PRIVACY POLICY

1. INFORMATION WE COLLECT

1.1 Information you provide directly:

• Name and email address (beta sign-up and account creation)
• Daily check-in responses (anxiety level, worry category)
• Reassurance-seeking log entries (number of checking episodes per day)
• Responses to CBT and ERP exercises within the app
• Optional: age group, country, health context (from beta application)

1.2 Information collected automatically:

• Device type and operating system
• App version
• Session duration and feature usage (anonymised)
• Crash reports and error logs (no personal data attached)

1.3 Information we do NOT collect:

• We do not collect precise location data
• We do not access your camera, microphone, or contacts
• We do not read your browser history or Google search queries
• We do not sell your data to third parties — ever

2. HOW WE USE YOUR INFORMATION

We use your information to:

• Generate your personalised daily CBT/ERP exercise via the Claude AI API
• Show you your own progress data (anxiety trend, checking episodes)
• Send you daily check-in reminders (if you enable push notifications)
• Improve the app based on anonymised usage patterns
• Respond to support requests

Your daily check-in data and exercise responses are used solely to

personalise your in-app experience. They are not shared with employers,

insurance companies, healthcare providers, or any third party.

3. AI PROCESSING (CLAUDE API)

Calma uses Anthropic's Claude API to generate your personalised daily

exercise. When you submit a check-in, your anxiety level and worry

category are sent to the Claude API to generate a response. This data

is processed under Anthropic's API Terms of Service and Privacy Policy.

We send the minimum data necessary: anxiety level (a number 1–10) and

worry category (a general label). We do not send your name, email, or

any identifying information to the Claude API.

Anthropic's privacy policy: https://www.anthropic.com/privacy

4. DATA STORAGE AND SECURITY

Your data is stored on Supabase (https://supabase.com), a secure

cloud database platform. All data is encrypted at rest (AES-256)

and in transit (TLS 1.3).

We retain your data for as long as your account is active. If you

delete your account, all personal data is permanently deleted within

30 days.

5. YOUR RIGHTS

You have the right to:

• Access a copy of all data we hold about you
• Correct inaccurate data
• Request deletion of your data (right to be forgotten)
• Withdraw consent for data processing at any time
• Export your data in a portable format (CSV)
• Lodge a complaint with a data protection authority

To exercise any of these rights, email: hello@calmaapp.com

We will respond within 30 days.

6. COOKIES

We use minimal cookies. See our Cookie Policy at calmaapp.com/cookies

for full details.

7. CHILDREN'S PRIVACY

Calma is not intended for users under the age of 18. We do not

knowingly collect data from minors. If you believe a minor has

provided us with personal data, contact hello@calmaapp.com and

we will delete it immediately.

8. CHANGES TO THIS POLICY

We will notify registered users by email of any material changes

to this policy at least 14 days before they take effect. The

"Last Updated" date at the top of this page will always reflect

the most current version.

9. CONTACT

Calma / kriva.studio / LasyaAitech

Email: hello@calmaapp.com

Website: https://lasyaaitech.com

For data protection enquiries specifically:

privacy@calmaapp.com