Privacy Policy

Draft for counsel review. Items marked [NEEDED: like this] need business information or a legal decision before publishing. Do not run paid traffic until this page is approved.

Who we are

CalmGlide is operated by [NEEDED: LEGAL ENTITY NAME, LLC], [NEEDED: registered address], United States (“CalmGlide”, “we”). Contact: hello@calmglide.com.

What we collect

• Quiz answers. Self-reported wellness answers (for example how often your legs feel heavy, how you sleep, your goals). We use them only to build and adapt your plan. They are not medical records and we do not use them to diagnose anything.
• Account details. Email, first name, timezone, units, goals and the settings you choose.
• Activity you log. Sessions completed, water, steps, sleep, weight, mood and your daily check-in. You can edit or delete entries at any time.
• Payment. Handled by Stripe. We receive your subscription status, the last four digits of your card and your billing email; we never see your full card number.
• Device and usage data. With your consent, product analytics (PostHog) and advertising measurement (Meta Pixel and Conversions API). Quiz answers are never sent to advertising platforms; only events such as “started quiz”, “started checkout” and purchase totals, with your email hashed.

Why we use it (legal bases where applicable)

• To provide the service you bought: your plan, player, trackers and account (contract).
• To bill you and prevent fraud (contract, legal obligation).
• To send service emails: login links, your plan, renewal and cancellation confirmations (contract).
• To send tips and offers only if you ticked the marketing box; unsubscribe any time (consent).
• To improve the product and measure our ads, only with your cookie consent (consent).

Sensitive information

Some quiz answers relate to how your body feels. We treat these as sensitive: we collect the minimum needed, store them encrypted at rest with Supabase in [NEEDED: region, e.g. US-East], restrict access to them, and never sell or share them with advertisers. [NEEDED: Counsel: confirm applicability of Washington My Health My Data Act, Nevada SB 370, Connecticut CTDPA health-data provisions, and whether HIPAA does not apply (we are not a covered entity).]

How long we keep it

• Quiz sessions that never became accounts: deleted after [NEEDED: 12 months].
• Account and activity data: for as long as you have an account, then deleted within 30 days of a deletion request.
• Billing records: [NEEDED: 7 years] as required for tax and accounting.
• Webhook and audit logs: [NEEDED: 13 months].

Your rights

You can access, correct, export or delete your data. Email hello@calmglide.com from your account email; we respond within 7 days and complete deletion within 30. Depending on where you live (for example California, Colorado, Virginia, Connecticut, Utah, Texas, Oregon, the EU/UK) you may have additional rights, including to opt out of targeted advertising, which you can do via the cookie banner or by emailing us. We do not sell personal information. [NEEDED: Counsel: confirm “share” status under CPRA given Meta Pixel use, and add a “Do Not Sell or Share” link if required.]

Processors

Vercel (hosting), Supabase (database and authentication), Stripe (payments), Resend (email), Bunny.net (video delivery), PostHog (analytics), Meta (advertising measurement, with consent). [NEEDED: Add any others before launch.]

Children

CalmGlide is for adults. We do not knowingly collect data from anyone under 18.

Changes

We will post updates here and, for material changes, email account holders.