Privacy Policy

1. Introduction

This Privacy Policy explains how TheraPal ("TheraPal," "we," "us," or "our") handles information when you use the TheraPal mobile application (the "App") and this website (https://therapal.fit) (together, the "Services").

TheraPal is designed as a local-first, privacy-focused wellness companion. We do not operate a TheraPal backend that stores your journal entries, mood history, or chat transcripts. Please read this policy carefully. By using the Services, you acknowledge the practices described here.

Related documents: Terms of Use.

2. Information We Collect

2.1 Information We Do Not Collect as Account Data

TheraPal does not require or collect as an account:

• Name, email address, phone number, or postal address for an App account
• Social media profiles or contact lists
• Precise location for advertising
• Photos or device contacts (unless you voluntarily share content via the system share sheet when exporting)

2.2 Information Stored Locally on Your Device

The following categories are stored on your device using on-device storage (including SQLite and similar system storage), and are not uploaded to a TheraPal server:

• Chat history: Messages you exchange with the AI companion within the App
• Journal entries: Text you write in the journal feature
• Mood logs: Mood selections, tags, notes, and timestamps
• Habits & streaks: Habit definitions and completion history
• Thought records & tool usage: CBT-style entries and related local state (where enabled)
• Preferences: Language, notification settings, onboarding answers kept locally, and UI preferences
• Local safety flags: On-device indicators related to crisis-resource display within a session (not sent to TheraPal servers)

This local data is generally deleted when you use "Delete All My Data" in Settings or uninstall the App (subject to your device's backup behavior).

2.3 Information Processed to Provide AI Features

When you use AI features (including AI chat, optional journal insights, and personalized reflections), the content you submit for that request is transmitted to our AI infrastructure provider so a response can be generated.

• Provider pathway: Requests are sent via OpenRouter to underlying large language models configured by TheraPal.
• Purpose: Generate the AI response you requested — not to build advertising profiles.
• TheraPal servers: We do not operate a TheraPal cloud database that retains your chat or journal content as a synced account history.
• Provider policies: OpenRouter and model providers process data under their own terms and privacy policies. Do not submit information you are not comfortable transmitting to an AI provider.

Sensitive content: wellness conversations can include highly personal topics. You choose what to type. For crisis situations, prioritize human emergency resources over AI chat.

2.4 Subscriptions and Payments

If you purchase TheraPal Pro, payments are processed by Google Play.We use RevenueCat to validate entitlement status (for example, whether "premium" is active). We do not receive your full payment card number. We may receive anonymous or pseudonymous subscription status and purchase metadata necessary to unlock Pro features.

2.5 Notifications

If you opt in, the App may use device notification services (for example, Expo Notifications / FCM) to deliver reminders you configure (mood check-ins, habits, wind-down).Notification tokens and delivery metadata may be processed by those platform providers solely to deliver notifications you requested.

2.6 Diagnostics and Crash Reporting

We may use Sentry (or similar) to diagnose crashes and errors. Diagnostic data may include device type, OS version, App version, stack traces, and performance metrics. We configure diagnostics to avoid collecting unnecessary personal content from your journals or chats. See Sentry's privacy documentation for infrastructure details.

2.7 Website Information

When you visit https://therapal.fit, standard server or hosting logs (for example, IP address, user agent, pages requested) may be processed by our hosting provider (such as Vercel) for security, reliability, and basic analytics. If you email us, we receive the content of your message and your email address.

Optional cookie consent on this marketing site may store a local preference (therapal-cookie-consent) in your browser.

3. How We Use Information

• Operate and improve App features you request
• Generate AI responses for AI-enabled features
• Validate Pro entitlements and prevent abuse of paid features
• Deliver optional reminders you enable
• Diagnose crashes and improve stability
• Respond to support or privacy requests you send by email
• Comply with law and protect the safety and integrity of the Services

We do not sell your personal information.

4. Legal Bases (GDPR / UK GDPR)

Where applicable (EEA/UK), we rely on:

• Contract / requested service: Processing AI prompts you submit to return a response; validating subscriptions you purchase
• Legitimate interests: Security, fraud prevention, crash diagnostics, and improving reliability — balanced against your rights
• Consent: Optional notifications and non-essential website cookies/analytics, where required
• Legal obligation: When we must retain or disclose information to comply with law

5. Sharing and Processors

We share information only with service providers needed to run the Services, including:

• OpenRouter / AI model providers (AI feature processing)
• Google Play (app distribution and payments)
• RevenueCat (subscription entitlement)
• Sentry (error monitoring)
• Hosting providers for this website (for example, Vercel)
• Email providers when you contact us

We do not share your data with advertising networks for behavioral advertising. We may disclose information if required by law, legal process, or to protect vital interests in genuine emergencies to the extent we possess relevant information (note: we typically do not hold your on-device journal/chat content on TheraPal servers).

6. International Transfers

Service providers may process data in the United States or other countries. Where required, we rely on appropriate transfer mechanisms used by those providers (such as Standard Contractual Clauses). Because core wellness content remains on your device except when you actively use AI features, cross-border processing primarily relates to AI requests, subscriptions, diagnostics, and website hosting.

7. Data Retention

• On-device data: Retained until you delete it in-app, clear App storage, or uninstall (device backups may retain copies until you clear backups)
• AI requests: Processed to generate responses; not retained by TheraPal as a cloud account history. Provider retention is governed by provider policies
• Subscription records: Kept as needed for entitlement, accounting, and compliance via store/RevenueCat systems
• Support emails: Retained as reasonably needed to resolve your request
• Diagnostics: Retained for a limited period consistent with debugging needs

8. Your Rights and Choices

8.1 Access, Export, Delete (App)

Because most personal wellness data is on your device, you can view it in the App, export it (JSON), or delete all local data via Settings. Uninstalling removes the App's local store subject to OS behavior.

8.2 GDPR / CCPA-style Requests

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability. For information we actually control (for example, support email correspondence), contact privacy@therapal.fit. We will respond within the timeframe required by applicable law (typically within 30 days where GDPR applies).

8.3 California (CCPA/CPRA)

We do not sell personal information and do not share personal information for cross-context behavioral advertising as those terms are commonly defined. California residents may contact us to exercise applicable rights regarding personal information we hold.

8.4 Do Not Track

This marketing site does not respond to DNT signals in a specialized way beyond our general minimal-tracking approach.

9. Children's Privacy

TheraPal is not directed to children under 13 (or under 16 where stricter rules apply). We do not knowingly collect personal information from children under these ages to create accounts. If you believe a child has provided personal information to us via email or similar channels, contact us and we will take appropriate steps to delete it.

10. Security

We use reasonable technical and organizational measures appropriate to a local-first App: platform storage protections, HTTPS for network calls (AI, subscriptions, diagnostics), and limited data collection. No method of transmission or storage is 100% secure. You are responsible for securing your device with a passcode/biometrics and OS updates.

11. Sensitive Wellness Content — Important Notice

Mental health and emotional content is sensitive. TheraPal keeps core records on-device to reduce unnecessary cloud retention. When you use AI features, content you send is processed by third-party AI infrastructure. Do not rely on the App as a secure clinical record system for regulated medical documentation.

12. Third-Party Links

The App and site may link to third-party resources (for example, findahelpline.com). Their privacy practices are their own. Review their policies before providing information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last Updated" date above. Material changes may also be highlighted in the App or on this website. Continued use after an update constitutes acceptance where permitted by law.

14. Contact Us

For privacy questions or requests:

• Privacy: privacy@therapal.fit
• General: contact@therapal.fit
• Website: https://therapal.fit