Privacy Policy

• Account information: email address and authentication details handled by our authentication provider.
• Session content you create (depending on what you use): audio recordings (from microphone) and uploaded audio files, session titles, tags, and related notes, transcripts, summaries, insights, themes, emotions, wins, reflection prompts, and action items generated from your sessions.
• Chat content: messages you send in the in-app chat and the AI responses you receive.
• Upcoming session planning (if you use scheduling features): session title, date/time, therapist name, location (as entered by you), and optional notes.

• Device/app data: basic technical information needed to run the app (e.g., app version, OS type/version, timestamps).
• Analytics events: event and screen-view data used to understand app usage and improve the Service. We configure analytics to reduce collection and we sanitize event properties to avoid sending session/chat content.
• Measurement/attribution data: an identifier generated by our measurement provider, your IP address (for approximate location and fraud prevention), and install/event data (such as installs, registrations, and subscription events) used to measure marketing performance. We do not collect the iOS advertising identifier (IDFA) and we do not show the App Tracking Transparency prompt; on iOS, attribution relies on the operating system's privacy-preserving attribution framework (SKAdNetwork).

The app stores certain information on your device:

• SecureStore (encrypted by the OS where available): authentication tokens and basic user identity info.
• AsyncStorage (app storage): app data such as cached sessions/metadata, settings, folders, and chat history.

Guest users can clear local data from within the app or by uninstalling the app. For signed-in users, the in-app "Delete All Data" feature deletes both local app data and associated server-side account data; see "Retention" and "Account and deletion requests."

We use providers for user authentication and to store app data in a database (e.g., sessions, transcripts, summaries, insights, goals/action items, settings).

When you record or upload audio for processing, the audio is uploaded to and stored with a cloud storage provider. When you view a session, the backend may provide a time-limited link (a presigned URL) to access the audio.

We use AI processing providers to:

• Transcribe audio into text (including, in some cases, speaker diarization)
• Analyze transcripts to generate summaries and insights
• Generate AI chat responses

Important: for AI chat, the backend may provide the AI processing provider with your chat messages and may also include context from your saved sessions (such as summaries and/or transcripts) to help the AI respond.

Users are shown an in-app disclosure before AI-powered processing is used and must agree before relevant content is sent for processing.

Content sent to our AI processing provider through our API is not used to train its models and is not retained or reused after processing.

Chat storage: we store chat history on your device for convenience. The current Service does not aim to store your full chat history in our primary database, but chat content may be processed transiently by our servers and may appear in operational logs in limited circumstances (for example, error logs), then retained for a limited period.

We use an analytics provider to measure usage and improve the app. We disable automatic event capture and sanitize tracked properties to avoid including sensitive session/chat content. Analytics may still include limited technical and usage data (e.g., app screens visited, feature usage events) and an analytics identifier. Our analytics data is hosted in the EU region. You can opt out of analytics in the app.

We use a marketing measurement provider to understand how people discover the app and to measure the effectiveness of our marketing, without tracking you across other apps or websites. We do not collect the iOS advertising identifier (IDFA) and we do not show the App Tracking Transparency prompt. On iOS, attribution relies on the operating system's privacy-preserving attribution framework (SKAdNetwork). The provider may process a device identifier it generates, your IP address (for approximate location and fraud prevention), and app/event data (such as installs, registrations, and subscription events). Aggregated or privacy-preserving conversion measurements may be shared with advertising networks to measure campaign performance. We do not share device-level identifiers with these networks for cross-app advertising.

We offer an optional paid subscription ("TheraNotes Pro"). Purchases are processed by the app store platform, and we use a subscription management provider to validate subscription status. These providers process purchase and subscription data and app/device identifiers needed to deliver and verify your subscription. We do not receive your full payment card details.

We may share information if we believe it is reasonably necessary to:

• Comply with law or lawful requests
• Protect the safety, rights, and property of users, the public, or our Service
• Prevent fraud, abuse, or security issues

You may have the right to request access to, correction of, deletion of, or portability of your personal data, and to object to or restrict certain processing. You also have the right to complain to the UK Information Commissioner's Office (ICO).

You may have rights to access and correct your personal information and to challenge our compliance with applicable privacy principles. Contact us to exercise these rights.

Depending on your state, you may have rights to access, delete, or correct certain personal information and to opt out of certain processing. Contact us to submit a request. We may need to verify your identity before fulfilling requests.