This Privacy Policy explains how we collect, use, store, and protect your personal data when you use Align. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR).

• We collect only data necessary to provide our service

• We never sell your personal data

• You have full control over your data

• We use industry-standard security measures

The data controller responsible for your personal data is the operator of the Align app. For all privacy inquiries, contact: hello@align.zone

For EU users, a Data Protection Officer (DPO) can be reached at the same address.

3.1 Account Information

• Email address — required for account creation and communication

• Display name — optional, used for personalization

• Password — stored as a salted bcrypt hash; never stored in plain text

• Account creation date — for record-keeping

3.2 Usage Data

• Meditation preferences — focus areas, style, voice selection, duration

• Meditation history — timestamps, completion status, session counts

• App usage analytics — feature usage, session duration (with consent)

3.3 Technical Data

• Device information — device type, OS version

• IP address — for security; anonymized after 30 days

• App version — for troubleshooting

3.4 Payment Data

• Subscription status — active, cancelled, trial

• Transaction history — processed by Apple/Google, not stored by us

We do NOT store credit card numbers, bank details, or payment credentials. All payment data is handled by Apple App Store, Google Play, or Stripe under their own privacy policies.

3.5 AI Processing Data

• Your focus areas and preferences are sent to Anthropic Claude to generate meditation scripts

• Generated scripts are sent to ElevenLabs for audio synthesis

• Questionnaire answers you provide during session creation are used only to generate your meditation and are never stored on our servers. They are passed directly to the AI and discarded.

3.6 Journal Entries

Journal entries are stored only on your device (AsyncStorage). They are never transmitted to or stored on our servers. Only a mood signal (e.g., "calm", "hopeful") is optionally saved server-side for aggregate analytics — no free text is ever stored.

PurposeLegal BasisAccount creation and authenticationContract performance (Art. 6(1)(b))Meditation generationContract performance (Art. 6(1)(b))Payment processingContract performance (Art. 6(1)(b))Customer supportLegitimate interest (Art. 6(1)(f))Service improvementLegitimate interest (Art. 6(1)(f))Marketing emailsConsent (Art. 6(1)(a)) — opt-in onlyAnalyticsConsent (Art. 6(1)(a)) — opt-in onlyLegal complianceLegal obligation (Art. 6(1)(c))

Primary purposes

• Generate personalized meditations using your preferences and AI services

• Store your meditation history and preferences

• Process subscription payments through Apple, Google, or Stripe

• Provide customer support

• Send service notifications (account alerts, subscription renewals)

What we do NOT do

• Sell your personal data to third parties

• Use your data for advertising outside the App

• Share your journal entries with anyone

• Store raw questionnaire answers

• Retain data longer than necessary

6.1 Anthropic Claude — AI Text Generation

Used to generate personalized meditation scripts. Your focus areas and meditation preferences are sent to Anthropic's API. Anthropic does not retain API data for model training. Data is transmitted via HTTPS/TLS. Anthropic Privacy Policy →

6.2 ElevenLabs — Voice Synthesis

Used to convert meditation scripts to audio. Only the text script (no personal identifiers) is sent for synthesis. ElevenLabs Privacy Policy →

6.3 RevenueCat — Subscription Management

Used to manage in-app subscriptions and track purchase status. Subscription status and user ID are shared. RevenueCat Privacy Policy →

6.4 Apple App Store / Google Play

Used for app distribution and payment processing. Subject to Apple and Google's respective privacy policies.

7.1 Security Measures

• Encryption in transit: TLS 1.3 for all data transmission

• Password hashing: bcrypt with salt

• Access controls: role-based access, principle of least privilege

• Session management: secure HTTP-only cookies

7.2 Data Retention

Data TypeRetention PeriodDeletion MethodAccount dataUntil deletion requestPermanent deletion within 30 daysMeditation historyUntil deletion requestPermanent deletion within 30 daysMeditation preferencesUntil deletion requestPermanent deletion within 30 daysJournal entriesDevice-only, never server-storedCleared on app uninstallQuestionnaire answersNever stored (pass-through only)Not applicablePayment records7 years (legal requirement)Anonymized after 7 yearsServer logs30 days rollingAutomatic deletionAI inputs / outputs30 daysAutomatic deletionConsent records7 years (legal compliance)Retained per legal obligation

7.3 Account Deletion

You can delete your account through three methods:

• In-app: Privacy Center → Account → Delete Account

• Web: /delete-account

• Email: hello@align.zone with subject "Delete My Account"

Upon deletion: account is immediately deactivated, data is removed from active systems within 7 days, and completely removed from all backups within 30 days. A confirmation email is sent when deletion is complete.

7.4 Data Breach Response

In the event of a data breach, we will notify affected users and relevant supervisory authorities within 72 hours as required by GDPR, and will provide details of the breach and mitigation measures.

All rights below are accessible directly through the Privacy Center in the App (Settings → Privacy Center).

Right to Access (Art. 15)

Export a complete copy of all your personal data as a JSON file from the Privacy Center. Delivered instantly, free of charge.

Right to Rectification (Art. 16)

Update your profile, email, display name, and preferences at any time in App settings. Changes take effect immediately.

Right to Erasure (Art. 17)

Delete your meditation history only, or delete your entire account. Both options available in the Privacy Center. Full erasure within 30 days.

Right to Restrict Processing (Art. 18)

Manage consent preferences and pause non-essential processing through the Privacy Center at any time.

Right to Data Portability (Art. 20)

Download all your personal data in structured, machine-readable JSON format from the Privacy Center.

Right to Object (Art. 21)

Opt out of marketing emails instantly via any email footer or through the Privacy Center. Opt out of analytics at any time.

Right to Withdraw Consent (Art. 7)

Withdraw consent for analytics and marketing communications at any time. Withdrawal does not affect the lawfulness of prior processing.

Right to Lodge a Complaint (Art. 77)

You may complain to the Dutch supervisory authority: Autoriteit Persoonsgegevens, or your local EU Data Protection Authority.

Analytics (Optional)

Opt-in required. Can be revoked at any time in the Privacy Center. Revoking stops non-essential tracking while the app continues to function normally.

Marketing Emails (Optional)

Unchecked by default. One-click unsubscribe in every email. Can be revoked in the Privacy Center.

Personalized Emails (Optional)

Separate from marketing emails. Focused on your wellness journey. Unchecked by default, can be revoked independently.

Core Service Processing (No Separate Consent Required)

The following are essential to provide the service and do not require separate consent: meditation generation, account management, payment processing, customer support, and security monitoring. Legal basis: contract performance (Art. 6(1)(b) GDPR).

Align is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover we have collected data from a child under 13 without parental consent, we will immediately delete the account and all associated data within 48 hours.

Users aged 13–16 may use Align with parental or guardian consent. By creating an account, users in this age range confirm they have obtained such consent.

If you are a parent or guardian and believe your child has provided us with personal data, contact us at hello@align.zone with subject "Underage Account Report". We will respond within 48 hours.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. All international transfers comply with GDPR Chapter V requirements through Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) with all third-party processors.

Align uses artificial intelligence to generate personalized meditation content. Here is what AI does and does not do:

• AI generates meditation scripts based on your inputs and selected focus areas

• AI converts scripts to audio using voice synthesis

• AI does not make medical or therapeutic diagnoses

• AI does not store or learn from your personal data for other users

• AI does not replace human judgment or professional advice

Humans design and maintain all AI systems, review outputs for quality, and provide all customer support.

We may update this Privacy Policy from time to time. For material changes, we will notify you via email and in-app notification at least 30 days before the change takes effect. The "Last Updated" date at the top reflects the most recent revision. Continued use of Align after changes constitutes acceptance of the updated Policy.

Email: hello@align.zone

General inquiries: Response within 48 hours

Data access or deletion requests: Acknowledged within 7 days, completed within 30 days

Availability: Monday–Friday, 9:00–17:00 CET