Privacy Policy

Information We Collect

We collect information you provide directly and data generated through your use of the app:

• Account data — name, email address, and password upon registration
• Profile data — gender, date of birth, and optional avatar photo
• Authentication tokens — from Apple Sign In or Google Sign In if used
• Session data — meditations completed, breathing exercises, sounds, durations, XP, and level progress
• Journal entries — mood logs, anxiety diary records, and personal notes you write
• Notification preferences — which notifications you have enabled or disabled
• Device data — device model, OS version, and app version for technical support

How We Use Your Information

Your data is used exclusively to provide and improve your Eilo experience:

• Deliver personalized meditation, breathing, and sound content
• Track your progress, streaks, XP levels, and medal achievements
• Sync your data securely across sessions and app relaunches
• Send relevant push notifications (fully controllable by you)
• Display Live Activity and Lock Screen controls during sessions
• Improve app features through anonymized, aggregated analytics
• Maintain account security and prevent unauthorized access

We do not use your data for advertising, profiling, or any purpose unrelated to providing the Eilo service.

Data Storage & Security

Your data is stored on secure servers. We apply industry-standard security measures including:

• HTTPS/TLS encryption for all data transmitted between the app and our servers
• JWT authentication tokens stored securely in the device Keychain (not UserDefaults)
• Passwords hashed using bcrypt — never stored in plaintext
• Regular security reviews and dependency updates

Your journal entries and personal notes are private to your account and are only accessible through your authenticated session.

Third-Party Services

Eilo uses the following third-party services, each governed by their own privacy policies:

• Apple Sign In — secure authentication via Apple ID
• Google Sign In — secure authentication via Google account
• Apple Push Notification Service (APNs) — delivering push notifications
• Apple ActivityKit — Live Activity on Lock Screen (processed on-device only)
• Strapi — backend content management platform for API and data storage

We do not sell, rent, or share your personal data with advertisers, data brokers, or third-party marketing services.

Your Rights & Controls

You have full control over your personal data at all times:

• Access — view your profile and session history in the app
• Update — edit your name, avatar, gender, and birthday in Profile Settings
• Delete — request full account and data deletion by contacting us
• Notifications — enable or disable notifications in iOS Settings or the app
• Export — request a copy of your personal data by emailing us

For users in the European Economic Area (EEA), you also have rights under GDPR including the right to restrict processing and the right to object.

Children's Privacy

Eilo is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us immediately and we will delete it promptly.

Data Retention

We retain your personal data for as long as your account is active or as required to provide the service. Upon account deletion request, your data will be permanently removed from our servers within 30 days, except where retention is required by applicable law.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable laws. When we make material changes, we will notify you through the app or via email at least 7 days before changes take effect.

Your continued use of Eilo after changes are posted constitutes your acceptance of the updated Privacy Policy.