Information we collect
We collect the following categories of information:
- Account information — if you sign in, your email address and basic profile information from your sign-in provider (email magic link or Google), handled through our authentication provider (Supabase).
- Anonymous device identifier — if you train without an account, a randomly generated identifier stored on your device (browser localStorage on the web, app storage on mobile). It contains no personal details; the server only sees a hashed version used to keep your progress and free-tier allowance together.
- Practice content — the workout prompts you receive and the attempts (text you write or transcripts of what you speak) you submit, plus the resulting AI feedback, scores, and session history.
- Billing information — your subscription tier and status. Payments are processed by Paddle (web) or the app stores (mobile); we never receive or store your card number.
- Technical information — IP address and basic request metadata, used for rate limiting, security, abuse prevention, and operational logs.
How we use your information
We use the information above to:
- Provide the Service: run workouts, generate AI coaching feedback, and track your progress, streaks, and scores.
- Enforce daily free allowances and manage paid subscriptions.
- Keep the Service safe: screen submissions, prevent abuse, and rate-limit traffic.
- Operate and improve the Service, including debugging and monitoring aggregate usage and cost.
- Communicate with you about your account when needed (for example sign-in links).
AI processing of your practice content
To generate coaching feedback, your practice submissions and the associated workout prompt are sent to third-party AI model providers (currently DeepSeek) for processing. Submissions are screened before processing, and we send only what is needed to produce feedback.
Please do not include sensitive personal information (about yourself or others) in practice submissions — the exercises never require it.
Who we share information with
We do not sell your personal information, and we do not share it with advertisers. We share information only with service providers who process it on our behalf to run the Service:
- AI model providers (currently DeepSeek) — practice submissions and prompts, to generate feedback.
- Supabase — authentication and database hosting.
- Paddle, Apple App Store, or Google Play — payment processing for subscriptions.
- Infrastructure providers that host the Service.
Data retention
We keep your account data and practice history while your account is active, or — for anonymous training — while your device identifier remains in use. We may retain limited records where required for legal, billing, security, or fraud-prevention purposes.
You can request deletion of your data at any time (see "Your rights" below). Clearing your browser storage or uninstalling the mobile app discards the anonymous device identifier, which permanently disconnects that device's anonymous history.
Your rights
Depending on where you live (for example under the GDPR or CCPA/CPRA), you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority.
To exercise any of these rights, email tech@entropicharmony.com from the address associated with your account (or include your device identifier for anonymous data, shown on the Profile screen). We will respond within the timeframe required by applicable law, and we do not discriminate against you for exercising your rights.
Security
Information is encrypted in transit, access to production systems is restricted, and anonymous identifiers are stored hashed on the server. No method of transmission or storage is completely secure, so we cannot guarantee absolute security — but we work to protect your information using industry-standard measures appropriate to the data we hold.
International transfers
Our service providers may process information in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.
Children
The Service is not directed to children under 13 (or the higher minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date above reflects the latest revision, and material changes may additionally be announced in the app. Your continued use of the Service after an update constitutes acceptance of the revised policy.
Contact
Privacy questions and requests: tech@entropicharmony.com.