Privacy Policy

• Download and use our mobile application (Salwa), or any other application of ours that links to this Privacy Notice
• Use Salwa. Salwa is an iOS mindfulness app designed to support emotional processing through intentional reflection. The app guides users through a structured practice: write a brief reflection about something they are holding onto, sit with it during a 90-second meditative breathing session, then make a deliberate choice to release or hold the reflection. Reflections that are released are permanently deleted. No text is retained after release. Reflections that are held are stored temporarily in the user's personal practice space, with a maximum of seven held at one time. The app tracks a user's emotional practice over time, including reflection frequency, emotion tags selected, and release history. This data is used solely to display the user's own practice history within the app. Salwa does not analyze, share, or sell this data to third parties. The app offers optional account creation via Apple Sign-In or Google Sign-In to enable data sync across devices. Users may also use the app without signing in, in which case all data is stored locally on the device.
• Engage with us in other related ways, including any marketing or events

• Email address. Collected when you register via Apple Sign-In or Google Sign-In.
• Reflection text (user-generated content). Text you write during the reflection practice. Reflections you choose to save as Moments are encrypted on your device using AES-256 encryption before being transmitted or stored on our servers. The encryption key lives in your device's secure iOS Keychain; we cannot read the content of your saved Moments even with full database access. Reflections you choose to release are permanently and irrevocably deleted — no copy is retained anywhere.
• Emotion tags. Short descriptive words (e.g., "anxious," "grief," "joy") you select to label your emotional state during a session. Emotion tags are stored in association with your account to power your in-app practice history. Unlike reflection text, emotion tags are not end-to-end encrypted. They are never shared with third parties or used for advertising.
• Practice history metadata. Dates, session counts, release/hold outcomes — used solely to display your own history within the app.

• Precise or approximate location data
• Contacts, phone numbers, or address book data
• Microphone or camera input of any kind
• Photos or media from your device library
• Apple Advertising Identifier (IDFA) or any advertising identifier
• Apple HealthKit data or any health platform data
• Browsing history outside the app
• Face ID or fingerprint biometric data

• Mobile Device Data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model, Internet service provider and/or mobile carrier, and Internet Protocol (IP) address.
• Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files.
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services.

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To fulfill and manage your orders. We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

• Consent. We may process your information if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you.
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party.

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

• Allow Users to Connect to Their Third-Party Accounts — Google account (via Google Sign-In). Apple account (via Apple Sign-In).
• Cloud Computing Services and Database — Supabase (data storage and authentication infrastructure). User account data, encrypted Moments, and emotion tags are stored on Supabase servers located in the United States. Supabase's privacy policy is available at https://supabase.com/privacy.
• User Account Registration and Authentication — Google Sign-In (Google LLC) and Apple Sign-In (Apple Inc.).
• Crash Reporting and App Stability — Firebase Crashlytics (Google LLC). When the app crashes or encounters a critical error, Crashlytics automatically collects a crash report containing: the device model and iOS version, a stack trace (code path that led to the crash), a randomly-generated Crashlytics installation identifier, your Supabase account identifier (a UUID assigned when you create an account, used to correlate crash reports with a specific account for debugging), and the time and date of the crash. Crashlytics does not collect your name, email address, reflection content, or emotion tags. Crash reports are used solely to identify and fix bugs. Firebase Crashlytics privacy information is available at https://firebase.google.com/support/privacy.
• Payment Processing — Apple Inc. (via the App Store and StoreKit). All subscription purchases and payment processing are handled entirely by Apple. We do not receive or store your payment card number, billing address, or any other payment instrument details. See Apple's privacy policy at https://www.apple.com/legal/privacy/.

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

• Log in to your account settings and update your user account.
• Use the "Erase Everything" option in the app's Settings screen to erase all your data and close your account.
• Email us at hello@salwaspace.com to request an export of your personal data. We will provide a machine-readable copy of the data we hold about you within 30 days.

Category	Examples	Collected
A. Identifiers	Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name	YES
B. Personal information as defined in the California Customer Records statute	Name, contact information, education, employment, employment history, and financial information	NO
C. Protected classification characteristics under state or federal law	Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data	NO
D. Commercial information	Transaction information, purchase history, financial details, and payment information	NO
E. Biometric information	Fingerprints and voiceprints	NO
F. Internet or other similar network activity	Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements	YES
G. Geolocation data	Device location	NO
H. Audio, electronic, sensory, or similar information	Images and audio, video or call recordings created in connection with our business activities	NO
I. Professional or employment-related information	Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us	NO
J. Education Information	Student records and directory information	NO
K. Inferences drawn from collected personal information	Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual's preferences and characteristics	NO
L. Sensitive personal Information		NO

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)