Privacy Policy — Catharsis Cards

1. Who We Are

Catharsis Cards is a mindfulness and self-discovery app operated by WeMadeThisOÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Järvevana tee 9, 11314, Estonia. This policy explains what personal data we collect, why we collect it, and how it is handled when you use our app.

For any privacy-related questions, contact us at findyourcatharsis@gmail.com.

2. Data We Collect

We collect the minimum data necessary to provide the app's features:

Account data — email address, display name, and optional profile avatar (photo).
User-generated content — personal reflections you write on liked cards, and answers and votes you submit during Circle mode sessions.
App activity — which questions you like or skip, your daily streak count, selected categories, and subscription status.
Usage and analytics data — aggregated, anonymised information about how the app is used, collected via Firebase Analytics (e.g. screens viewed, session length). This does not identify you individually.
Advertising identifiers — if you are on the free tier, Google AdMob may collect your device advertising identifier (IDFA on iOS, GAID on Android) to serve ads. You can opt out of personalised ads in your device settings.
Purchase data — when you subscribe, transaction metadata is processed by Apple App Store or Google Play. We do not receive your full payment details.

3. How We Use Your Data

To provide and personalise the app experience (saving liked cards, syncing Circle sessions, maintaining your streak).
To process and verify your subscription status.
To generate AI-powered questions via our server-side integration with OpenAI (see §5).
To display relevant advertisements to free-tier users via Google AdMob.
To understand how the app is used in aggregate, so we can improve it.
To send you local notifications if you enable streak reminders (no marketing push notifications are sent).

4. Legal Basis for Processing (GDPR)

As an EU-based operator registered in Estonia, we process personal data under the following legal bases as defined by the GDPR:

Contract performance — processing necessary to provide the services you signed up for (account, subscriptions, Circle mode).
Legitimate interests — anonymised analytics to improve the app, where this does not override your privacy rights.
Consent — advertising identifiers and personalised ads, which you can withdraw at any time via your device settings.

5. Third-Party Services

We use the following third-party services to operate the app. Each acts as a data processor on our behalf:

Service	Provider	Purpose
Firebase Auth, Firestore, Storage, Analytics	Google LLC	Authentication, database, file storage, usage analytics
Google AdMob	Google LLC	Advertising shown to free-tier users
Google Play Billing	Google LLC	Subscription purchase processing (Android)
Apple App Store / StoreKit	Apple Inc.	Subscription purchase processing (iOS)
OpenAI API	OpenAI, L.L.C.	Server-side AI question generation. Only the requested category and question count are sent — no personal data is transmitted.

We do not sell your personal data to any third parties.

6. Data Retention

Account and profile data — retained until you delete your account.
User-generated content (reflections, Circle session answers) — retained until you delete the relevant content or your account.
Analytics data — anonymised and retained for up to 24 months.
Subscription status — stored locally on your device only; cleared if you uninstall the app.

7. Your Rights

Under the GDPR and applicable data protection law, you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion of your personal data ("right to be forgotten").
Portability — receive your data in a structured, machine-readable format.
Restriction — ask us to limit how we process your data in certain circumstances.
Object — object to processing based on legitimate interests.
Withdraw consent — for advertising identifiers, opt out via your device settings at any time.

To exercise any of these rights, contact us at findyourcatharsis@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee).

8. Account Deletion

You can delete your account directly from within the app under Account Settings. Deletion removes your profile, reflections, and associated data from our systems within 30 days.

Note: Circle mode session documents in which you participated are not fully removed on deletion — your answers remain visible to the other participants of that session. If you need these removed as well, contact us directly.

View step-by-step account deletion instructions →

9. Children's Privacy

The app is available to users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.

10. International Data Transfers

Your data may be processed in countries outside the European Economic Area, including the United States, by our third-party service providers (Google, Apple, OpenAI). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to ensure your data is protected in accordance with GDPR.

11. Security

We use industry-standard encryption in transit (TLS) and at rest for all data stored with Firebase. Whilst we take reasonable steps to protect your information, no method of transmission or storage is completely secure. If you believe your account has been compromised, contact us immediately.

12. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the app after changes are posted constitutes acceptance of the revised policy.

13. Contact

For any privacy questions, data requests, or concerns:

WeMadeThisOÜ — Privacy

findyourcatharsis@gmail.com