Privacy Policy

Data controller

The controller responsible for your data under the GDPR is [Controller legal name], [Address], Austria. Contact: feedback@mindful-pleasure.life. Full legal details are in our Impressum.

Summary

Swellness is private by default. Your session data — breathwork history, calm ratings, program progress, and personal notes — is stored exclusively on your device using your browser's localStorage. We do not store, transmit, or have access to it.

Data we do not collect

• Session history, breathwork logs, calm ratings
• Recovery phrase or identifier (stored only on your device)
• Notes or personal reflections
• HRV or biometric data you enter

What we process, and the legal basis

• Community posts (opt-in): if you share a session to the anonymous community feed, the post content and a non-identifying identifier are stored on our servers. Legal basis: your consent (Art. 6(1)(a) GDPR), given by choosing to post. You can delete posts at any time from the Community screen.
• Premium purchase: if you buy Premium (a one-time lifetime purchase), your identifier, Stripe customer ID, and unlock status are stored to verify access. Legal basis: performance of a contract (Art. 6(1)(b)). We do not store your name, email, or address — Stripe processes payment data under its own policy.
• Analytics (web app only, consent-based): in the web app, and only after you accept the consent banner, we use privacy-first product analytics to see which features help. Umami is self-hosted (no data leaves our infrastructure); PostHog (EU region) is used only where enabled. Nothing is tracked until you accept, and you can withdraw at any time in Settings. Legal basis: your consent (Art. 6(1)(a)). The iOS app contains no third-party analytics or trackers.

Third-party services

• Stripe — payment processing (web only). Stripe Privacy Policy
• PostHog — product analytics, EU region, web only, consent-based. PostHog Privacy Policy
• Umami — self-hosted analytics, web only, consent-based. No data leaves our infrastructure.

International transfers

Stripe processes payment data in the United States under the EU Standard Contractual Clauses. PostHog is used in its EU region. Self-hosted Umami data stays on our EU infrastructure.

Data retention

On-device data persists until you clear your browser data or use "Delete all data" in Settings. Community posts are soft-deleted immediately on request. Premium purchase records are retained while your lifetime access remains valid, for access verification and billing-dispute purposes. Analytics events are retained per the processor's standard period and are not linked to your on-device identity.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing and withdraw consent at any time. Because most data lives only on your device, you can exercise access and erasure directly via Export and "Delete all data" in Settings. For server-side data (community posts, purchase records), contact us at the address above.

You also have the right to lodge a complaint with a supervisory authority — in Austria, the Datenschutzbehörde (dsb.gv.at).

Contact

For privacy-related questions: feedback@mindful-pleasure.life