolvers that receive, directly from your device, the DNS lookup for connections the filter allows (§3), to resolve the domain name into an address, the same as would happen on any device using those resolvers. On Android, that lookup may instead go to your own Wi-Fi/mobile network's DNS when it provides one.
OpenAI, through GROCHA Tech's AI gateway: receives the data in §5 for chat replies (on Android), facilitator replies (on Android) and moderation; OpenAI also receives audio for transcription. Processing may occur outside Brazil. We require equal or equivalent protection to this policy, including confidentiality, purpose limitation, security measures and data processing agreements. Only commercial API services excluding this data from training are authorized to receive it; free services using content to improve models are not authorized. OpenAI may retain data for abuse prevention and legal obligations under the contracted service: OpenAI. Sentinel may send a summary of an unknown domain's public page (§3), never your messages, audio or account context.
Email provider: sends login emails, notices and guardian alerts.
Meta Platforms (website Pixel), only with your consent: receives the data described in §7, only from people who accept cookies on the website. None of this happens in the app.
Firebase (Google): authentication, push notifications (FCM), including the content-free message of the removed-app probe (§3), and, only with your telemetry consent, usage and crash metrics (Analytics/Crashlytics).
Google (Play Integrity API), Android only: our server sends Google the integrity token the app generated, for Google to decode it and return the verdict (§3). We do not store the token. We do not send your name, email, phone or any other data of yours with it.
Apple (App Attest), iOS only: the attestation that the app is the original is generated by Apple's service from the device. Our server only checks Apple's signature, without sending any data of yours to Apple.
App Store and Google Play: processing the subscription payment; the store returns to us only the confirmation and identification of the purchase. We never see your card.
OpenFreeMap: provides the map imagery shown to the guardian. The guardian's browser or app downloads the map tiles for the area being viewed; no data from your account is sent to this service.
Guardian: as described in §4, within what you authorized.

Beyond that, we share data only under a court order or a request from a competent authority, to the exact extent ordered. We do not sell personal data and do not share health, gambling, betting, message or location data with advertisers.

7. Advertising and ad measurement

7.1 In the app

The app does not show ads and does not send data to ad networks. The ad SDK (Google AdMob) is kept off by a remote switch and, while it is off, it is not even initialized: there is no advertising consent request, no system tracking permission (ATT) and no traffic to Google for that purpose.

If this changes, we will update this Policy and ask for your consent before any ad appears. Even then, we will not send health, gambling, betting, message or location data to the ad SDK.

7.2 On the website: Meta Pixel, only with consent

We advertise Stop Betting on Facebook and Instagram. To find out whether those ads work, the website uses the Meta Pixel, a tool from Meta Platforms that measures visits and clicks.

Only with your acceptance. When you arrive, you choose Accept or Decline in the cookie notice. Until you accept, the website does not load the Pixel and makes no connection to Meta. If you decline, nothing is loaded.
Purpose: to measure ad performance, that is, how many visits reach the website and how many people click the button that leads to the app store. We do not use the Pixel for any other purpose.
Your choice: it is stored only in your browser (local storage) and is not sent to our servers.
Legal basis: consent (LGPD, art. 7, I).
What the Pixel receives: the page visit (PageView) and the click on the store button (the standard "Lead" event), plus what any browser connection sends (IP address, device and browser type, page address) and Meta's own cookies (such as _fbp and _fbc), which link the visit to the ad that was seen. We turn off the Pixel's automatic reading of page data and send no content parameters or custom events.
What never goes to Meta: health data, app usage data, gambling or betting data, messages, location, account data or payment data. Sign-up and subscription happen in the app, and the app does not talk to Meta.
Where the Pixel does not exist: on guardian invitation pages (addresses starting with /g/) and on these legal pages, even if you accepted before.
How to withdraw consent: click Cookie preferences in the footer of any page of the website and choose Decline; the Pixel stops sending data immediately. You can also clear the site's cookies and data in your browser settings, and adjust your ad preferences in your Facebook or Instagram account. Withdrawing consent does not affect processing already carried out, nor your use of the app.
Who processes it: Meta Platforms, Inc. and its affiliates, which may process this data outside Brazil (§12). Meta also processes the data as a controller under its own policy: Meta Privacy Policy.

8. Retention and deletion

You can export your data at any time from the app. You can delete your account at any time from the app; deletion enters a 7-day grace period (cancellable within that period) and then permanently erases the account and linked data.

Deletion is never blocked by an active lock. If a guardian was linked, they are notified of the request but cannot prevent it.

Specific periods:

Location: each route point and each record of passing near a risk place is automatically deleted 7 days after it is recorded. Turning off sharing stops sending immediately.
AI conversations (on Android): 30 days by default, or nothing, if you choose not to store them.
Filter messages: the text stays only on the device; we keep only the count.
Integrity signals and events, App Attest data, installation identifier and internal alerts: kept while the account exists and deleted with it (§8, first paragraph). There is no separate automatic deletion. The Play Integrity token, the App Attest receipt and any image of the screen are not stored; the one-time challenge of the verification expires in 10 minutes.
Telemetry: according to Firebase's standard retention, subject to your consent.
Access logs: 6 months, kept confidential, as required by art. 15 of the Marco Civil da Internet.
Record of acceptance of these documents and billing data: the applicable tax and accounting retention period (5 years, arts. 173 and 174 of the Código Tributário Nacional, the Brazilian National Tax Code), kept only for that purpose after account deletion.
Data that the law requires us to keep, or that is necessary to exercise rights in judicial, administrative or arbitration proceedings (art. 16 of the LGPD), is kept for as long as necessary, even after deletion.

9. Your rights and how to exercise them (LGPD art. 18)

Confirmation of processing, access, correction, anonymization/blocking/deletion, portability, deletion of data processed with consent, information about sharing, information about the right not to consent, and withdrawal of consent.

You exercise deletion yourself in the app (§8); other requests go through the channel in §1 and are answered within 15 days (art. 19, II, of the LGPD). You can also request a review of decisions made solely on the basis of automated processing (art. 20 of the LGPD), such as automated Community moderation. In addition, you can file a complaint with the National Data Protection Authority (ANPD).

Each consent can be withdrawn in the app itself, and system permissions (location, notifications, accessibility) can be revoked at any time in the device settings. Withdrawal may limit or disable the features that depend on it, and turning off a protection mechanism may trigger a notice to the guardian.

10. Security

Communication between your device and our servers is encrypted in transit (HTTPS/TLS), and access to data is restricted to those who need it to operate the service.

No measure eliminates risk completely; if there is a security incident that may pose a relevant risk to you, we will notify you and the ANPD, describing what happened and the measures taken, as provided in art. 48 of the LGPD.

11. Minors under 18

Stop Betting is intended for people aged 18 and over and is not directed at children or adolescents. We do not knowingly collect data from anyone under 18. Age is declared by you at sign-up; if an account belonging to a minor is identified, it is closed and the data erased, except for what the law requires us to keep.

12. International data transfer

Our servers are in Brazil (Google Cloud, São Paulo), but some of our providers (Firebase/Google, including Play Integrity; Apple, with App Attest; OpenAI; Meta, for the website Pixel, only with your consent; and the email provider) are based or process data outside Brazil. The public DNS resolvers named in §6 (Cloudflare and Google Public DNS) may also process the DNS lookup outside Brazil, directly from your device, without passing through our servers. The transfer takes place under arts. 33 to 36 of the LGPD, supported by the data protection contractual clauses these providers offer, and limited to what is necessary to perform the contract with you.

13. Users outside Brazil

We operate from Brazil under the LGPD. If you are in another country, we process your data to the same standard as this Policy and honor the rights provided by your local law whenever applicable, through the same channels listed here.

14. Changes to this Policy

We may update this Policy. The current version is always published on this page, with a version identifier and effective date.

A material change (new controller, new purpose, new data) is announced in the service itself and requires new acceptance on your next access.

15. Contact

G DA SILVA C ROCHA DESENVOLVIMENTO DE SOFTWARE & TECNOLOGIA (GROCHA Tech), CNPJ 38.323.551/0001-69.

DPO and data-subject channel: contato@grochatech.com.br, phone/WhatsApp +55 (19) 98847-2424.