Privacy Policy

Last updated: September 2026

The Short Version

Your wellness data is personal, so this page says plainly what CalmChat keeps. When you use AI chat with a CalmChat account, your messages are sent to our server and saved in our database, together with the replies. Your messages are not only on your phone. The rest of this page explains what is saved, where, for how long, and who can read it.

What Stays on Your Device

The app keeps its own copy of your chats, journal entries, memory facts, breathing and meditation sessions, goals and settings on your iPhone using Apple SwiftData. The current app has iCloud (CloudKit) syncing switched off, so this data is not copied to iCloud, even if the iCloud Sync switch in the app's Settings is on.

What We Store on Our Server

When you create an account and chat, our database stores:

  • Your account: email address, the name you give, and your password in hashed form (we never store the password itself)
  • Your chats: every message you send in AI chat and every reply, the conversation title (the first 60 characters of your first message), the time of each message, and a flag if a message matched our crisis-safety keywords
  • Your profile and settings: any age, concerns, goals and preferred coach style you choose to share, and your chat settings
  • Usage records: how many AI tokens each request used, which AI model answered, and how long it took (not the text)
  • Subscriptions: your plan, Apple transaction IDs and expiry dates if you subscribe

The current app does not send your journal entries, HealthKit readings, sleep data, breathing or meditation sessions to our server; those stay on your device.

Where It Is Kept

Our database is a PostgreSQL database run by Neon on Amazon Web Services in the United States (us-east-1). Our website and server run on Vercel. Data travels to and from our server over encrypted HTTPS connections.

How Long We Keep It

We do not delete stored chats or account data automatically. It stays in our database until your account is deleted. “Delete All Data” in the app's Settings erases the copy on your phone only; it does not erase the copy on our server. To delete your account and everything stored with it on our server, send us a request through our contact form and include the email address on your account.

Who Can Read It

Your chats are tied to your account. The people who operate CalmChat and hold access to the database can read what is stored in it. Our admin dashboard shows account emails, names, plan and usage counts; it does not display chat text. We do not sell your data or share it with advertisers.

AI Conversations

When you send a message, the app sends it to our server, which saves it and then passes the conversation to Anthropic (Claude AI) to write the reply. In Gas Saver Mode (on by default), our server sends Anthropic only the last 4 messages of the conversation and up to 3 memory facts stored with your account. Anthropic's commercial terms say it does not train its models on data sent through its API.

If a message matches our crisis-safety keywords, the app does not send it to Anthropic. It replies straight away with crisis resources (the 988 Suicide & Crisis Lifeline and the Crisis Text Line), and both your message and that reply are saved to your conversation as above.

HealthKit Data

CalmChat can optionally read heart rate and heart rate variability data from Apple HealthKit, and write mindful minutes when you complete breathing exercises or meditations. HealthKit access requires your explicit permission and can be revoked at any time in iOS Settings. The current app keeps HealthKit data on your device and does not send it to our server.

This Website

  • Page analytics: every page loads our own analytics script, which records page views, time on page, the page you came from and link clicks, using an ID kept in your browser (no cookie). Our server works out your device type and approximate city from the request.
  • Google Analytics: loads only if you accept analytics cookies in the cookie banner.
  • Contact form: sends your name, email and message to our team by email (through Resend). It is not saved in the CalmChat database.
  • Server logs: like any website, our hosting sees your IP address when your browser or the app connects.

Third-Party Services

  • Anthropic (Claude AI): writes the AI chat replies
  • Neon: hosts our database
  • Vercel: hosts this website and our server
  • Apple: App Store, subscriptions and HealthKit
  • Google Analytics: website analytics, only with your consent
  • Resend: delivers contact form emails

Your Rights

You can at any time:

  • Export the data on your device as JSON from the app's Settings
  • Delete the data on your device (Settings > Privacy > Delete All Data)
  • Ask us, through our contact form, for a copy of what we store on our server, or to delete your account and all of it
  • Revoke HealthKit permissions in iOS Settings

Children

CalmChat is not intended for users under 13 years of age. We do not knowingly collect data from children.

Contact

Questions about privacy? Use our contact form and we will reply to you by email.