Unmute
Privacy Policy
This policy explains what personal data we process when you use the UNMUTE mobile app (the "App"), and your rights under the GDPR (EU/UK) and the California Consumer Privacy Act (CCPA/CPRA).
1. Who we are (data controller)
UNMUTE ("UNMUTE", "we") is published by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], [COUNTRY].
- Privacy / DPO contact: [privacy@yourdomain.com]
- EU/UK representative (if applicable): [NAME + ADDRESS]
2. Scope & data collected
We apply the principle of data minimization: we only collect what is necessary to operate the App.
| Category | Examples | Source |
|---|---|---|
| Account / identity | Email address, chosen username, pronouns/bio (optional) | You, at sign-up |
| Authentication | Session tokens. Passwords are hashed and stored by our authentication provider (Supabase); we never see or store your password in plain text. | You |
| Progress & wellbeing | XP, levels, streaks, mood check-ins, completed challenges, journal reflections | You, in the app |
| AI conversation content | The text you send to the coach and to "Practice" roleplays, and the AI's responses | You |
| Subscription / status | Whether you hold a Plus subscription, plan type, renewal status. Card data is processed by Apple — we never receive it. | Apple / RevenueCat |
| Technical & telemetry | Device model, OS version, app version, crash diagnostics, coarse usage events | Automatically |
What we don't collect
- No audio / voice recordings. The current version of UNMUTE is text-based; it does not record your microphone or capture ambient sound.
- No precise geolocation.
- No advertising identifiers; we do not serve third-party ads.
3. Why we process your data (purposes & GDPR legal bases)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and operate your account | Performance of a contract (Art. 6(1)(b)) |
| Generate challenges, roleplays, and AI coach responses | Performance of a contract |
| Save your progress, journal, and preferences | Performance of a contract |
| Manage subscriptions and entitlements | Performance of a contract |
| Crash diagnostics, security, fraud/abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Optional product-improvement analytics | Consent (Art. 6(1)(a)) — you can opt out |
We collect your explicit in-app consent to this policy and our Terms before the App initializes (consent screen on first launch).
4. AI processing & data flow
When you interact with the coach or a Practice roleplay, the text of your message is sent over an encrypted connection to our gateway (a Supabase Edge Function), which forwards it to our AI subprocessor Mistral AI to generate a response, which is then returned to your device.
- We only send the conversation text needed to generate the response — never your email, password, or payment data.
- AI responses are probabilistic and may be inaccurate; see the disclaimer in our Terms of Service.
- We do not sell your data and do not use it for advertising or cross-context behavioral targeting.
- We do not use your private conversations to train third-party foundation models beyond what is necessary to generate your response, and we require the same from our subprocessors. [Confirm and, where offered, enable "zero retention"/no-training options, sign a Data Processing Agreement (DPA) with each subprocessor, then state exact retention periods here.]
5. Subprocessors
We only share data with selected vendors, acting on our instructions under data processing agreements:
| Subprocessor | Purpose | Region | Policy |
|---|---|---|---|
| Supabase | Database, authentication, backend functions | EU region (GDPR) | supabase.com/privacy |
| Mistral AI | Generative AI responses (text) | EU (France) | mistral.ai/terms |
| RevenueCat | Subscription/entitlement management | United States | revenuecat.com/privacy |
| Apple | App distribution & in-app purchases | Global | apple.com/legal/privacy |
| Expo / EAS | App builds, crash diagnostics | United States | expo.dev/privacy |
6. International data transfers
Your primary storage is hosted in the EU. Where a subprocessor processes data outside the EEA/UK (e.g., RevenueCat, Apple, Expo in the United States), these transfers are governed by Standard Contractual Clauses and equivalent safeguards.
7. Retention periods
We retain personal data only as long as necessary for the purposes above, or as required by law. Account and progress data is kept while your account is active, and deleted within [30] days after account deletion (backups purged within [90] days). [Confirm the retention periods used by AI subprocessors and state them here.]
8. Your rights
Under the GDPR (EEA/UK)
You have the rights of access, rectification, erasure ("right to be forgotten"), restriction or objection to processing, and portability, as well as the right to withdraw consent at any time. You may lodge a complaint with your supervisory authority (e.g. the CNIL in France).
Under the CCPA/CPRA (California)
You have the right to know/access, delete, and correct your personal information, and to opt out of its "sale"/"sharing". We do not sell or share your personal information, and we do not discriminate against you for exercising your rights.
How to exercise your rights
- In the app: Settings → Privacy & Data → Download my data / Delete my account.
- By email: [privacy@yourdomain.com]. We respond within 30 days (GDPR) / 45 days (CCPA). We may verify your identity before acting.
9. Children & minors (ages 13–18)
UNMUTE is intended for people 13 and older. We do not knowingly collect data from children under 13. Depending on your country, the age of digital consent ranges from 13 to 16; below that age, a parent or guardian must consent on your behalf. [Implement age verification and, where applicable, verifiable parental consent, and confirm Apple's age rating. Obtain specialized legal advice (COPPA / GDPR-children) before launch.]
10. Security
We use encryption in transit (TLS), encrypted on-device credential storage (Keychain/Keystore via secure storage), row-level security on the database, and the principle of least privilege. No system is perfectly secure, and we cannot guarantee absolute security.
11. Changes to this policy
Any changes will be posted here with an updated "Last updated" date. Material changes will be notified in the app and may require renewed consent.
12. Contact
[LEGAL ENTITY NAME] — [privacy@yourdomain.com] — [ADDRESS]