Breathtaking - Privacy Policy

The Short Version

We collect minimal data to run Breathtaking. We never sell your data or use it for ads. Payments are handled by Apple and Google; we never see your card details. You can delete everything anytime. Your journal entries are private.

1. What We Collect

Information You Provide:

• Email address and name (if you create an account)
• Age confirmation (18+ requirement)
• Personality test responses
• Weekly check-in ratings across five areas: Stress, Emotional Imbalance, Energy, Motivation, Focus
• Journal entries

Information Collected Automatically:

• App usage data (practices completed, timestamps)
• Device type and operating system
• IP address (for security, abuse prevention, and approximate region)
• Subscription and purchase data: subscription status, plan type, trial status, and transaction history, received from Apple, Google, and RevenueCat
• Analytics data via our analytics providers, Mixpanel and PostHog (see mixpanel.com/legal/privacy-policy and posthog.com/privacy)

We DON'T Collect:

• Payment card details (Apple and Google process all payments; we never see your card number)
• Health app integrations
• Contacts
• Biometric data
• Browsing data from other sites

2. How We Use Your Information

To Provide the Service:

• Match practices to your personality type
• Generate your weekly plan: your plan is built by our own software running on our own infrastructure. Your weekly check-in answers are the input. Your journal entries are never used for plan generation, and we never send your journals, check-ins, or assessment answers to any third-party AI provider
• Track your wellness progress
• Manage your subscription and free trial, so the app knows what you have access to
• Send practice reminders (if enabled) and service communications, like weekly check-in prompts and trial or renewal notices
• Provide customer support

To Improve Breathtaking:

• Analyze usage patterns to improve our algorithm
• Understand which practices work best
• Fix bugs and improve performance

We NEVER:

• Sell or rent your data
• Share with advertisers or data brokers
• Use for behavioral advertising
• Share your journal entries with anyone
• Use your data for purposes unrelated to Breathtaking

3. Who We Share With

Only These Service Providers:

Firebase (Google Cloud):

Hosts our service as a data processor. All data is stored on U.S.-based servers (see Section 11 if you use Breathtaking from outside the United States).

RevenueCat:

Manages subscription status and entitlements (which plan you are on, whether your trial is active). Receives transaction information from Apple and Google. Never receives your payment card details. See revenuecat.com/privacy.

Mixpanel and PostHog:

Provide product analytics (we are transitioning from Mixpanel to PostHog). Configured without advertising features or cross-app tracking. See mixpanel.com/legal/privacy-policy and posthog.com/privacy.

Apple and Google:

Process all subscription payments through their app stores under their own terms and privacy policies. We never receive your payment card details.

Each provider only receives the minimum data necessary to perform their service and is contractually bound to protect your data.

4. Your Rights

You Can Always:

• Access your data anytime in the app
• Export your journal entries (email support@tarexventures.com)
• Delete your entire account and all associated data in Settings
• Opt-out of marketing emails and push notifications
• Correct any inaccurate information
• Withdraw consent for data processing by deleting your account (WA/NV/CT residents: see Section 8; EEA/UK users: see Section 11 for additional rights)

5. Data Security

• Encryption in transit (TLS) and at rest (AES-256)
• Secure Firebase infrastructure (SOC 2 compliant)
• U.S.-based servers (see Section 11 for international users)
• Hashed password storage (never plain text)
• Regular security updates and monitoring

Breach Notification:

If a data breach occurs, we will notify affected users without unreasonable delay and no later than the earliest deadline required by applicable law, including but not limited to: California Civil Code §1798.82 (within 72 hours of determination for certain breaches), Colorado (30 days), New York (reasonable time without unreasonable delay), Washington (30 days), and where applicable, the FTC Health Breach Notification Rule (16 C.F.R. Part 318). We will also notify regulators and, if required, the media.

6. Data Retention

Active accounts:

Data retained while you use Breathtaking

Deleted accounts:

Personal data removed within 7 days, backups purged within 30 days

Inactive accounts:

Automatically deleted after 24 months of inactivity (with 30-day notice)

Transaction records:

Records of purchases are kept as long as required for tax, accounting, and legal purposes, even if you delete your account

Analytics data:

Usage data linked to your account is retained while your account is active and deleted when you delete your account. Aggregated, non-identifiable statistics may be retained indefinitely.

7. Children's Privacy

Breathtaking is strictly for users 18 and older. We do not knowingly collect data from anyone under 18. If we discover we have collected information from a minor, we will delete it immediately. If you believe a child has provided us data, please contact legal@tarexventures.com.

8. State-Specific Privacy Rights

California Residents (CCPA/CPRA):

• Right to know what personal information we collect and how it's used
• Right to delete your personal information
• Right to opt-out of sale/sharing (we don't sell or share for advertising)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate information

Washington, Nevada, Connecticut Residents (Consumer Health Data):

Your wellness ratings, practice data, and exercise completion analytics may be considered "consumer health data" under state law. You have additional rights:

• We obtain separate, informed opt-in consent before collecting health data during onboarding; this includes analytics tracked via our analytics providers (Mixpanel, PostHog)
• If you do not consent, you may not use the Service
• You may withdraw consent at any time by deleting your account in Settings, which will delete your consumer health data
• We never sell consumer health data
• We do not use geofencing around healthcare facilities
• You have the right to delete all health data

To exercise any rights, email legal@tarexventures.com.

9. Cookies and Tracking

Mobile App:

Does not use cookies

Website:

Uses essential session cookies and basic analytics only

Analytics providers (Mixpanel, PostHog):

Used for product analytics. Configured without advertising features or cross-app tracking.

We do NOT use tracking pixels, fingerprinting, or behavioral advertising.

10. Changes to This Policy

We'll notify you by email of any material changes to this Privacy Policy. The "Last Updated" date shows when changes were made. Continuing to use Breathtaking after changes take effect means you accept the updated policy.

11. International Users

Breathtaking is available worldwide and is operated from the United States. Your data is processed and stored on U.S.-based servers. If you use Breathtaking from outside the United States, your personal data is transferred to, and processed in, the United States, where privacy laws may differ from those in your country. We protect your data the same way everywhere, as described in this policy, and we have data processing agreements with our service providers, including standard contractual clauses where required.

For users in the European Economic Area, the United Kingdom, and Switzerland:

Legal bases. We process your data based on: your consent (for wellness ratings, personality responses, journal entries, and analytics; you give this consent during onboarding and can withdraw it at any time by deleting your account); performance of our contract with you (your account, your subscription, and core service functionality); and our legitimate interests (security, fraud prevention, and service improvement).

Special category data. Your wellness ratings and journal entries may be considered health-related data. We process them only with your explicit consent, only to provide the Service, and we never sell them or use them for advertising.

Your rights. You have the right to access, correct, export, restrict, or object to the processing of your data, the right to have it deleted, and the right to withdraw consent at any time without affecting prior processing. You can exercise these rights in the app (Settings) or by emailing legal@tarexventures.com. You also have the right to lodge a complaint with your local data protection authority.

If you live in another country with its own privacy law (for example Canada, Brazil, or Australia), we apply the same core commitments: transparency, consent for health-related data, deletion on request, and no sale of your data. We respond to all privacy rights requests within 30 days, or sooner where local law requires.

12. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict-of-laws rules, except where the mandatory privacy laws of your place of residence apply. For dispute resolution, see our Terms of Service.