Privacy Policy

1. Overview

Drift is a mental wellness app designed to help users manage emotional regulation and nervous system health. This privacy policy explains what information we collect, how we use it, how we store it, and your rights regarding your data.

2. What information we collect

Information you provide

• Display name (optional, for personalisation)
• Email address (only if you sign in via Google or Apple)
• Mental health data: spiral logs (emotional triggers, intensity ratings, timestamps, optional notes)
• Journal entries (free-form text about your emotional state)
• Morning check-ins (mood selection, optional notes)
• Focus timer sessions (duration, completion status)
• 12-week programme progress (completion tracking)
• Safe people contacts (name and phone number for crisis support)
• App preferences (theme, notification settings, onboarding status)
• Dates and times attached to your entries

Information we do not collect

• Location data
• Contacts or address book
• Camera or microphone data
• Advertising identifiers
• Biometric data
• Financial information
• Health data via HealthKit or similar frameworks
• Browsing history outside the app
• App usage analytics
• Crash reports or device diagnostics

3. How we use your information

We use your data to:

• Provide the app’s core functions (logging spirals, tracking mood, timer sessions)
• Back up your data to your account so it is not lost if you change or reset your phone
• Respond to support requests and fix problems you report to us
• Send you optional reminders for morning check-ins (if you enable notifications)
• Aggregate anonymised insights (see “Community insights” below)

We do not use your data to:

• Target you with advertisements
• Build a profile for third-party marketing
• Sell your data to third parties
• Track you across other apps or websites

4. Data storage and security

On your device

• Your data is stored locally in Drift’s private app storage on your iPhone
• After you sign in, Drift’s core tools, including the crisis support screen, work without an internet connection
• Device storage is protected by your phone’s native security (Face ID, passcode)

Cloud backup

• When you are signed in, your data is automatically backed up to Supabase (a PostgreSQL database provider)
• Data is encrypted in transit (HTTPS/TLS)
• Supabase applies row-level security (RLS) policies so only you can access your data
• Supabase’s privacy practices are governed by their privacy policy: supabase.com/privacy

Data security measures

• All data is encrypted in transit
• Authentication is delegated to Google or Apple (we don’t store passwords)
• Supabase uses industry-standard encryption at rest
• Access is restricted to authenticated users only

5. Data sharing and third parties

We share data with

• Google / Apple: when you sign in via Google Sign-In or Apple Sign-In, they receive your email and authentication token per their privacy policies
• Supabase: your backed-up data is stored on Supabase’s servers (see their privacy policy)

Community insights (anonymised aggregates only)

• The app may display anonymised, aggregated statistics (for example, average recovery time across all users, or the most common triggers)
• These insights are calculated from your data but do not identify you
• No individual data is shared or visible to other users
• You cannot opt out of aggregate statistics (they are calculated server-side)

We do not share

• Your personal information with advertisers
• Your data with third-party analytics services
• Your mental health data with insurance companies, employers, or healthcare providers
• Any data with law enforcement (except as required by valid legal process)

6. Data retention and deletion

On your device

• Data stays on your phone until you delete it or uninstall the app
• Uninstalling the app removes all local data

In the cloud

• Data is retained on Supabase’s servers indefinitely (until you delete it)
• Supabase’s retention policies apply; see supabase.com/privacy

How to delete your data

• Delete from device: Settings → “Clear all my data” removes everything locally
• Delete from cloud: when you clear data, the app sends a deletion request to Supabase; if offline, deletion syncs when you reconnect
• Delete your account: Settings → “Delete account” removes your account and its cloud data
• Uninstall app: removing Drift deletes all local data; cloud data persists until cleared via Settings

Get a copy of your data

Email drift.mentalhealthapp@gmail.com from the address linked to your account and we will send you a copy of your data.

7. Children’s privacy (COPPA)

Drift is not intended for children under 13. We do not knowingly collect data from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete such data and terminate the child’s account.

8. Your privacy rights

• Access: you can view all your data within the app at any time.
• Correction: you can edit or delete any log, journal entry, or preference directly in the app.
• Deletion: you can delete individual entries or all data via Settings.
• Data portability: you can request a copy of your data by emailing us (see “Get a copy of your data” above).
• Opt-out: you can disable notifications in Settings, and you can delete your account and all associated data at any time.

9. Third-party links

This privacy policy does not apply to third-party services linked from Drift, such as Supabase or Google. Please review their privacy policies independently.

10. California privacy rights (CCPA)

If you are a California resident, you have the right to know what personal information is collected, know whether your personal information is shared or sold, delete personal information collected from you, and opt out of the sale of your personal information.

Drift does not sell personal information. To exercise your rights, contact drift.mentalhealthapp@gmail.com with “California Privacy Request” in the subject line.

11. Changes to this policy

We may update this privacy policy to reflect changes in our practices or applicable law. Changes will be posted here with an updated date. Your continued use of Drift after changes constitutes your acceptance of the new policy.

12. Contact us

For questions about this privacy policy or to exercise your privacy rights, contact:

Zareef Zaman
drift.mentalhealthapp@gmail.com