Privacy Policy

1. Introduction

Woosah, operated by Woosah LLC (“we”, “our”, or “us”), is committed to protecting your privacy.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when
you use our mental wellness app.

2. Information We Collect

Personal Information

• Email address (for account creation and login)
• Name (optional, for personalization)
• Profile information (AI companion preferences, avatar selection)

Health and Wellness Data

• Mood tracking data (mood entries, ratings, notes)
• Journal entries (personal reflections and notes)
• Chat conversations with AI companion
• Self-help exercise progress
• Goals and challenges you’ve shared

Technical Information

• Location data (only if you grant permission for resource finding)
• For a no-account homepage conversation: a pseudonymous hash derived from your IP address for
  abuse prevention, limited referral attribution, and operational event data such as message
  number, device category, and whether a request succeeded. These events do not include your
  message text, the AI response text, diagnosis information, journal data, or crisis status.

No-Account Homepage Conversations

You may start a limited conversation from our homepage without creating an account. Your message
and the AI response are stored temporarily in Supabase as one application-encrypted
conversation. The browser stores only an opaque session token and expiration time in session
storage, not a copy of the transcript.

Our application server decrypts the recent conversation context and sends it to OpenAI to
generate the Companion response. OpenAI states that API inputs and outputs are not used to train
its models by default unless the API customer opts in. OpenAI processes and retains API data
under its own business-data terms and policies.

An unclaimed conversation expires after 60 minutes and is normally deleted by our scheduled
cleanup within 15 additional minutes. If you create an account and choose to continue, the
conversation is transferred into the registered-user chat flow and the temporary record is
deleted after a successful import. An interrupted import may remain for up to 30 minutes so the
same user can retry, after which it is deleted. Limited first-party event metadata may be kept
with our analytics records for product measurement, security, and legal compliance until it is
no longer needed or is de-identified.

3. How We Use Your Information

We use your information to:

• Provide and maintain the App’s functionality
• Personalize your AI companion experience
• Track your wellness progress over time
• Send important notifications about your account
• Improve our services and develop new features
• Detect and prevent fraud or security issues
• Comply with legal obligations

4. Data Storage and Security

We take data security seriously and implement industry-standard measures:

• End-to-end encryption for sensitive data
• Hybrid storage: Data stored locally by default, with optional cloud sync for multi-device
  access
• Secure cloud storage with Supabase (when cloud sync is enabled)
• Regular security audits and updates
• Limited employee access to user data

Note: While we implement strong security measures, no method of transmission
over the internet is 100% secure. We cannot guarantee absolute security.

5. Third-Party Services

We use the following third-party services:

• OpenAI: Powers our AI companion chat feature. Conversations are processed but
  not used to train OpenAI’s models.
• Supabase: Provides secure authentication and database services.
• Google Places: Helps find mental health resources near you (only with your
  permission).
• Resend: Sends transactional emails (account verification, password resets).

These services have their own privacy policies governing their use of your information.

6. Data Sharing and Disclosure

We do NOT sell your personal or health data to third parties.

We may share your information only in these limited circumstances:

• With your explicit consent
• To comply with legal obligations (court orders, subpoenas)
• To protect our rights, safety, or property
• In connection with a business transfer or acquisition (with notice to you)
• With service providers who assist in operating the App (under strict confidentiality
  agreements)

7. Your Privacy Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Data Portability: Export your data in a portable format
• Opt-Out: Unsubscribe from non-essential communications

To exercise these rights, visit your Account Settings or contact us at
support@getwoosah.com

8. Children’s Privacy

Woosah is not intended for individuals under 18 years of age. We do not knowingly collect
personal information from minors under 18. If you believe we have collected information from a
minor under 18, please contact us immediately.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide
services. When you delete your account, we will delete or anonymize your personal data within 30
days, except where we must retain it for legal compliance.

10. International Users

Woosah is based in the United States. If you are accessing the App from outside the U.S., your
information will be transferred to and processed in the United States. By using the App, you
consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes
by posting a notice in the App or sending you an email. Continued use of the App after changes
constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

Email: support@getwoosah.com