Breathtaking - Privacy Policy

The Short Version

We collect minimal data to run Breathtaking. We never sell your data or use it for ads. You can delete everything anytime. Your journal entries are private.

1. What We Collect

Information You Provide:

• Email address and name (if you create an account)
• Age confirmation (18+ requirement)
• Personality test responses
• Weekly wellness ratings (5 levers: stress/anxiety, emotional balance, energy, focus, purpose)
• Journal entries

Information Collected Automatically:

• App usage data (practices completed, timestamps)
• Device type and operating system
• IP address (for U.S. geographic restriction)
• Analytics data via Mixpanel (see Mixpanel's privacy policy at mixpanel.com/legal/privacy-policy)

We DON'T Collect:

• Health app integrations
• Contacts
• Biometric data
• Browsing data from other sites

2. How We Use Your Information

To Provide the Service:

• Match practices to your personality type
• Track your wellness progress
• Send practice reminders (if enabled)
• Provide customer support

To Improve Breathtaking:

• Analyze usage patterns to improve our algorithm
• Understand which practices work best
• Fix bugs and improve performance

We NEVER:

• Sell or rent your data
• Share with advertisers or data brokers
• Use for behavioral advertising
• Share your journal entries with anyone
• Use your data for purposes unrelated to Breathtaking

3. Who We Share With

Only These Service Providers:

Firebase (Google Cloud):

Hosts our service as a data processor. All data is stored on U.S.-based servers only—your data does not leave the United States.

Mixpanel:

Provides product analytics. See Mixpanel's privacy policy at mixpanel.com/legal/privacy-policy.

Each provider only receives the minimum data necessary to perform their service and is contractually bound to protect your data.

4. Your Rights

You Can Always:

• Access your data anytime in the app
• Export your journal entries (email support@tarexventures.com)
• Delete your entire account and all associated data in Settings
• Opt-out of marketing emails and push notifications
• Correct any inaccurate information
• Withdraw consent for data processing by deleting your account (WA/NV/CT residents—see Section 8)

5. Data Security

• Encryption in transit (TLS) and at rest (AES-256)
• Secure Firebase infrastructure (SOC 2 compliant)
• U.S.-based servers only—data does not leave the United States
• Hashed password storage (never plain text)
• Regular security updates and monitoring

Breach Notification:

If a data breach occurs, we will notify affected users without unreasonable delay and no later than the earliest deadline required by applicable law, including but not limited to: California Civil Code §1798.82 (within 72 hours of determination for certain breaches), Colorado (30 days), New York (reasonable time without unreasonable delay), Washington (30 days), and where applicable, the FTC Health Breach Notification Rule (16 C.F.R. Part 318). We will also notify regulators and, if required, the media.

6. Data Retention

Active accounts:

Data retained while you use Breathtaking

Deleted accounts:

Personal data removed within 7 days, backups purged within 30 days

Inactive accounts:

Automatically deleted after 24 months of inactivity (with 30-day notice)

Analytics data:

Usage data linked to your account is retained while your account is active and deleted when you delete your account. Aggregated, non-identifiable statistics may be retained indefinitely.

7. Children's Privacy

Breathtaking is strictly for users 18 and older. We do not knowingly collect data from anyone under 18. If we discover we have collected information from a minor, we will delete it immediately. If you believe a child has provided us data, please contact legal@tarexventures.com.

8. State-Specific Privacy Rights

California Residents (CCPA/CPRA):

• Right to know what personal information we collect and how it's used
• Right to delete your personal information
• Right to opt-out of sale/sharing (we don't sell or share for advertising)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate information

Washington, Nevada, Connecticut Residents (Consumer Health Data):

Your wellness ratings, practice data, and exercise completion analytics may be considered "consumer health data" under state law. You have additional rights:

• We obtain separate, informed opt-in consent before collecting health data during onboarding—this includes analytics tracked via Mixpanel
• If you do not consent, you may not use the Service
• You may withdraw consent at any time by deleting your account in Settings, which will delete your consumer health data
• We never sell consumer health data
• We do not use geofencing around healthcare facilities
• You have the right to delete all health data

To exercise any rights, email legal@tarexventures.com.

9. Cookies and Tracking

Mobile App:

Does not use cookies

Website:

Uses essential session cookies and basic analytics only

Mixpanel:

Used for product analytics. Configured without advertising features or cross-app tracking.

We do NOT use tracking pixels, fingerprinting, or behavioral advertising.

10. Changes to This Policy

We'll notify you by email of any material changes to this Privacy Policy. The "Last Updated" date shows when changes were made. Continuing to use Breathtaking after changes take effect means you accept the updated policy.

11. International Users

Breathtaking is available only in the United States. All data is processed and stored on U.S.-based servers. Data does not leave the United States. If you're outside the United States, please do not use our service.

12. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict-of-laws rules. For dispute resolution, see our Terms of Service.