Privacy Policy

Effective date: July 26, 2026

Your practice data belongs to you. Praxa keeps everything you track on your device, not on our servers. We have no copy of it, and no way to see it.

This policy covers the little that ever leaves your device — always with your approval: usage stats you can turn off, and anything you choose to send us when you ask for help or report a problem. None of that is built to carry the substance of your practice history. In the single case where we could receive partial data — when a data file is too damaged for us to describe any other way — we tell you plainly below, and nothing is sent without your explicit approval.

Your practice data

Everything you track — your practices, schedules, daily completions, mantras, and notes — lives only on your device. We don't have a server copy, we can't read it, and it isn't tied to any account with us.

Your device backup. Your practice data is included in your iPhone's own backup — iCloud Backup, or an encrypted backup you make to your computer — so replacing or restoring your phone brings your practices back with it. That backup is yours: it sits in your own Apple account, we never receive it, and we have no way to reach it.

Apple encrypts iCloud backups. By default Apple holds the keys, which means Apple can be compelled to hand over a backup's contents. Backups you make to your own computer with "Encrypt local backup" are end-to-end encrypted already. You can also exclude Praxa from your backup entirely under Settings → [your name] → iCloud → Manage Storage → Backups. However, doing so risks losing your history if you lose or replace your device.

Usage stats

We use TelemetryDeck to see how the app is used in aggregate. For example, how many people finish onboarding or how often a feature gets used. These events:

• describe an action, not you (e.g. "a practice was created") — never your practice names, mantras, or notes;
• carry a randomly generated identifier, not tied to any account, email, or name. That identifier reaches us as a one-way hash, and it's destroyed any time you delete the app;
• carry your app version, so we can tell if a release version caused something to get better or worse;
• are on by default, and you can turn them off anytime under Settings → Privacy & legal.

The events don't carry anything that we could use to find you. But a value that persists on your device can single that device out, so it's pseudonymous. To the extent it's ever treated as personal data, our basis for it is our legitimate interest in understanding and improving the app. Usage stats older than 3 months are archived, not deleted.

Feedback

When you send feedback from within the Settings page, your message and your email address (if you chose to include one) is stored on our backend, run by Supabase. We use it for one thing: to read and respond to what you told us. It isn't linked to your usage stats or anything else we hold.

It's a one-way inbox. Once a message is submitted, neither the app nor anyone using it can read it back out.

We can't verify that an email address belongs to whoever typed it, so by adding one you're confirming it's yours to use and that you're fine being contacted there about your feedback. We keep feedback for up to 365 days, then delete it. If you added your email, you can ask us to delete yours sooner — see Your rights.

Error reports

If Praxa ever can't open your data, the recovery screen asks whether you'd like to send us an error report first. Nothing is sent unless you tap Send. If you do, we receive:

• a description of the shape of the file that failed to load — how many practices it held, which fields were present, the type and length of each value, how many days of history were recorded, and the first and last dates in it;
• the technical error message explaining why it failed;
• your app version and OS version.

We do not receive the contents of your practice data. Your practice text, notes, and day-by-day history are stripped out before the report leaves your device.

There's one honest exception. If a file is so damaged we can't even describe its shape, we instead include a short excerpt of the raw text around the point where reading failed — capped at a few hundred characters, with longer words obscured. Because that excerpt is a fragment of the file itself, it may carry a word you wrote. It never includes the whole file.

We process an error report only because you chose to send it; your consent is the legal basis. It's stored with Supabase, in a separate inbox from feedback, with no account, email, or other identifier attached. That anonymity cuts both ways: we have no way to find one person's report among the rest, so we can't single one out to delete on request. Every error report is automatically deleted within 90 days.

Purchases

If you support Praxa with an in-app tip, the purchase runs entirely through Apple. RevenueCat checks the receipt and records that a purchase happened, under an anonymous app-generated ID — not your name, Apple ID, or payment details, none of which we ever see.

How we protect what little we hold

The strongest protection is the design itself: your practice data never reaches us, so there's no server copy of it for anyone — including us — to lose. For the little that does reach us:

• it travels over encrypted connections (the standard HTTPS/TLS your device already uses);
• feedback and error reports land in a one-way inbox that can't be read back out;
• we hold no passwords and no accounts, so there's no login for anyone to break into.

No method of storing or sending data over the internet is ever completely secure, so we can't promise absolute security — but we've kept the surface small on purpose, so there's very little to protect in the first place.

We don't profile you, score you, or make automated decisions about you. The reflections Praxa shows you are worked out on your own device, from your own data, and never leave it.

Children

Praxa isn't directed to children under 13, and we don't knowingly collect personal information from them.

Where your data is handled

The data that reaches us is handled by the services named throughout this document, which may process and store it on servers outside your country. Where that means moving data out of your region, such as the UK or EEA, it's covered by an appropriate safeguard — an adequacy decision or standard contractual clauses — provided by the service handling it. Your device backup isn't part of any of this: it goes to Apple, under your own account, never to us.

We don't sell your data

We don't, and won't, sell or share your personal information, and we don't use it for advertising of any kind. There's nothing here to opt out of on that front.

Your rights

Personal data is any information that could identify you. Depending on where you live — under the UK or EU GDPR, for instance — you have rights over the personal data we hold about you: to see it, correct it, delete it, object to or limit how we use it, receive it in a portable form, and withdraw consent you gave. You can also complain to your local data-protection authority (in the UK, that's the ICO).

Here's the honest shape of that, given how little we hold:

• Your practice data — we never receive it, so there's nothing on our side to see, export, or delete. It lives on your device (delete the app to remove it) and in your own Apple backup (manage it in your iCloud or computer settings).
• Usage stats — there is a per-install record here, but nothing that connects it to you. We hold no key linking that random value to a person, so we can't pick yours out to show you or delete it. You can switch it off in the app anytime.
• Feedback — if you included an email address, that's the one identifiable thing we might hold. Email us and we'll show you what's there or delete it.
• Error reports — these carry no identifier, so there's no individual report we could single out to act on.

To exercise any of these, just email us. We'll respond within one month. It's free, and asking won't change how we treat you.

Contact

Praxa is made by José De Gyves, the data controller for the data described here. Questions about this policy or your data go to praxa.app@gmail.com.

Changes

If we change what we collect or how we use it, we'll update this policy and move the effective date at the top.