Privacy Policy for the NA App

The party responsible for data processing in this app is:

Narcotics Anonymous Regions-Service Komitee e.V. (NARSK e.V.)
c/o Narcotics Anonymous Büro
Haus der Volksarbeit
Eschenheimer Anlage 21
60318 Frankfurt am Main
Germany
Represented by the board: L. Bittner
E-mail: vereinsvorstand@narcotics-anonymous.de

This statement describes what data the app processes. There is no advertising and no sharing of your data for advertising purposes.

1. Data stored on your device

Your name, clean date, favourites, subscribed channels, listened markers, and settings are stored by the app on your device. This information is optional and is not transmitted to us or to third parties. You can change or delete it at any time in the options.

Your name and clean date are not transmitted to us. They only leave your device if you choose so yourself: your name, if you include it when sharing your inventory or gratitude list, both, if you export them to a backup file under “Import & export”, and your clean date – with a name, if you wish – if you pass it on using “Share clean day”. If you enable the cloud backup (see section 9), the remaining data listed above – favourites, subscribed channels, listened markers, and settings – is backed up to your own Google cloud; your name and clean date are explicitly excluded from it.

Your daily inventory and gratitude lists are likewise stored only on your device, in encrypted form: the key is created in your device’s protected hardware storage and cannot be read out, not even by us. When you open them, the app asks for your screen lock (fingerprint, face, pattern, PIN or password). They are not transmitted to us or to third parties and are not part of the cloud backup. You can delete single days directly in the inventory section, and all entries or single years and months in the options under “Inventory”. If you share an entry via the share menu or the clipboard, or export a period as a PDF, it goes to the app, person or storage location you choose; we have no influence over that. To share a PDF, the app briefly stores the file in its own cache on your device; it is deleted with the next export or the next time you open the PDF dialog, and it is not part of the cloud backup.

Your friends’ clean days (name, day, month and, if you wish, the year) are stored by the app on your device only. They are not transmitted to us or to third parties and are not part of the cloud backup. You can change or delete them at any time in the options under “Clean days”.

With “Share clean day” you can show your clean date and, if you wish, a name as a QR code or send them as a link. The code and the link contain only this information. Anyone who scans the code or receives the link can see it. The recipient can forward a link you send; we have no influence over that. The link points to our website narcotics-anonymous.de. The information is placed after the “#” character; browsers do not transmit this part to our server, so it is neither received nor stored there. If someone opens the link without the app, their browser loads an information page from our server; as with any page request, their IP address is transmitted and stored in the usual server log files. The legal basis is our legitimate interest in providing this feature (Art. 6(1)(f) GDPR).

If you open a shared clean day, the app only adds it to your list after you confirm; you can change the name at that point. So that Android can open such links directly in the app, a small verification file is retrieved from our website when the app is installed or updated.

If you import clean days from your calendar or contacts, the app reads – with your permission – the events that repeat every year and events with “clean” in their title, or the anniversaries and custom events of your contacts. They are evaluated only on your device, and only the entries you select are saved. Calendar and contact data is not transmitted. The permissions are optional and can be withdrawn at any time in your device settings.

Under “Import & export” you can export your data to a backup file. You choose which data it contains. The file is encrypted on your device with your password and stored only where you save it. It is not transmitted to us. If you store it with a cloud service or send it on, that provider’s terms apply. Without the password nobody can open the file, not even us.

2. Loading content from the internet

Meetings, media library, conventions and messages are loaded by the app from our server or from the meeting databases (BMLT). When content is retrieved, your IP address is – unavoidably for technical reasons – transmitted to the respective server. Audio files in the media library are streamed directly from our server. The legal basis is our legitimate interest in providing the app content (Art. 6(1)(f) GDPR).

3. Access to the media library

The audio files in the media library are access-protected on our website. The app signs in using a shared access whose password you enter in the options. No personal user account is created and no assignment to an individual person takes place. During sign-in and file retrieval, the access credentials and your IP address are transmitted to our server and stored there in the usual server log files. The legal basis is our legitimate interest in protecting the content against unauthorised access (Art. 6(1)(f) GDPR).

4. Map view and location search

When you open the map, the map tiles are loaded from the servers of OpenFreeMap (vector tiles based on OpenStreetMap data). When you search for a place, your input is transmitted to the geocoding service Nominatim of the OpenStreetMap Foundation. In both cases your IP address is transmitted to these servers. The legal basis is Art. 6(1)(f) GDPR.

5. Location

If you use the “Near me” function, the app determines your device location. It is used on the device only, in order to display meetings in your vicinity, and is not transmitted to us or to third parties. The location permission is voluntary and can be withdrawn at any time.

6. Push notifications (Firebase Cloud Messaging)

Only if you allow push notifications does the app use Google’s Firebase Cloud Messaging service. In doing so, a device identifier (push token) and your IP address are transmitted to Google; processing in third countries (including the USA) is possible. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by deactivating notifications.

7. Abuse protection (Firebase App Check)

To prevent our messaging server from being queried abusively, the app uses Firebase App Check with Google Play Integrity to verify that it is a genuine, unmodified installation of this app. In doing so, technical information about the app and device is transmitted to Google; no reference to your person is created. The legal basis is our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR).

8. Anonymous usage statistics (Matomo)

In order to improve the app, we record anonymously which areas of the app are opened. This is done using Matomo on our own server (narcotics-anonymous.de); the data does not leave our infrastructure and is not passed on to third parties. No cookies are set, no device identifiers and no search terms are recorded; the visitor identifier is assigned randomly anew each time the app starts, so recognition across sessions is not possible. Your IP address is truncated on the server side. Any conclusions about your person are therefore excluded. You can switch the statistics off completely at any time in the options under “Usage statistics”. The legal basis is our legitimate interest in designing the app to meet users’ needs (Art. 6(1)(f) GDPR).

9. Cloud backup of your app data

In the options you can enable an optional cloud backup (off by default). When it is active, the app uses Android data backup to store your favourites, subscribed channels, listened markers, and settings in your own Google cloud, tied to your Google account. After a reinstall or on a new device, they are restored automatically.

Your name and clean date are explicitly excluded from the backup; they are not transferred to the cloud and must be entered again after a reinstall. The same applies to your daily inventory, your gratitude lists and your friends’ clean days; they are not backed up and are lost when you reinstall the app.

The backup is carried out by Google and transmitted encrypted; it only happens while your device is secured with a PIN, pattern or password. Processing by Google, including in third countries (such as the USA), is possible. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by turning the switch off. Using “Delete backed-up data” removes the stored copy from the cloud on the next backup run. We have no influence over your Google backup itself.

10. Obtaining the app via Google Play

The app is distributed via the Google Play Store. When downloading and updating, Google LLC or Google Ireland Limited processes data on its own responsibility (including Google account, device information, IP address). We have no influence over this. Google’s privacy policy applies: https://policies.google.com/privacy

11. Your rights

Under the GDPR you have the right to information, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority. Please contact the address given above.

Last updated: October 2026