Privacy Policy
The short version: the personal things you save in HealWithMe — your moods, private notes, and relationship details — stay on your device. We can't read them. There are no accounts, no ads, and no cross-app tracking. A small amount of data does leave your phone: purchase information needed to make your subscription work; pseudonymous usage statistics only if you turn them on; the adaptive-personality selections you make during onboarding, and the further answers needed if you later take an optional clarity quiz in Explore; if you use the optional Chat with Freya feature, the messages you send in that chat so an AI can write a reply; a support request or Freya safety report you choose to email us; and, if you are a subscriber and turn on reminders, coarse information used to send push notifications. If you enable usage analytics, four welcome-questionnaire answers — your focus area, age range, gender, and how you heard about the app — may be included as broad categories linked only to a random app identifier. You can erase everything at any time with Erase my data in Settings → Privacy, which wipes your device and best-effort requests deletion of the server-side data described below. Sections 4–10 explain what is processed, your choices, and the current launch hold on unverified AI retention.
1. Who we are
HealWithMe is developed by Hamza Messaoudi ("we", "us"). If you have any question about this policy or your data, contact us at support@healwithme.app.
2. Data that stays on your device
HealWithMe is designed to work without an account. The personal content you create in the app is stored only on your device and is never transmitted to us or to any server we control:
- Your other welcome-questionnaire answers and your on-device clarity profile (except the four broad categories named in section 4 and the adaptive-personality question/answer IDs described in section 5)
- Mood check-ins and reflections
- Relationship names, notes, and details
- Your journey progress and completed activities
- Your Chat with Freya conversation history (see section 6 for how individual messages are processed to generate replies)
Because this data lives only on your device, deleting the app permanently deletes it. It may also be included in your personal device backups (iCloud or computer backups), which are governed by Apple's privacy policy and are under your control. A first name you enter is also stored on your device; it is sent only when you use Chat with Freya so the reply can address you, as described in section 6. Adaptive clarity-quiz answers are processed separately as described in section 5.
3. Data processed for purchases
If you subscribe, the payment itself is handled entirely by Apple through your Apple ID. We never see your name, payment card, or billing address.
To recognize your subscription and unlock paid features, we use RevenueCat, a subscription-management service. RevenueCat processes:
| Data | Purpose |
|---|---|
| A random app user ID | Recognizing your subscription on your device — it is not linked to your name or email |
| Purchase history and receipt data | Validating your purchase and keeping your access active, including restoring purchases on a new device |
| Basic device information (model, OS version, locale, app version) | Correct subscription handling and diagnostics |
RevenueCat acts as our processor and does not sell this data. You can read their policy at revenuecat.com/privacy. RevenueCat, Inc. is based in the United States; transfers of this data are protected by standard contractual clauses.
4. Usage analytics
HealWithMe sends no usage analytics unless you choose to turn on “Share usage analytics” on the onboarding privacy screen or later in your Profile. Until you opt in, the PostHog SDK is not initialized and analytics events are ignored. You can turn sharing off or back on from Profile at any time; turning it off stops future analytics collection and does not change any free or paid app feature.
If you opt in, HealWithMe shares pseudonymous usage statistics to help us understand and improve the app. We use PostHog, an analytics service hosted in the European Union (Frankfurt, Germany). These events are not tied to your name, email, Apple ID, or advertising identifier, but a random app identifier allows events from the same installation to be counted together. What PostHog receives:
| Data | Purpose |
|---|---|
| A random identifier created on your device | Counting a returning device as one user — it is not linked to your name, email, Apple ID, or the identifier for advertisers (IDFA) |
| Which screens and features are used, and for how long | Understanding which parts of the app are useful and where people get stuck |
| Which techniques and exercises are opened, completed, or abandoned (by their catalog ID), and the star-style ratings you give them | Ranking and improving the exercise library |
| Your progress through the welcome questionnaire — which screens you saw and how long each took, together with the focus area you picked at the start (for example "relationships" or "anxiety about work"), which shapes the path you're shown | Seeing where people stop during setup on each path so the questionnaire can be shortened and improved |
| Your broad age range and gender, including "prefer not to say" if that is what you choose | Understanding which broad groups use the app and whether the experience works well across them |
| How you heard about HealWithMe — the option you pick in the welcome questionnaire (for example "TikTok", "a friend", or "the App Store") | Knowing which channels bring people to the app. Because we use no advertising identifier and do no cross-app tracking, the answer you give is the only way we can tell |
| Paywall and purchase activity — where the paywall was opened, its stage, RevenueCat offering/package/product IDs, the displayed price and currency, and whether a purchase or restoration succeeded, was cancelled, found nothing, or failed with a numeric error code | Understanding the subscription funnel, diagnosing storefront problems, and correlating app actions with pseudonymous subscription lifecycle events |
| Freya reporting activity — whether the report flow was opened and its delivery outcome. Analytics never receives the selected reason or any report or chat content | Checking that the safety-reporting route works |
| Basic app information (app version, content version, OS version, device model, language) | Diagnosing version-specific problems |
What analytics never includes: your other welcome-questionnaire answers (outside the four broad categories above), your adaptive clarity-quiz answers, which mood you logged, your name or the names of your relationships, anything you type in notes, and the content of your chats with Freya. Events record that something happened ("a mood was logged today"), never its content. PostHog acts as our processor and does not sell this data; you can read their policy at posthog.com/privacy.
5. Onboarding personalization and adaptive clarity quizzes
The adaptive-personality questions during onboarding, and any further clarity quiz you choose to take in the Explore tab, both run on the same quiz service, hosted on our own Cloudflare Workers and backed by Cloudflare D1. Because the questions are adaptive, the service needs each answer, under your random per-install app identifier, to choose the next question, calculate your result, and let an interrupted session resume. It receives and stores:
| Data | Purpose |
|---|---|
| A random per-install app identifier, a broad age bracket, gender, language, and the quiz topic you chose | Creating the quiz session and selecting questions appropriate to the chosen topic and broad demographic group. If you did not provide an age or gender, the service uses a neutral fallback value |
| Question IDs, selected option IDs, answer position, and the resulting clarity profile | Selecting each next question, calculating the result, and allowing an interrupted quiz or completed result to be reopened |
The service does not receive your name, email, Apple ID, mood history, relationship names, notes, or chat content. Onboarding and Explore-tab quiz sessions and results are stored the same way in Cloudflare D1 so they can be resumed. Unfinished or abandoned sessions are deleted automatically after 30 days of inactivity, and completed sessions after 365 days. You can request deletion sooner at any time with Erase my data in Settings → Privacy, which asks our quiz service to permanently delete that session's stored answers and results immediately. Cloudflare acts as our processor and does not sell this data. Email is a fallback for a session the in-app control can't reach — for example, one created before your device had this feature.
6. Chat with Freya (AI companion)
HealWithMe includes an optional AI companion chat, Chat with Freya. This is the one place where content you type is sent off your device — it has to be, so that an AI can generate a reply. If you never open the chat, nothing described in this section happens.
- What is sent: when you send a message, that message together with the recent messages of the same conversation (a short window, so Freya has context) is transmitted to our AI provider, Cloudflare, which runs the language model that writes the reply on its Workers AI infrastructure. If you have set a first name in the app, it is included so Freya can address you. Nothing else from the app — your moods, quiz answers, relationship notes, or other conversations — is sent.
- Retention and model use: your on-device conversation history is kept until you tap "New chat" or delete the app. We do not use chat messages to train our own models. Cloudflare's AI Gateway configuration and any provider-side logging/retention are being independently verified before launch. Until that evidence is published, do not assume that a message is retained only transiently; avoid entering sensitive information that you would not want processed by a third-party AI service.
- Not a professional service: Freya is a supportive companion, not a therapist, doctor, or crisis service. Please don't rely on it for medical, legal, or emergency advice, and avoid entering anything you would not want processed by a third-party AI service.
- Reporting a response: you can report any Freya response through your email app. The draft includes a coarse reason and basic app, device, and locale diagnostics. It never includes your messages or other chat history. The selected generated response is included only if you explicitly turn that option on after reviewing the exact report.
Cloudflare acts as our processor for this feature and does not sell this data; you can read their policy at cloudflare.com/privacypolicy. Cloudflare, Inc. is based in the United States; transfers of this data are protected by standard contractual clauses.
7. Push notifications — only for subscribers who turn them on
If you subscribe and choose to turn on reminders, we can send you push notifications (for example, a gentle nudge to check in). Delivering these uses OneSignal, a push-notification service.
- OneSignal is only ever activated after you subscribe and grant notification permission through the app's own prompt. If you are not a subscriber, or you don't turn reminders on, OneSignal is never activated and no data is sent to it.
- Reminders that mention anything personal — a person's name, your streak, today's mood — are built and scheduled entirely on your device by iOS and are never sent to OneSignal. OneSignal is used only for broad, non-personal messages.
What OneSignal receives is limited to what's needed to deliver those broad messages:
| Data | Purpose |
|---|---|
| A push subscription token and a random OneSignal device/user ID | Delivering notifications to your device. This ID is linked to your random RevenueCat purchase ID so subscription status (for example, active or lapsed) can guide which broad messages you receive — it is not linked to your name or email |
| Coarse, non-personal tags: app language, app version, whether you have added any relationship (yes/no), a rough count bucket of relationships (e.g. "1", "2-3", "4+"), and a rough check-in streak bucket (e.g. "0", "1-6", "7+") | Sending relevant broad messages to segments of users |
| Basic device information (device model, OS version) | Delivering notifications correctly |
What OneSignal never receives: person names, mood values, quiz or persona answers, notes, chat content, or anything else you type. OneSignal acts as our processor and does not sell this data; you can read their policy at onesignal.com/privacy. OneSignal, Inc. is based in the United States; transfers of this data are protected by standard contractual clauses. You can turn notifications off at any time in iOS Settings or in the app.
8. What we don't do
- No user accounts and no collection of your contacts; we receive your email address only if you choose to contact support or send a Freya safety report. A first name you set is used only on your device and in a Chat with Freya request as described in section 6
- No advertising and no advertising SDKs
- No cross-app tracking — we do not use the identifier for advertisers (IDFA)
- No sale or sharing of personal data with third parties for their own purposes
- No use of your chat messages to train AI models
- No attempt to identify you from analytics — the four broad welcome answers are linked only to a random app identifier, never your name, email, or Apple ID; your moods, relationship details, notes, and free text never enter analytics
9. Legal bases (EU/UK users)
Where the GDPR applies, we process purchase data in section 3 and the quiz or chat request you choose to make in sections 5–6 to perform our contract with you. A support request or safety report you choose to send is processed on our legitimate interest in responding and keeping the service safe. Usage analytics is processed only with your consent, which you can withdraw or grant again from Profile without losing any functionality. Push notifications and associated data are also processed based on your consent; you can withdraw it in iOS Settings or in the app.
10. Retention and deletion
Erase my data (Settings → Privacy) is the primary, self-service way to delete what's described below: it immediately wipes your on-device content, then best-effort requests deletion at our quiz service, PostHog (if you shared analytics), OneSignal (if you turned on reminders), and RevenueCat's record that recognizes your subscription on this device — without cancelling your Apple subscription, which Apple, not HealWithMe, controls. If you're offline, the on-device erase still happens immediately; a server-side request that couldn't be sent is retried the next time you open Erase my data, and any request that was already sent is automatically rechecked each time you open the app until every service confirms it's done. Email is a fallback for anything the in-app control doesn't reach, including the categories below.
- On-device content: kept until you delete it in the app, use Erase my data, or delete the app itself. It is entirely under your control.
- Chat messages: the on-device conversation history is kept until you tap "New chat", use Erase my data, or delete the app. Cloudflare AI Gateway/provider payload logging and retention are not represented as transient until their production configuration is verified and the policy is republished.
- Freya safety reports: a report you choose to email is kept only while needed to investigate and respond, then deleted from the support mailbox and trash after a content-free record of its category and resolution is made. You can ask us to delete it earlier. Erase my data does not reach this mailbox; email is the only way to request its deletion.
- Adaptive quiz sessions and results: kept in Cloudflare D1 so an interrupted quiz can be resumed and its result reopened. Unfinished or abandoned sessions are deleted automatically after 30 days of inactivity, and completed sessions after 365 days. Use Erase my data to delete your device's sessions immediately at any time before then; email is a fallback for a session the in-app control can't reach.
- Purchase records: kept while your subscription is active and for as long as needed for accounting and legal obligations. Erase my data best-effort requests deletion of the RevenueCat record that recognizes your subscription on this device; RevenueCat may retain what it needs for its own accounting and legal obligations, and your Apple subscription itself is unaffected. Email is a fallback and, for anything Erase my data doesn't cover, we will process the request within 30 days.
- Push data: the OneSignal ID and coarse tags are kept while your device is subscribed to notifications. You can turn notifications off in iOS Settings or in the app, or use Erase my data to request deletion of your OneSignal identifier immediately. Email is a fallback; we will acknowledge the request and provide the applicable completion timeline.
- Usage analytics: the PostHog project is currently configured to retain events for up to 12 months. Turning off "Share usage analytics" stops future collection but does not delete events PostHog already received. Use Erase my data to best-effort request deletion of the events tied to your device's random identifier immediately (PostHog's own processing of that request, including any session recordings, can take longer to fully complete). Email is a fallback and, for anything not covered, we will process the request within 30 days.
11. Your rights
Depending on where you live (including under the GDPR, UK GDPR, and California law), you may have rights to access, correct, delete, or receive a copy of personal data, to object to or restrict certain processing, and to lodge a complaint with a data-protection authority. Since your personal content is stored only on your device, most of it can be erased there. The fastest self-service way to exercise a deletion right across both your device and our servers is Erase my data in Settings → Privacy (see section 10 for exactly what it reaches). For a support request or Freya safety report you sent us, or for anything Erase my data doesn't cover, email support@healwithme.app. We will verify and respond to the request as required by applicable law. We do not discriminate for exercising a privacy right.
12. Children
HealWithMe is intended for users aged 16 and over and is not directed at children under 16. We ask only for a broad age range, not a birth date. If you believe someone under 16 has provided data to the app, contact us and we will delete the server-side data we can identify.
13. Changes to this policy
If we change this policy — for example, if a future version of the app adds new features that process data differently — we will update this page and the effective date above, and for material changes we will notify you in the app before they take effect.
14. Contact
Hamza Messaoudi
Email: support@healwithme.app
Support: healwithme.app/support
15. App nature and content
HealWithMe does not operate in a highly regulated industry. It provides general self-reflection and relationship guidance and does not diagnose, treat, prevent, or measure a medical or psychological condition, claim clinical credentials or regulatory clearance, or provide therapy, medical advice, or crisis care. The app does not intentionally include protected third-party material. Its code, product content, branding, screenshots, and illustrations were created by the individual seller, Hamza Messaoudi; illustrations were generated through his OpenAI account using inputs he owns. Jung-inspired material uses original wording based on general psychological ideas and does not quote or closely adapt a protected assessment or publication. Commercial platforms are used under applicable account terms, and provenance records can be provided if requested.