Privacy Policy

1. Who We Are

NumaHaven is a self-guided mental wellness mobile application offering breathing exercises, guided meditations, journaling, mood tracking, and personalised wellness session plans. NumaHaven is operated by CareSoul AI Private Limited.

NumaHaven is not a mental health establishment under the Mental Healthcare Act, 2017, and does not provide clinical services, diagnosis, or treatment. We are a technology platform offering self-reflection and wellness tools.

Data Fiduciary (under India DPDPA 2023): CareSoul AI Private Limited.

2. Your Account: Guest or Signed In

You can use NumaHaven in two ways, and this affects what data we hold about you:

• Guest account: when you first open the app you can start without an email address. We create an account for you that is linked to your device, and everything you do (check-ins, practices, journal) is stored under that account. A guest account has no email, no password, and no name unless you choose to give one.
• Signed-in account: at any time you can add an email address, or continue with Google or Apple. When you do this from a guest account with an identity we have never seen before, the identity is attached to your existing account, so your history stays with you. If you sign in to an account that already exists, you switch to that account.

Guest accounts that are never claimed and show no activity for 90 days are automatically and permanently deleted, including all wellness data stored under them. This is described further in Section 7 (Data Retention).

3. Data We Collect

We collect only what is necessary to provide our services:

• Account information: email address (once you add one) and display name
• Authentication data: passwords for legacy password accounts (irreversibly hashed using bcrypt), one-time sign-in codes (short-lived, stored hashed), refresh tokens (hashed), and OAuth identifiers if you sign in with Google or Apple
• Device identifier: a random identifier generated by the app and kept in your device's secure storage. It is used for exactly three things: keeping one guest account per device, enforcing the single-device policy on paid and employer-provided accounts, and binding sign-in sessions to your device for security. It is not an advertising identifier and is never used for tracking or profiling.
• Wellness content you create:
  • Assessment responses and scores
  • Journal entries (titles and content you write)
  • Mood check-ins (mood labels, energy levels, optional notes)
  • Session practice logs and post-session reflections
  • Goals and check-ins, favourites, practice week tracking
  • Reminder times you choose, and optional monthly reflections
• AI-generated content: wellness summaries and personalised session plans created from your assessments
• Consent records: your opt-in and opt-out choices for health data processing, AI analysis, and your acceptance of the Terms and this policy, each with a version and timestamp
• Subscription status: if you subscribe to NumaHaven Plus, we hold your subscription state (active, expired, plan type). Payment itself happens through Apple or Google; we never see your card details.
• Usage events: which features and screens you use (for example, "completed a breathing exercise" or "viewed the paywall"), linked to your account. These never include journal text, mood notes, or any free-text content, and they are deleted with your account.
• Technical metadata: timezone (for scheduling reminders), anonymised crash reports, error context
• Waitlist email: if you join the waitlist on our website, we store your email address solely to send launch announcements, and delete it on request

Voice input: some writing surfaces offer optional voice dictation. If you use it, the app asks for microphone and speech recognition permission, and your speech is converted to text by your device's speech service (provided by Apple on iOS and Google on Android, which may process audio on-device or on their servers under their own policies). We never receive or store your audio. Only the resulting text reaches us, and only if the surface saves text at all: dictation into a journal entry is saved like typed text, while the one-line thought release exercise is never stored anywhere, spoken or typed.

We do not collect:

• Location data (GPS, IP-based location, or otherwise)
• Audio recordings (see voice input above: speech-to-text happens on your device's speech service; no audio ever reaches our servers)
• Contacts
• Device advertising identifiers
• Browsing history outside the app
• Biometric data
• Card or bank details (payments are handled entirely by Apple and Google)

About camera and photo-library permissions: the Android build of NumaHaven declares the CAMERA and photo-library permissions as part of bundled libraries that support a planned profile-photo feature. This feature is not enabled in the current version: the app does not access your camera, photo library, or any media on your device. If we enable any feature that actually uses these permissions in a future release, we will update this policy and request your explicit consent at the moment of use through the standard Android runtime permission prompt.

4. How We Use Your Data

Your data is used only to:

• Deliver personalised wellness recommendations based on your assessments
• Generate AI-based wellness summaries and session plans (Section 8)
• Track your practice progress across sessions and days, including the progress artwork the app draws from your practice history
• Send reminder notifications you explicitly opt in to. Reminders are scheduled locally on your device; no notification service receives your data.
• Provide account authentication, session security, and subscription entitlement
• Understand how features are used, through the usage events described in Section 3, so we can improve the product

We never:

• Sell your personal data to any third party
• Use your wellness data for advertising or retargeting
• Use your data to train AI models
• Share your journal entries, mood notes, or assessment responses with anyone outside the processors named in Section 8
• Use sensitive health data for employment, insurance, credit, or eligibility decisions, or for unauthorised social sharing

5. Data Storage and Security

Your data is stored on secure servers in Helsinki, Finland (European Union), operated by Hetzner Online GmbH in ISO 27001-certified data centres. By using NumaHaven, you consent to your personal data being transferred to and processed in the European Union.

Data stored in the EU is protected under the General Data Protection Regulation (GDPR). If you are located in India, we also comply with the Digital Personal Data Protection Act (DPDPA) 2023, and the transfer of your data to the European Union is a permitted cross-border transfer under the DPDPA framework.

Security measures

• All data encrypted in transit using TLS 1.2 or higher
• Certificate pinning enforced in the mobile app
• Passwords hashed with bcrypt (cost factor 12); never stored in readable form
• Authentication tokens stored in your device's secure keychain (iOS Keychain / Android Keystore / EncryptedSharedPreferences)
• JWT access tokens expire within 24 hours; refresh tokens rotate with theft-detection family revocation
• Database is not exposed to the public internet; access restricted to authorised personnel through role-based access controls
• Password changes invalidate all existing sessions across devices

6. Your Rights Under DPDPA 2023 and GDPR

You have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Delete your data ("right to erasure"): see Section 10 and our Data Deletion page
• Export your data in a portable, machine-readable JSON format
• Withdraw consent for AI analysis or health data processing at any time, as easily as you gave it, from Settings inside the app
• Object to or restrict certain processing (under GDPR)
• Nominate another individual to exercise your rights in the event of death or incapacity (under DPDPA)
• Lodge a complaint with a supervisory authority

To exercise these rights, use Settings → Your Data in the app, or contact us at support@numahaven.ai.

If you are in India and are not satisfied with our response, you may escalate your grievance to the Data Protection Board of India through the mechanism notified by the Government of India. If you are in the EU, you may contact your Member State's data protection authority.

7. Data Retention

We keep personal data only as long as it serves the purpose you gave it to us for:

• Active accounts: your data is retained for as long as your account exists.
• Deleted accounts: when you delete your account (in-app or by email), all personal data is removed from live systems immediately and from backups within 30 days.
• Unclaimed guest accounts: a guest account with no activity for 90 days is automatically and permanently deleted, along with all data stored under it.
• One-time sign-in codes: expire within minutes and are deleted on use or expiry.
• Consent receipts: when an account is deleted, we retain a minimal proof-of-consent record (a one-way hash of the email, the consent type, version, and timestamps, with no wellness data and no readable identity). This is standard accountability practice under GDPR and DPDPA: it lets us demonstrate that consent existed if a question is raised later. These receipts are kept for 3 years (matching India's civil limitation period) and then permanently deleted.

Anonymised, aggregated statistics that cannot be linked to you personally may be retained for service improvement. Such data never includes journal entries, mood notes, or any free-text content.

8. Third-Party Services

We use the following third-party services that process limited data strictly for the purposes described:

• OpenAI receives your assessment responses when generating personalised wellness session plans and summaries. Only users who have explicitly granted AI consent have their data sent to OpenAI. Data submitted to the OpenAI API is not used to train OpenAI models under OpenAI's API data usage policies.
• Google (Sign-In): if you choose to continue with Google, Google provides us your email address, Google user ID, and display name. No NumaHaven data is sent to Google.
• Apple (Sign in with Apple): if you choose to continue with Apple, Apple provides us your Apple user ID, and your name and email if you share them. If you hide or withhold your email, we create your account against your Apple ID with an internal placeholder address. No NumaHaven data is sent to Apple.
• RevenueCat manages NumaHaven Plus subscriptions. It receives your NumaHaven account ID and the purchase receipt issued by Apple or Google, so your subscription follows your account across devices. RevenueCat never receives wellness data. Payment details stay entirely with Apple or Google.
• Hetzner Online GmbH hosts our servers and database in Helsinki, Finland under ISO 27001 certification.
• Sentry receives anonymised crash reports and error context. Journal entries, mood entries, and assessment responses are never sent to Sentry. User identifiers are stripped of personal information before transmission.
• SMTP provider (Gmail) sends transactional emails (sign-in codes, verification, security notifications). It receives only your email address and the message content.
• Apple / Google speech services convert your voice to text on the writing surfaces that offer dictation, as described in Section 3. We never receive audio.

Reminder notifications are scheduled locally on your device: no push notification service receives your data.

Each third-party provider is contractually or operationally bound to protect your data and use it only for the specified purpose.

9. Grievance Redressal

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, our Grievance Officers are:

• Shahnawaz, Grievance Officer
• Kirtimaan, Grievance Officer

Email: support@numahaven.ai
Response time: Within 24 hours of receipt
Resolution time: Within 15 days of receipt for substantive complaints

10. Data Breaches

If a personal data breach occurs, we will notify the Data Protection Board of India and each affected user as required by the DPDPA 2023 and applicable rules, and where GDPR applies, the relevant supervisory authority within the prescribed timelines. We maintain an internal incident response process for detecting, containing, and reporting breaches.

11. Age, Consent, and Children's Privacy

NumaHaven is intended for users aged 18 and above. By creating an account, you represent that you are 18 years of age or older.

We do not:

• Knowingly collect personal data from anyone under 18
• Use tracking, behavioural monitoring, or retargeting against users of any age
• Direct advertising of any kind to users

If you are a parent or guardian and believe a minor under 18 has created an account, email support@numahaven.ai and we will promptly delete the account and all associated data.

12. Account Deletion

You can delete your account and all associated data at any time:

• In-app: Settings → Account → Delete Account. Guest accounts can delete the same way.
• By email: send a request to support@numahaven.ai from the email address associated with your account

See our dedicated Data Deletion Page for complete instructions and the list of data that is removed.

13. California Privacy Rights

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the "sale" of personal information

We do not sell personal information. To exercise your rights, contact us at support@numahaven.ai.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app and update the "Last updated" date at the top of this policy. Continued use of NumaHaven after changes constitutes acceptance of the updated policy.

15. Contact

For any questions about this policy, our data practices, or to exercise your rights:

Email: support@numahaven.ai
Operator: CareSoul AI Private Limited
Parent company: CareSoul.ai
Data hosting: Hetzner Online GmbH, Helsinki, Finland (EU)