Privacy Policy

Recalm ("we", "us", "our", or "the App") is a wellbeing companion app built around four practices: Reset (breathing exercises), Release (word cloud), Relax (mandala colouring), and Reflect (gratitude journal). We are committed to protecting your privacy. This Privacy Policy explains how your data is handled when you use Recalm.

This policy is designed to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), and applicable United States privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA").

Recalm does not collect, store, or process any personal data. All user-generated content — including journal entries, activity data, and settings — is stored exclusively on your own device and is never transmitted to or processed by any server. Because no personal data is collected or processed, Recalm does not act as a data controller under UK GDPR or EU GDPR.

The only network request the App makes (fetching the daily tip, as described in Section 5) transmits no personal data whatsoever — only a day number is sent. For any privacy enquiries, please contact us at the contact details provided on the App Store listing.

Recalm does not store any data on its own servers. The following information is stored locally on your device using your browser or app's built-in local storage. This data never leaves your device, is never transmitted to Recalm or any third party, and remains entirely under your control:

• Local user identifier: A randomly generated unique ID created on first use. This is not linked to your name, email address, or any other identifying information.
• Activity and streak data: The dates on which you completed activities (Reset, Release, Relax, or Reflect). Used to calculate your streak and award badges.
• Gratitude journal entries: The date, mood, gratitude items, and any reflection text you write. These entries are encrypted at rest using AES-GCM 256-bit encryption via the Web Crypto API, with a key derived from a device-specific secret.
• App settings: Your preferences such as dark mode, mandala colour theme, journal lock PIN, and notification preferences.

Release text is processed into a word cloud on screen and is not saved — it is cleared when you leave the page or refresh.

Recalm does not:

• Require you to create an account, log in, or provide an email address;
• Send your journal entries, activity data, or settings to any server;
• Use advertising or ad-tracking SDKs;
• Use third-party analytics or crash reporting tools;
• Share or sell your data to any third party;
• Use cookies to track you across sessions or other websites.

The App makes a single type of network request: fetching the daily "happiness action" tip, which is queried by the day of the year. No personal data, user identifier, or device information is sent in this request. The only data transmitted is the day number needed to retrieve the correct tip.

As with any network request, the hosting infrastructure may automatically log standard technical data (such as IP address and timestamp) for security and abuse-prevention purposes. This is standard server operation and is not used to identify or profile you.

Recalm does not collect, store, or process personal data. All user-generated content is stored locally on your device and is never transmitted to or processed by any server. Accordingly, the data processing provisions of UK GDPR and EU GDPR do not apply to your use of the App.

The single network request the App makes (fetching the daily tip) sends only a day number and no personal data. See Section 5 for further details on network requests.

All user data is stored on your device only. It is retained for as long as you keep the App installed and do not clear the App's data or local storage. When you delete the App, or use the "Delete Account" option within Settings, all locally stored data is permanently erased from your device.

Your gratitude journal entries are encrypted at rest using AES-GCM 256-bit authenticated encryption, with encryption keys derived from a device-specific secret using PBKDF2 (SHA-256, 100,000 iterations). This means your journal content cannot be read without access to both your device and the locally stored encryption key.

Your journal can additionally be protected with a 4-digit PIN lock, which can be enabled in Settings.

Because your personal data is stored locally on your device and is not transferred to any server, there are no international data transfers of your user-generated content. The daily content request described in Section 5 does not transmit personal data.

As a data subject, you have the following rights regarding your personal data:

• Right of access — to be informed about and obtain a copy of your personal data.
• Right to rectification — to have inaccurate personal data corrected.
• Right to erasure — to have your personal data deleted.
• Right to restriction — to restrict the processing of your data.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to object to the processing of your data.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

Because your data is stored locally on your device, you can exercise these rights directly by using the "Export Journal" feature in Settings to obtain a copy of your data, or by using "Delete Account" in Settings to erase all data. You may also clear the App's data through your device's system settings.

If you wish to make a formal request or have questions about your rights, please contact us at the contact details provided on the App Store listing.

You also have the right to lodge a complaint with your local data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, you may contact your Member State's data protection authority.

If you are a resident of California or other US states with comparable privacy laws, you have additional rights regarding your personal information:

• Right to know — the categories and specific pieces of personal information we collect about you. As described above, we do not collect personal information from you through the App.
• Right to delete — you may delete all data stored by the App at any time using the "Delete Account" option in Settings or by uninstalling the App.
• Right to correct — you may correct your data by editing it within the App (e.g., updating journal entries).
• Right to opt-out of sale or sharing — we do not sell, share, or rent your personal information to any third party for any purpose. No opt-out is necessary because no sale or sharing occurs.
• Right to non-discrimination — we will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, use the in-app Settings (Delete Account) or contact us at the details provided on the App Store listing.

Recalm is a general-purpose wellbeing app and does not knowingly collect personal information from children under the age of 16 (or the applicable age in your jurisdiction). Because the App does not require account creation or collect personal data from users, no special parental controls are needed. If you believe a child has provided information to us, please contact us and we will take appropriate action.

Recalm does not use cookies. The App uses local storage on your device to store your data and preferences. Unlike cookies, local storage data is not transmitted to any server and remains entirely on your device.

Recalm does not use automated decision-making, profiling, or artificial intelligence to make decisions about you. Your streak and badge calculations are simple date-based computations performed locally on your device.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted within the App with an updated "Last updated" date. We encourage you to review this policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us via the contact information provided on the App Store listing.