CalmPath

Privacy Policy

Last updated: July 13, 2026

CalmPath ("we", "us") is a mental-wellness app that offers an AI companion for supportive conversation, mood tracking, and private journaling. This policy explains what we collect, how we use and protect it, who we share it with, and the choices you have. By using CalmPath you agree to this policy.

CalmPath is not a medical service. It does not provide diagnosis, therapy, or treatment, is not a substitute for professional care, and is not for emergencies. We are not a HIPAA-covered entity. If you are in crisis, contact your local emergency number or a crisis line — the app also lists crisis resources.

Information we collect

CategoryExamples
AccountEmail address, display name.
Your content (encrypted)Your conversations with Calm, journal entries, and mood check-ins and notes.
Derived wellness dataSession summaries and weekly insights generated from your activity (no verbatim quotes of your content).
SubscriptionYour CalmPath Pro status and renewal state (via our payments processor).
Usage analyticsScreen views and feature interactions — never the text of your messages, journals, or mood notes.
DiagnosticsCrash reports and error diagnostics, scrubbed of personal content.
NotificationsA device push token, only if you enable reminders.
Safety recordsIf our crisis-safety filter triggers, we log a severity level and timestamp only — never the message text.

How we use it

We do not sell your personal information, and your content is never used to train AI models.

Encryption & security

Your conversations, journal entries, and mood notes are encrypted at rest. Access is protected by row-level security so your data is readable only by you (and the service components needed to operate the app). No method of transmission or storage is 100% secure, but we design for data-minimization and least privilege.

Service providers we share data with

We use a small set of processors, each for a specific purpose:

ProviderPurpose
Anthropic (Claude)Processes your chat messages to generate responses. Not used to train models.
SupabaseAuthentication, database, and hosting.
RevenueCat & Google PlaySubscription management and billing.
PostHogProduct analytics (usage events only — no content).
SentryCrash and error diagnostics (scrubbed of content).
Expo (EAS)Push notifications and app updates.
ResendTransactional email (confirmations, resets, export links).

Each provider processes data under its own privacy terms. We share only what each needs for its function.

Your rights & choices

Data retention

We keep your data until you delete it or your account. When you delete your account, your personal data is removed promptly; anonymized safety records may be retained as described above.

Children

CalmPath is intended for adults and is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect data from children.

International users

Your data may be processed in countries other than your own by us and our providers. Where required, we rely on appropriate safeguards for such transfers.

Changes to this policy

We may update this policy; we will revise the "Last updated" date above and, for material changes, notify you in the app.

Contact

Questions or requests: support@calmpath.app.