Privacy Policy

The controller responsible for your data is:

[COMPANY NAME]
[STREET ADDRESS]
[POSTAL CODE, CITY, COUNTRY]
Email: [CONTACT EMAIL]
[Where applicable: Data Protection Officer — [NAME / EMAIL]]

• Account data — name, email address, and password (stored hashed) when you create an account.
• Ritual & log data — the habits, protocols, mood, energy, and completion entries you record in the app.
• Usage & device data — IP address, device type, app version, and interaction data collected automatically.
• Communications — the content of messages you send us (e.g. support requests).

• To provide, maintain, and personalize the Service.
• To generate AI-assisted recommendations via Aura AI based on the data you provide.
• To communicate with you about your account and support requests.
• To secure the Service and prevent abuse.
• To comply with our legal obligations.

• Contract (Art. 6(1)(b)) — to provide the Service you sign up for.
• Consent (Art. 6(1)(a)) — for optional analytics, marketing, and health-related data, where required.
• Legitimate interests (Art. 6(1)(f)) — to secure and improve the Service.
• Legal obligation (Art. 6(1)(c)).

Note: health and wellbeing data may qualify as a special category under Art. 9 GDPR and is processed only with your explicit consent.

Technically necessary cookies are used only for the error-free operation of the site. Optional cookies for reach measurement (see Google Analytics below) are set only with your explicit consent. You can change or withdraw your choice at any time via the “Cookie settings” button in the footer.

Web analytics with Google Analytics. With your consent we use Google Analytics, a web-analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies to statistically analyse use of the website; your IP address is anonymised in the process (anonymize_ip). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. Without consent, Google Analytics is not loaded. You can withdraw your consent at any time with effect for the future via the “Cookie settings” button in the footer. Data may also be transferred to Google servers in the USA. A data processing agreement (DPA) with Google is in place. See the controller details in Section 1.

We share data with service providers acting on our behalf under data processing agreements, including:

• [HOSTING / DATABASE PROVIDER, e.g. Supabase]
• [AI PROVIDER, e.g. OpenAI] — to generate Aura recommendations.
• [ANALYTICS PROVIDER]
• [EMAIL / PAYMENT PROVIDERS]

Where data is transferred outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses. [List relevant transfers and mechanisms.]

We keep personal data only as long as necessary for the purposes above or as required by law. Account and log data are deleted [within X days] after you close your account. [Specify concrete retention periods.]

Under the GDPR you have the right to:

• Access your data and request a copy.
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”).
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time.
• Lodge a complaint with a supervisory authority ([RELEVANT AUTHORITY]).

To exercise any right, contact us at [CONTACT EMAIL].

The Service is not directed to children under [16]. We do not knowingly collect data from children below that age.

We may update this policy from time to time. Material changes will be announced via [email / in-app notice], and the “last updated” date above will change.

Questions about this policy? Email us at [CONTACT EMAIL] or write to the address in Section 1.