Privacy Policy

This page is maintained by [anása data controller — FILL IN] ("we", "us") to explain how anása ("the app") collects, uses, stores, and protects your personal data. It is written in plain language and is not a substitute for legal advice.

1. Who we are

The data controller for personal data processed through anása is [anása data controller — FILL IN], based at [Legal address — FILL IN]. You can reach us about privacy matters at [privacy@your-domain — FILL IN].

2. What we collect, why, and on what legal basis

Category	Examples	Legal basis
Account data	Email, display name, encrypted password (if you sign up with email)	Performance of contract (Art. 6(1)(b) GDPR) — to provide the app
Profile preferences	Experience level, sleep goal, language, dark/light theme	Performance of contract
Journal entries	The text reflections and gratitudes you choose to write	Performance of contract; you control deletion at any time
Mood entries	Mood score, energy level, optional notes	Performance of contract
Practice activity	Exercises completed, durations, favorites, achievements, streaks	Performance of contract
Push device token	An opaque identifier from Apple/Google so we can send reminders you enabled	Consent (Art. 6(1)(a)); withdrawn by turning off notifications
Device locale	Language tag used to pick a translation	Legitimate interest (Art. 6(1)(f)) — minimal, no profiling
Security/diagnostic logs	Request metadata kept briefly to detect abuse	Legitimate interest

We do not collect precise location, contacts, photos, microphone input, advertising identifiers, or behavioural profiling data. anása does not run ads.

3. Sensitive content

Journal reflections and mood notes describe how you feel and may touch on mental wellbeing. We treat them as private to you: they are scoped to your account by database row-level security, they are not shared with anyone, and they are not used to train AI models. You can delete any entry from the Journal screen and you can delete every entry by deleting your account.

3a. Camera & focus tracking (optional)

The meditation session player has an optional Focus Tracking feature that uses your device's front camera to measure how steady your gaze is during a session. It is off by default and must be explicitly enabled after an in-app consent screen.

On-device only. Camera frames are processed locally by MediaPipe FaceLandmarker running in your browser or WebView. No video, image, or facial geometry ever leaves your device.
Not biometric identification. We compute an aggregate stability score from iris position. We do not create, store, or match a biometric template, and we do not attempt to identify you.
What we save to your account: a numeric focus score (0–100), a low-resolution timeline of scores, drift count, average recovery time, and session duration. No images, no raw landmarks.
Legal basis: your explicit consent (Art. 6(1)(a) GDPR), collected via a dedicated in-app screen before the camera is activated. You can withdraw consent at any time by disabling the feature during a session.
Retention: focus session rows are kept for as long as your account exists and are deleted when you delete your account.
Notice for Illinois (BIPA) and Washington (MHMDA) residents: because on-device iris processing may fall within these laws' scope, please do not enable this feature if you do not wish this processing to occur. Accepting the in-app consent screen provides the written, informed consent contemplated by these statutes for processing that occurs solely on your device.

4. Where your data lives

anása stores data on Lovable Cloud (powered by Supabase). The database is hosted in the European Union and encrypted at rest and in transit. Backups are retained on the same infrastructure.

5. Subprocessors

Lovable Cloud / Supabase — hosting, database, authentication
Lovable AI Gateway — optional AI features routed through Lovable; only data you submit to those features is processed
Apple Push Notification service (APNs) — iOS reminders
Google Firebase Cloud Messaging (FCM) — Android reminders
Web Push (VAPID) — browser reminders

Subprocessors only process data on our instructions and under their own GDPR commitments.

6. International transfers

Some subprocessors (Apple, Google) are based outside the EEA. Where transfers occur, they rely on Standard Contractual Clauses or equivalent safeguards.

7. How long we keep your data

Account, journal, mood, and practice data: as long as your account exists.
Push tokens: until you disable notifications or sign out.
Security logs: up to 30 days.
After account deletion: all rows are removed immediately; backups roll off within 30 days.

8. Your rights

Under GDPR you may at any time:

Access the data we hold about you — use "Download my data" in your profile.
Rectify inaccurate data — edit your profile or journal entries directly.
Erase your data — use "Delete my account" in your profile.
Restrict or object to processing, or withdraw consent for push at any time.
Portability — the export above is a structured, machine-readable JSON file.
Lodge a complaint with your national supervisory authority.

9. Children

anása is not directed at children under 16 in the EEA or under 13 elsewhere. If you believe a child has provided personal data, contact us and we will remove it.

10. Security

We use TLS in transit, encryption at rest, row-level security so each user only sees their own data, and least-privilege server access. No system is perfectly secure; if you discover a vulnerability please email [privacy@your-domain — FILL IN].

11. Changes to this policy

If we change this policy materially we will bump the version, prompt you to re-accept on next sign-in, and update the date above.