Privacy Policy — Allow

Last Updated: June 10, 2026

---

1. Introduction

Welcome to Allow ("the App"). Your privacy is important to us. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application.

Allow is built to keep your personal practice private. The affirmations you choose, the answers you give during onboarding, the recordings you make, and your reflections are stored only on your device. They are not sent to us or to any third party for content generation.

By using Allow, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

2. Information We Collect

2.1 Information You Provide (stored on your device only)

When you use Allow, you may provide the following information directly within the App. All of it is stored locally on your device and is not transmitted to us:

• Onboarding answers — your selected goal area, focus, sub-goal, the response you select about how a goal feels to you, the direction you want to practice toward, and any free-text goal you write
• Your name — if you choose to provide one
• Mood / check-ins — how you feel before or after a session, if you choose to record it
• Chosen affirmations — the affirmations you select for your path
• Custom affirmations — affirmations you write yourself
• Voice recordings — audio recordings of affirmations you choose to record in your own voice
• Preferences — wake-up/reminder time, language, session settings, and similar choices

2.2 Information Collected for Analytics and Operations

To understand how the App is used and to operate subscriptions, the following limited information is collected through third-party services (see Section 5):

• Usage events — anonymous events such as which onboarding step or screen was viewed, whether a session was started or completed, and which subscription plan was selected. These events do not include the text of your answers, your affirmations, your recordings, or any other content you create.
• Subscription and purchase data — managed by the app store and our subscription provider
• Install attribution — used to measure the effectiveness of our marketing
• Device identifiers — basic identifiers used by analytics, subscription, and attribution services

2.3 Information We Do NOT Collect

• We do not require you to create an account
• We do not collect your email address or contact information
• We do not track your location
• We do not transmit your onboarding answers, affirmations, reflections, or voice recordings to us or to any content-generation service
• We do not sell, share, or rent your personal data to third parties for marketing purposes

3. How Your Data Is Stored

Your personal practice data stays on your device. Allow stores your onboarding answers, chosen and custom affirmations, mood data, reflections, preferences, and voice recordings locally on your device. We do not maintain a server-side database of this data.

• Text data is stored on-device using local storage.
• Voice recordings are stored as audio files in the App's local storage on your device. They are not uploaded to us or to any third party.
• Device backups: Because your data and recordings live in the App's storage area, they may be included in your device's own cloud backups (iCloud on iOS, Google Drive / Android backup on Android) if you have those enabled. These backups are controlled by you and governed by Apple's and Google's privacy policies. We do not have access to your backups.

4. How We Use Your Information

We use the information described above to:

• Provide the App's core features — your onboarding answers are used on your device to build your path and select affirmations from our built-in, handcrafted affirmation library. This processing happens locally; your answers are not sent anywhere.
• Deliver reminders — your chosen reminder time is used to schedule local notifications.
• Improve the App — anonymous usage events help us understand how the App is used and where to improve it.
• Operate subscriptions and marketing — purchase and attribution data are used to manage your subscription and measure marketing effectiveness.

5. Third-Party Services

Allow uses the following third-party services. None of them receive your onboarding answers, affirmations, reflections, or voice recordings.

5.1 Analytics (Firebase Analytics — Google)

We use Firebase Analytics to collect anonymous usage events (e.g., screens viewed, sessions started/completed, plan selected). These events contain generic identifiers and outcomes only — no text you enter and no recordings. Firebase may collect a Firebase installation identifier and basic device information. Google's privacy policy is available at policies.google.com/privacy.

5.2 Subscription Management (RevenueCat)

We use RevenueCat to manage in-app subscriptions and purchases. RevenueCat may collect device identifiers and purchase/transaction data as described in their privacy policy at revenuecat.com/privacy.

5.3 Marketing Attribution (TikTok)

We use the TikTok Business SDK to measure the effectiveness of our advertising (for example, whether an app install or subscription resulted from a TikTok ad). This is initialized only after you grant tracking permission where required (e.g., via Apple's App Tracking Transparency prompt on iOS). It collects install/attribution and purchase-event data, not the content you create in the App. TikTok's privacy policy is available at tiktok.com/legal/privacy-policy.

5.4 Anonymous Counter (Firebase Firestore — Google)

We maintain a single global, anonymous counter of total lifetime purchases. No user data is written to this counter — it is an aggregate number only.

5.5 App Store Platforms

The App is distributed through the Apple App Store and Google Play Store, each of which has its own privacy practices:

• Apple: apple.com/privacy
• Google: policies.google.com/privacy

6. Data Security

We take reasonable measures to protect your information:

• Your personal practice data and recordings remain on your device and are not stored on our servers.
• Data transmitted to our analytics, subscription, and attribution providers is sent over encrypted connections.

However, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

7. Children's Privacy

Allow is not directed to children under the age of 13 (or under the age of 16 in certain jurisdictions). We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@alignaffirm.com so we can take appropriate action.

In compliance with Brazil's Federal Law No. 15.211/2025 (Digital Statute of the Child and Adolescent), we implement age-appropriate safeguards in our digital products.

8. Legal Basis for Processing (LGPD — Brazil)

Under Brazil's Lei Geral de Proteção de Dados (LGPD — Law No. 13.709/2018), we process personal data based on the following legal grounds:

• Consent (Art. 7, I) — You provide consent when you choose to enter information into the App. You may withdraw consent at any time by deleting the App or clearing its data.
• Performance of contract (Art. 7, V) — Limited purchase data is processed to deliver the subscription service you purchased.
• Legitimate interest (Art. 7, IX) — Anonymous usage analytics and marketing-attribution data are processed to operate and improve the App. This processing does not override your fundamental rights.

Sensitive Data Notice

Some of the information you may enter — such as how you feel about a goal, your mood, or reflections — could be considered sensitive personal data under LGPD (Art. 11). This data is stored only on your device and is never transmitted to us or to any third party. It is used solely on your device to personalize your path and affirmation selection.

9. Your Rights Under Applicable Law

For All Users

• Delete your data — Your personal practice data and recordings are stored locally. You can delete all of it at any time by uninstalling the App or clearing the App's data in your device settings.
• Manage notifications — Disable notifications at any time in your device settings.
• Manage subscriptions — Manage or cancel your subscription through the App Store (iOS) or Google Play (Android).
• Manage backups — Manage or delete cloud backups through your iCloud or Google account settings.
• Limit tracking — You can decline or revoke tracking permission (used for marketing attribution) in your device settings.

For Users in Brazil (LGPD Rights — Art. 18)

As a data subject under LGPD, you have the right to confirmation and access, correction, anonymization/blocking/deletion, data portability, deletion of data processed with consent, information about sharing, withdrawal of consent, and to file a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd. Because your practice data is stored only on your device, you can exercise access, correction, and deletion directly within the App and your device settings. To exercise other rights, contact us at support@alignaffirm.com. We will respond within 15 days as required by LGPD.

For Users in the European Economic Area (GDPR Rights)

If you are located in the EEA, you have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. You may also lodge a complaint with your local data protection supervisory authority. To exercise these rights, contact us at support@alignaffirm.com.

For Users in California, USA (CCPA/CPRA Rights)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to delete your personal information; to opt out of sale (we do not sell personal information); and to non-discrimination for exercising your rights. We do not sell personal information and do not use or share it for cross-context behavioral advertising.

10. Data Retention

• On-device data and recordings — Retained on your device until you uninstall the App or clear its data. We do not control retention of on-device data.
• Analytics data — Anonymous usage events are retained by our analytics provider according to its standard retention policies.
• Subscription/attribution data — Retained by our subscription and attribution providers per their policies.
• Cloud backups — Retained according to your iCloud or Google account settings. We have no access to or control over these backups.

11. International Data Transfers

Allow is available globally. The limited data sent to our analytics, subscription, and attribution providers (see Section 5) may be processed on servers located in the United States or other countries. Your onboarding answers, affirmations, reflections, and voice recordings are not transmitted internationally — they remain on your device.

For users in Brazil, any international transfers of the limited operational data comply with LGPD Art. 33. For users in the EEA, such transfers are conducted in compliance with GDPR Chapter V, relying on adequacy decisions or standard contractual clauses where applicable.

12. No AI Content Generation

Allow does not use artificial intelligence to generate your affirmations, and does not send your information to any AI service. All affirmations come from a built-in, handcrafted library, and your path is generated on your device from the answers you provide. Affirmations you write yourself are saved exactly as you enter them.

13. Google Play Data Safety Alignment

For Google Play users, the following summarizes our data practices:

• Data collected: Device identifiers and anonymous app-usage events (for analytics, subscriptions, and attribution).
• Data stored only on device (not collected by us): onboarding answers, affirmations, reflections, mood, and voice recordings.
• Data shared with third parties: device identifiers and purchase/attribution data with our analytics, subscription, and attribution providers. No user-created content is shared.
• Data encryption: Data in transit is encrypted.
• Data deletion: Users can delete all on-device data by uninstalling the App.
• No data sold to third parties.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date at the top of this page and, where appropriate, through an in-app notification. Your continued use of the App after changes constitutes acceptance of the updated policy.

15. Data Protection Contact

For any questions, concerns, or requests related to this Privacy Policy or your data rights, please contact us:

Email: support@alignaffirm.com

Response times:

• LGPD requests (Brazil): within 15 days
• GDPR requests (EEA): within 30 days
• All other requests: within 30 days

If you believe your data protection rights have been violated, you may lodge a complaint with:

• Brazil: Autoridade Nacional de Proteção de Dados (ANPD) — gov.br/anpd
• EEA: Your local data protection supervisory authority
• USA: Federal Trade Commission (FTC) — ftc.gov