Privacy Policy

1. Who this applies to

This policy applies to everyone who uses the Arisn app. Arisn is intended only for adults (18 years or older, or the age of majority where you live). It is not directed to children, and we do not knowingly collect data from anyone under 18.

2. Information we collect

We only collect what you choose to put into the app, plus the minimum needed to run an account.

Account information

• Name / display name you enter.
• Email address: when you sign up with email and password.
• If you sign in with Google, we receive your name and email from Google (we never receive your Google password).
• If you sign in with Apple, we receive your email (or an Apple private relay address, if you choose Hide My Email) and, on your first sign in only, your name. We never receive your Apple Account password.

Your self improvement data

This is the content you create as you use Arisn:

Brotherhood (community) data

The Brotherhood is an optional community feed inside the app. If you join it, we store the following in the cloud:

Anything you post in the Brotherhood can reveal that you are working on this habit. If you want to stay anonymous, choose a handle that does not identify you and leave identifying details out of your posts. You can delete your own posts and comments at any time.

Camera (The Mirror)

The Mirror shows you your own face through the front camera during an urge. The camera feed is displayed on your screen only: it is never recorded, saved, or uploaded, and the microphone is never used. The app asks for camera permission only when you first open The Mirror, and you can turn it off at any time in your phone's settings.

Push notifications

Daily reminders are scheduled and generated on your device. If you allow notifications and use the Brotherhood, we also store a push token (an address for your device issued by Apple or Google) linked to your account, so we can tell you when someone replies to you, mentions you, or backs your post. These alerts are sent from our server through Expo's push service and then Apple Push Notification service or Firebase Cloud Messaging. Their text includes the handle of the member who replied (for example "Sam replied to you."). Records of sent alerts are deleted after 7 days. Tokens are deleted when they stop working or when you delete your account.

Technical information

To keep you signed in, we store authentication tokens in your device's secure storage. Inside the app, we do not collect advertising identifiers, precise location, contacts, or browsing history, and we do not use crash tracking SDKs.

App analytics (PostHog)

We use PostHog to understand, in aggregate, how the app is used so we can improve it. It works like this:

• The app creates a random identifier when it is installed. It is not linked to your account, name or email, and we never tell PostHog who you are.
• We send a fixed list of events: the app being installed, updated, opened or closed; which screen you viewed (its name only); onboarding steps viewed and completed; the paywall being opened or dismissed; a purchase or restore completing; an urge session starting and ending (with its length rounded into a range); a daily check in; and whether you respond to prompts to rate or update the app.
• PostHog also receives your device model, operating system, app version, and an approximate country or city derived from your IP address.
• We never send anything you type, your journal, your quiz answers, your urge log details, or your Brotherhood posts. Session recording and tap tracking are switched off.
• Analytics data is stored by PostHog in the United States. Because it is not linked to you, we cannot look up or delete the events from a particular person.

Website analytics

Our website (arisn.app) uses Google Analytics to understand basic, aggregated visitor traffic: such as page views, approximate location (country/region), and device type. This helps us see how people find Arisn. Google Analytics sets cookies and may process your IP address; IP addresses are anonymised where supported. This applies only to the website, not the app, and is not linked to your Arisn account. Analytics cookies are only set after you accept our cookie banner; if you decline, no analytics cookies are stored. You can also opt out using the Google Analytics opt out browser add on or your browser's cookie controls.

3. Sensitive personal data

Where the law requires it, our legal basis for processing this data is your explicit consent, which you give by creating an account and choosing to record this information. You can withdraw that consent at any time by deleting your data and account.

4. How we use your data

• To provide the app's core features (streak, journal, urge tool, levels, timeline).
• To personalise content such as daily quotes, based on your quiz answers.
• To create and secure your account and keep you signed in.
• To back up and restore your data across reinstalls and devices (when signed in).
• To run the Brotherhood: show your posts and comments to other members, notify you about replies, mentions and backing, and keep the community safe.
• To understand, in aggregate and anonymously, how the app is used so we can improve it (see "App analytics").

We do not use your data for advertising, profiling for third parties, or sale.

Moderation

Brotherhood members can report any post or comment. When three different members report the same post or comment, it is hidden from everyone except its author automatically. We review reports ourselves and may remove content or restrict a member who breaks our community rules. We do not currently use any AI or outside service to screen Brotherhood content. If we start, we will update this policy and ask you to accept it in the app first. If you think a decision was wrong, email support@arisn.app and a person will review it.

Our legal basis is our legitimate interest in keeping the community safe. Nothing outside the Brotherhood (your journal, streak, urge log or quiz answers) is ever reviewed for moderation.

5. Where your data is stored & how we protect it

• On your device: your data is stored locally and works fully offline. If you never sign in, it stays on your device.
• In the cloud: once you sign in, your data is stored with Supabase (our database and authentication provider), hosted in the Sydney, Australia (ap-southeast-2) region.
• Data is encrypted in transit (HTTPS/TLS) and at rest in the cloud. Access to your cloud data is restricted to your account through database row level security. Journal entries on your device are stored in encrypted storage (AES 256) whose key is kept in your phone's Keychain or Keystore.
• sign in tokens are kept in your device's encrypted secure storage, not in plain app storage.

6. Who we share data with

We share data only with the service providers needed to run the app, and only as needed:

• Supabase: cloud database, authentication hosting, and the server functions that send Brotherhood alerts.
• RevenueCat: subscription management; receives a pseudonymous app user ID, purchase and renewal status, and basic device metadata. We never receive or store your payment card details.
• PostHog: anonymous app analytics, as described in "App analytics". Never linked to your account.
• Expo: relays Brotherhood push notifications (your push token and the alert text) to Apple and Google.
• Apple: only if you choose Sign in with Apple (for authentication), and to deliver push notifications on iPhone.
• Google: only if you choose to sign in with Google (for authentication), and to deliver push notifications on Android.
• Other Brotherhood members: see what you choose to post there, as described in "Brotherhood (community) data".
• Google Play / Apple App Store: distributes the app and processes subscription payments under their own terms. We do not receive or store your payment card details.
• Google Analytics: aggregated visitor analytics on our website only (not the app).

We do not sell your personal data, and we do not share it with advertisers or data brokers. We may disclose data if required by law (e.g. a valid legal request).

7. International transfers

Your cloud data is stored in the Sydney, Australia (ap-southeast-2) region via Supabase. Some of our providers process data in the United States: Supabase Inc. (its parent company), RevenueCat, PostHog (anonymous analytics) and Expo (push delivery). Neither Australia nor the United States is covered by an EU adequacy decision for these transfers, so transfers from the EEA, UK and Switzerland rely on the Standard Contractual Clauses (and the UK Addendum) in each provider's data processing terms, or on the EU-US Data Privacy Framework where the provider is certified. You can ask us for a copy of the relevant safeguards at support@arisn.app.

India (DPDP Act 2023, §16): The Act permits transfers of personal data outside India to all countries except those restricted by the Central Government. As of the date of this policy, the Government has not published a restricted country list, so international transfers are currently permitted under the Act.

8. How long we keep your data

We keep your data for as long as your account exists. When you delete your account, we delete your associated data from our cloud as described below. Data stored only on your device is removed when you delete the app or clear its storage.

• Brotherhood posts and comments stay until you delete them or your account. Content removed by moderation is hidden from everyone but kept, with its moderation record, until your account is deleted, so repeat violations can be recognised.
• Records of sent push alerts are deleted 7 days after sending.
• Anonymous analytics events are kept by PostHog under our account's retention settings. They are not linked to your account, so deleting your account does not affect them and they cannot identify you.

9. Your rights

Depending on where you live (including under the GDPR, India's DPDP Act 2023, and the CCPA), you may have the right to:

• Access: obtain a summary of the personal data we process about you and how it is used.
• Correct: have inaccurate or incomplete data updated.
• Delete (erasure): have your data and account permanently removed.
• Export (portability): receive your data in a machine readable form; journal entries can be exported as Markdown directly from the app.
• Withdraw consent: stop processing at any time; this does not affect the lawfulness of processing before withdrawal.
• Grievance redressal (India: DPDP §13): submit a complaint to our Grievance Officer (see §13). We will acknowledge within 48 hours and resolve within 30 days. If unresolved, you may escalate to the Data Protection Board of India.
• Nominate (India: DPDP §14): designate another person to exercise your data rights on your behalf in the event of your death or incapacity. Contact us to register a nominee.
• Complain to a regulator: EEA/UK users may lodge a complaint with their national data protection authority; Indian users may escalate to the Data Protection Board of India.

To exercise any of these rights, use the in app options or contact our Grievance Officer at support@arisn.app.

10. How to delete your data

You can delete everything at any time:

1. In the app: open Profile → Delete account & data. This removes your account and all associated data from our cloud and clears it from your device.
2. By request: email support@arisn.app from your account email and we will delete your account and data.

11. India: DPDP Act 2023 supplement

This section applies to users in India and supplements the rest of this policy in accordance with the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025.

Consent notice (DPDP §5 + Rule 3)

Before collecting your personal data, we provide this policy as our Consent Notice. It specifies what data we collect, the purpose for which it is processed, and how you can withdraw consent. By creating an account you acknowledge having read this notice and consent to the processing described herein. You may withdraw consent at any time by deleting your account (see §10).

Purpose limitation & data minimisation

We collect only the personal data necessary for the stated purposes. We do not use your data for any purpose other than those listed in §4. If we wish to use your data for a new purpose, we will seek fresh consent.

Data accuracy & retention

We take reasonable steps to ensure your data is accurate and up to date. Your data is retained only for as long as your account is active or as necessary to fulfil the purposes in §4. When you delete your account, your personal data is erased from our systems (see §10).

Security safeguards (DPDP §8)

We implement reasonable security measures: including encryption in transit, row level access controls, and secure token storage: to prevent unauthorised access, disclosure, or loss of personal data.

Breach notification (DPDP §8(6))

In the event of a personal data breach that is likely to affect your rights, we will notify the Data Protection Board of India and affected users in the manner and within the timeframe prescribed by the Board.

Children's data (DPDP §9)

Arisn is restricted to users aged 18 and above. We do not knowingly process personal data of children (anyone under 18). If we become aware that a minor has provided data, we will delete it promptly.

Grievance redressal (DPDP §13 + Rule 4)

If you have a complaint about how we handle your personal data, you may contact our Grievance Officer (details in §13). We will:

• Acknowledge your complaint within 48 hours of receipt.
• Resolve it within 30 days (or notify you if more time is needed and explain why).

If your complaint is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India at meity.gov.in.

cross border transfers (DPDP §16)

Personal data may be transferred outside India to countries not restricted by the Central Government. As of the effective date of this policy, the Government has not notified any restricted countries, so such transfers are currently permitted under the Act. We will update this section if the permitted countries list changes.

12. Changes to this policy

We may update this policy as the app evolves. When we make material changes, we will update the "Last updated" date and ask you to review and accept the new version in the app before you continue using it.

13. Contact us & Grievance Officer

Questions about this policy, your data, or to exercise your rights: including the DPDP right to grievance redressal and nomination:

• Grievance Officer / Privacy contact: support@arisn.app
• Entity: Arisn

India users: complaints not resolved within 30 days may be escalated to the Data Protection Board of India.
EEA/UK users: you may also contact your national data protection authority.