Skip to content
Restorae

Privacy Policy

Effective: September 9, 2026

This Privacy Policy explains how Bagadi LLC, the operator of Restorae ("we" or "us"), collects, uses, stores, and shares information when you use the Restorae mobile application or visit restorae.app (together, the "Service"). Restorae is a lifestyle app for emotional awareness and self-reflection. This policy is written to satisfy the App Store Privacy Nutrition Label, the Google Play Data Safety declaration, the EU General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and applicable Canadian, UK, and Australian privacy laws. If anything here is unclear, email privacy@restorae.app.

Who is the data controller

Bagadi LLC operates Restorae and is the data controller for personal information processed in connection with the Service. For GDPR purposes, data-subject requests can be sent to privacy@restorae.app. We do not have an EU or UK representative; our processing is consumer-direct and we do not operate local establishments.

What we collect and why

Account information

When you create an account we collect an email address or phone number and, optionally, a display name and profile photo. If you sign in with Apple or Google, we receive the identifier and email those providers release. Phone sign-in sends your number to Firebase for verification. Google stores phone numbers and uses them to prevent spam and abuse across its services, including Firebase. The phone sign-in screen asks for your consent before sending the number. Our service handles any available fallback verification flow. We do not receive your provider password. Your email address is stored encrypted at rest; the lookup key we use to log you in is an HMAC of the lower-cased address, so a database breach exposes neither your address nor an offline-brute-force path to it. Legal basis: performance of the contract you enter when you create an account (GDPR Art. 6(1)(b)).

Emotional check-ins, journal entries, and reflections

The core of Restorae is your daily emotional check-ins: the quadrant you select, an optional short note, and the time and timezone you recorded the check-in. Journal entries, journal prompts, program-day written reflections, and direct messages between you and a companion are stored alongside check-ins. This is the most sensitive category of data we hold. Every one of those fields is encrypted at rest with AES-256-GCM, with a per-row initialization vector, an authentication tag, and a key identifier that lets us rotate the encryption key without re-uploading anything. Access is controlled by authenticated application permissions. Companion messages are also available to their intended recipient. Journal entries you flag as biometric-locked are additionally gated by a device-local biometric check before they decrypt on screen. Legal basis: performance of the contract.

Usage telemetry

When the app is active we may send product-interaction events (for example, check-in completed, tool session started) to our own backend so we can understand what is being used and what is not. Optional product telemetry is off on a fresh install and is controlled by your choice in You → Settings → Share Usage Data. Turning it off suppresses these optional events at the source. Essential crash diagnostics are handled separately below. We do not run any third-party analytics SDK and these events are associated with your account ID for troubleshooting. They do not include journal text. Legal basis: your consent (GDPR Art. 6(1)(a)), revocable at any time.

Crash and diagnostic data

Crash reports go to our own diagnostic endpoint and self-hosted observability service. Reports can include a scrubbed error message and stack trace, operating platform, app version and build, and limited diagnostic context. The reporter does not attach your account identifier. We use these reports to diagnose failures and maintain the service; they are separate from optional product analytics. We do not include the Firebase Crashlytics SDK in this release.

Purchase history

Subscriptions are processed by Apple on iOS and Google on Android. We see the resulting entitlement state via RevenueCat (a subscription-management processor): which product you purchased, when it renews, and whether it is active. We do not receive your payment card or banking details; those stay with Apple, Google, or your card network. Legal basis: performance of the contract.

Device identifiers, sync secrets, and reminders

We store a per-device identifier and a per-device sync secret, encrypted at rest, to verify offline synchronization requests. The app schedules local reminders on your device when you allow notifications. It does not register an FCM push token in this release. We do not use advertising identifiers (IDFA, AAID) or track you across apps or websites.

What we do not collect

  • Contacts, calendar, precise location, microphone recordings, or your entire photo library. If you choose a profile photo, we receive only the image you select or capture using the camera.
  • Health data (Apple HealthKit, Google Fit) or any clinical record.
  • Advertising identifiers (IDFA, AAID).
  • Browsing history or analytics from other apps or websites you use.
  • Anything from third-party apps installed on your device.

Third-party processors (sub-processors)

The following service providers process personal information on our behalf under written data-processing agreements. They act as "sub-processors" under GDPR and "service providers" under CCPA/CPRA; none of them sells your data. None of them receives your full journal entries; the only AI processor we use, Anthropic, sees only minimized signals as described in Where AI is used in Restorae below. A maintained list of sub-processors with effective dates lives at restorae.app/sub-processors.

  • Apple, Inc. — App Store billing and Sign in with Apple. Data: subscription state and Apple user identifier. Region: United States.
  • Google LLC (incl. Firebase) — Play Store billing, Google Sign-In, Firebase phone authentication. Data: subscription state, Google or Firebase user identifier, phone number, and device or app-verification signals needed for authentication. Region: United States.
  • RevenueCat, Inc. — subscription reconciliation across iOS and Android. Data: our user identifier, store transaction metadata. Region: United States.
  • Oracle America, Inc. (Oracle Cloud Infrastructure) — cloud hosting for the backend and application runtime. Data: encrypted application traffic and operational metadata. Region: United States.
  • Twilio Inc. (SendGrid) — transactional email only: account verification, password reset, account-deletion confirmation, and security alerts. We do not send marketing email. Data: email address, message body. Region: United States.
  • Anthropic PBC — AI insight narration and program personalization (Claude API) for Premium. Data: emotion words, derived signals, truncated note excerpts, journal keywords — never full journal entries. Region: United States.

Where AI is used in Restorae

Only after you enable AI personalization in You → Settings and accept the disclosure, optional AI insights, program personalization and post-session reflections call Anthropic's Claude API, which acts as a processor on our behalf under a written data-processing agreement. We practice strict data minimization: the prompt for these features sees only your emotion words, derived signals, truncated note excerpts, and journal keywords. We never send full journal entries or add your account name or email to prompts. Note excerpts can contain details you write yourself, so avoid identifying details in notes you allow AI to use. Anthropic does not use Restorae content to train its models, and provider-side inputs are retained for at most 30 days before deletion. You can read what Anthropic processes and when on our sub-processors page.

When AI features are disabled, Restorae uses deterministic rule-based fallbacks and sends no content to an AI provider. Restorae does not send content to OpenAI, Google, or any AI provider other than Anthropic for the features described above, and never uses your content to train a machine-learning model. AI personalization is off by default. Turn it off at any time in You → Settings → AI personalizationto stop future AI processing; existing insights remain in your history.

Data security

Network traffic is encrypted in transit with TLS 1.2 or higher, and the mobile app pins the leaf certificate by SHA-256 in release builds. Sensitive fields — your email address, check-in notes, journal entries, journal prompts, program-day written reflections, companion direct messages, and per-device sync secrets — are encrypted at rest with AES-256-GCM using keys held in our server-side key management. Database backups inherit the same encryption. Production access is restricted to the engineering team, gated by SSH keys, and every administrative action is recorded in an append-only audit log that the application itself cannot edit.

Retention

  • Active accounts: retained for the duration of your use.
  • Deleted accounts: soft-deleted for 7 days so you can reverse the decision, then the encryption keys associated with your data are destroyed. Backups containing deleted data age out within 30 days.
  • Crash diagnostics follow our operational log-retention settings. The mobile reporter does not attach an account identifier.
  • Server-side request logs: 30 days, then expire. Email addresses are redacted by a regex pre-processor before logs are stored.

Your rights

You have the right to:

  • Access — request a copy of the data we hold. In-app: You → Export My Data.
  • Rectify — correct inaccurate data. In-app: You → Profile.
  • Erase — delete your account and all associated data. In-app: You → Delete account. You can also request deletion without signing in via restorae.app/delete-account.
  • Portability — receive your data in machine-readable form (CSV).
  • Object / restrict processing — disable telemetry, or write to us for other processing objections.
  • Withdraw consent — in-app for telemetry and AI personalization; email us for other requests.
  • Lodge a complaint — with your local supervisory authority (EU residents) or the Information Commissioner's Office (UK residents).

We respond to requests within 30 days. If you are an EU/UK resident and prefer to email, write to privacy@restorae.app.

California residents (CCPA/CPRA)

We do not sell or share personal information as those terms are defined by the CCPA/CPRA. California residents have the right to know what we collect, to delete, to correct, to opt out of sale or sharing (not applicable here), to limit the use of sensitive personal information (which our telemetry toggle supports), and to non- discrimination for exercising these rights. You can exercise any of them through the in-app controls above or by emailing privacy@restorae.app. An authorized agent can act on your behalf with signed written authorization.

Children

Restorae is not directed at children under 13 in the United States or under 16 in the European Union, and we do not knowingly collect personal information from them. If you are a parent or guardian and believe your child has used the Service without your consent, email us and we will delete the account.

International transfers

Restorae is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required, we rely on the European Commission's Standard Contractual Clauses with our sub-processors for transfers out of the EU/UK.

About the app

Restorae is a lifestyle app for emotional awareness and self-reflection. The app does not provide healthcare, therapy, diagnosis, treatment, or emergency assistance. Personal check-ins and journals are private reflections, not clinical records. The protections described in this policy apply to the personal information you choose to share.

Changes to this policy

We may update this Privacy Policy. Material changes will be notified in-app at least 14 days before they take effect; the effective date at the top of this page always reflects the current version. Past versions are available on request.

Contact

Privacy questions, data-subject requests, regulator correspondence: privacy@restorae.app. Sub-processor list and effective dates: restorae.app/sub-processors. Tracking practices: restorae.app/cookies.