Calmivelle - CBT & Sleep — Privacy Policy

This policy explains what Calmivelle - CBT & Sleep ("Calmivelle", "the app", "we") keeps on your phone, what it can send to our server and to other companies, how long anything is kept, and how you delete it. We wrote it in plain words on purpose.

The short version

Your journal stays on your phone. Check-ins, thought records, worries, your sleep diary, two-week check-in answers, your safety plan and reminders are saved in an encrypted file on your device. They are not sent to us and they are not backed up to iCloud or Google.
Our server holds nothing about you until you turn on AI features. Nothing goes to an AI service unless you say yes, and then only the text or numbers you choose for the feature you use.
There are no ads, no tracking and no selling of information. The app does not ask to track you across other companies' apps and websites.
You can delete everything, on your phone and on our server, from Settings at any time, without a subscription.
Calmivelle is for adults aged 18 and over.

What Calmivelle is, and what it is not

Calmivelle offers CBT-informed self-help skills for everyday stress, low moods and sleep. It is not a medical device and does not diagnose, treat, cure or prevent any medical or mental health condition. It cannot replace a doctor, therapist or counsellor. If you are worried about your health, talk to a qualified professional.

AI-generated content can be wrong. It is not a person, therapist or medical advice, and it cannot call for help.
Calmivelle cannot contact anyone for you, and nobody at Calmivelle reads your entries.
If you might act on thoughts of harming yourself, or you are in danger, call your local emergency number now. The last section of this page lists some lines.

Who we are

Calmivelle is published by the developer named on its App Store and Google Play listings. We decide how the information described here is used, and we are the controller of it under laws that use that word. You can reach us through the support page. The same page is where privacy requests go.

What stays on your phone

These are saved on your device only:

check-ins (mood, stress and energy ratings, tags and notes)
thought records, worries and worry-time sessions, activities
your sleep diary and sleep plan
your two-week check-in answers and total
your safety plan
reminders, settings, lesson progress and bookmarks
AI results and Reflect conversations that you chose to keep

How they are protected:

Everything is written to one encrypted file (AES-256-GCM). The key lives in the iPhone Keychain or the Android Keystore, in secure storage on this device.
The file is left out of iCloud and Android backups. The app does not use Apple Health, Health Connect, iCloud or any cloud sync for it.
The only backup is one you make yourself: in Settings you can export a readable summary, or an encrypted backup file protected by a password you choose. Nothing is shared until you tap share and pick where it goes.
A summary for a professional is a PDF or text file that you create and share yourself.
Reminders are notifications made on your phone. Their wording is generic, for example "Time for your check-in", and they never go through a server.
Removing the app removes this data.

What we keep on our servers

The app's server exists to run the optional AI features and to check your membership for them. It never holds your journal, check-ins, diary entries, safety plan, name or e-mail address. The app does not contact it about you until you turn on AI features, or ask it to delete server data. The only way we receive an e-mail address is if you write to us through the support page, described below.

Your installation record

When you turn on AI features, the app creates a random installation ID and a key pair on your phone, and signs in to an anonymous Firebase account that has no name or e-mail. We store:

the installation ID and the public half of the key (the private half never leaves your phone)
whether the phone runs iOS or Android, and the app version
the anonymous Firebase account ID
the first and last time the installation was seen
your AI consent record: the consent version, which of the three choices you allowed, and when. We do not store the consent text.

Every request is signed with your private key and carries a check that the app is a genuine copy. That is how we tell your app from someone else's. The installation ID is shown to you in Settings > Your data as your data reference.

Membership and purchases

You buy through Apple or Google. They take the payment; we never see your card or your Apple or Google account details. To meter AI use fairly, the app sends the store's purchase proof to our server, which asks Apple or Google whether the subscription is active. We keep:

the result (active, grace period, expired or refunded) and its expiry date
the product you bought
a one-way keyed hash that identifies the purchase without revealing it
the store's purchase proof, encrypted and never written to logs

Up to three installations can use one purchase. This does not let us see who you are.

Optional AI features

AI features are off until you choose them. They are:

thought help: suggests thinking traps, questions and drafts of a balanced thought
worry sorting and a tiny next step
sleep and weekly reflections, written from numbers your diary and check-ins produce
a personal wind-down script that is read aloud by your phone's own voice
small activity ideas
a plain draft summary to bring to a professional
Reflect, a guided reflection chat. We can switch it off on our side, and it may not be available.
typing by voice, which turns a recording into text

You choose in three separate steps, and each says what will be sent, who handles it and how to withdraw:

AI help with what you write
AI help that reads several weeks of your data, shown with a preview of exactly what will be sent
sending your recording to be turned into text

You also confirm that you are 18 or older. Not now is always a fair answer: closing the screen or going back never counts as yes. You can withdraw any choice in Settings at any time and it takes effect straight away. Your membership does not depend on AI, and the rest of the app works without it.

What may be sent, only for the feature you use and only after you agreed:

text you typed or picked for that feature, such as the thought you are working on, up to eight worries in a list, or the message you are sending in Reflect
numbers and yes-or-no answers from a few weeks of diary nights or check-ins, with no free text
for the voice choice, the recording

The app first replaces e-mail addresses, phone-like numbers and web links in your text with placeholders. It cannot recognise names, which is why you see a preview.

What is never sent to any AI feature:

your two-week check-in answers, totals or trend
your safety plan, or the result of any safety check
names, phone numbers, e-mail addresses or contacts
your whole journal
your location or advertising identifiers

How it travels: your app sends the request to our server at calmivelle.site. The server checks it, adds its own instructions, passes the text on to a third-party AI service provider that runs the model, checks the reply and returns it. Our server holds your text, the reply and any recording only in memory while the request runs. It does not write them to disk or to logs. It logs a request ID, which feature was used, the outcome, timing, sizes and how many credits were used, and never the content.

The AI provider handles that text under its own terms. We do not control how long it keeps requests, and we do not promise that it deletes them or that it will not use them to improve its models. Please send only what you are comfortable sharing. You can use everything else in Calmivelle without AI.

Safety screening: before any text is sent, the app checks it on your phone for words that suggest you may be in crisis, and our server checks again before anything goes to the provider. If either matches, nothing is sent to the provider and the app shows a help card instead, with the number to call for your region. We do not keep the text that triggered it, and we keep no record that ties it to you. We keep only anonymous daily counts of how often the help card was shown. The app cannot call anyone for you.

To keep the service fair, we count how many AI requests each membership uses each day. Those counts are tied to the one-way purchase hash, not to your name. We may switch off an AI feature, or all of them, or for some regions, without an app update.

Reports you choose to send

Every AI reply has a Report this response button. If you tap it, you see exactly what will be sent and confirm first. The report holds the reply text you chose to include, the type of problem, a short note if you write one, which feature it came from and the time. We keep reports for 90 days so we can review them, and they are deleted earlier if you delete your data. They are never sent to analytics or crash tools.

Usage statistics and crash reports

The app uses Google Firebase Analytics and Crashlytics. They are on by default, and you can switch them off in Settings (Anonymous diagnostics), which takes effect straight away.

Analytics receives a short list of fixed events that say a feature was used, for example that a check-in was saved or which calming exercise was finished. Events never contain what you wrote, rated or logged.
Crashlytics receives crash reports: technical detail of the failure, the phone model, the operating system and app version, and the time. The app does not put journal text in them.
Google's software also handles ordinary technical information such as a random app-instance ID, the language, and the country or region worked out from the network address.
Advertising ID collection and ad personalization are switched off. The app carries no advertising identifier.

Anonymous sign-in and app checks

Firebase Authentication creates the anonymous account described above, and Firebase App Check asks Apple's or Google's app-verification service whether the request comes from a genuine copy of the app. These services see the technical details they need to do that. Deleting your server data also deletes the anonymous account.

Support messages

If you write to us through the support page, we receive the name you type (optional), your e-mail address, the subject and your message, delivered to us by e-mail. We use them only to answer you and to handle privacy requests, and we keep them only as long as that needs. Please do not put health details in a message; you do not need to.

The welcome and membership screens

The welcome screens and the membership screen inside the app are web pages served from our own domain, calmivelle.site, through Cloudflare. They use no cookies, no third-party scripts, fonts or trackers, and they do not record the choices you tap. Like any web server, our host and Cloudflare see technical details of each request, such as the network address, the time and the page, to deliver it and to protect it from abuse.

Who else handles information

Apple and Google run the App Store, Google Play, payments, and their app-verification services. They act under their own privacy policies.
Google Firebase provides analytics, crash reports, anonymous sign-in and app checks, as our service provider. See the Firebase privacy information.
A third-party AI service provider runs the model behind AI features. It receives data only when you use an AI feature.
Cloudflare delivers calmivelle.site and helps protect it.
A hosting provider runs our server.

We do not sell personal information. We do not share it for advertising, and we give it to no data brokers. If the law requires us to disclose something, we can only disclose what we hold, and we do not hold your journal.

How long we keep things

Your journal and everything else on your phone: until you delete it or remove the app.
Installation record, consent record and purchase link on our server: until you delete your data.
The store's purchase proof: deleted with your purchase link, or 30 days after the purchase has expired.
AI text, replies and recordings: never stored by our server.
AI request records (request ID, a one-way hash of the installation ID, feature, model, outcome, timing, sizes and credits, never content): 30 days, or until you delete your data.
Security checks that stop repeated requests from being replayed: 10 minutes.
Reports you send: 90 days.
Daily AI usage counts tied to the purchase hash: until the end of the day, or of the month for the monthly count.
Server logs: request ID, feature, status, timing and sizes, kept until the logs rotate.
Support messages: as long as needed to answer you and to keep a record of privacy requests.
Statistics and crash reports held by Google: under Firebase's own retention settings.

Your choices and rights

Choices in the app

Turn AI features off, or any one of the three choices, in Settings. It takes effect straight away.
Switch Anonymous diagnostics off in Settings.
Say no to notifications and to the microphone. The app still works.
Export your data from Settings > Your data.
Delete your data from Settings > Your data.

Delete your data

In the app, open Settings > Your data. Delete all my data removes, on your phone, the encrypted file and its key, reminders, your safety plan, consent choices and saved AI content. It then asks our server to delete your installation record, consent record, purchase link, usage records for this installation, reports you sent and the anonymous Firebase account. If your phone is offline, the app keeps trying until it is done. You do not need a subscription to do this.

If you never turned on AI features, we hold nothing about you on our server, and deleting the local data is enough.

What remains after deleting your data:

A deletion marker for 90 days: a one-way hash of the installation ID, the deleted public key, a hash of the anonymous account ID and the time of deletion. It lets a repeated deletion request work and stops the same ID being registered again.
Daily AI usage counts tied to the one-way purchase hash, until the end of the day or month. They exist so that deleting and starting again cannot reset the daily allowance.
Server logs until they rotate.
Anonymous daily counts of help cards shown, which identify no one.

Without the app: use the deletion request page and enter your data reference, the installation ID from Settings > Your data, if you still have it. It needs no login and no subscription, and a matching record is deleted within 24 hours. You can also ask through the support page and include the same reference. The app's server holds no name or e-mail address, so the reference is the only way we can find a record. A record from an installation you removed without deleting stays until it is deleted, and it holds no journal text.

Deleting your data does not cancel your subscription. See the Subscriptions section.

Rights under privacy laws

If you live in the European Economic Area or the United Kingdom, you can ask us to give you access to your information, correct it, erase it, limit its use, hand it over in a portable form, or stop using it. You can withdraw consent at any time without affecting what happened before. You can complain to your data protection authority, for example the Information Commissioner's Office in the United Kingdom, or one of the authorities listed by the European Data Protection Board. Our reasons for using information are:

to provide the app and features you asked for
your explicit consent for AI features, including text that may relate to your health and any recording
our interest in keeping the service secure, preventing abuse and keeping the app working, which includes diagnostics that you can switch off

If you live in California, Washington or another state with a privacy or consumer health data law, you can ask to know what we hold, get a copy, correct it, delete it, withdraw consent, and appeal a decision about your request. We do not sell personal information or share it for targeted advertising. We use health-related information only to give you the feature you asked for.

Consumer health data: the health-related information we can receive is the text you choose to send to an AI feature, and any recording, after you agree. We use it only to run that feature and reply to you. We share it only with the AI service provider that runs the model, for that purpose. We do not sell it.

Most of your information never reaches us, so a copy of your journal is not something we hold. Use Export in Settings to get it. To make a request, use the support page. Our records hold no names, so include the data reference if you have it.

Subscriptions

Calmivelle needs an active membership to use its features. The Support tab with its crisis lines, viewing your safety plan, export, and deleting your data stay available without one. Membership is an auto-renewing subscription bought through Apple or Google. Prices, trial terms and renewal dates are shown by the store before you buy, and the store handles billing and refunds.

To cancel on an iPhone or iPad, follow Apple's guide to cancel a subscription.
To cancel on Android, follow Google's guide to cancel, pause or change a subscription.
To get membership back on a new phone, use Restore purchases on the membership screen or in Settings.

Deleting the app or your data does not cancel a subscription. Cancel it in the store.

Children

Calmivelle is for adults aged 18 and over. The app asks whether you are 18 or older before it goes further, and if you answer no it turns off AI features and the membership screen. It is not directed to children under 13, under 16 or under 18, and we do not knowingly collect information from them. If you think a child has used AI features, tell us through the support page and we will delete what we hold.

Security

Journal data is encrypted on your phone. All traffic to our server uses HTTPS, and each request is signed and checked. Our server stores no journal or AI content. No system is perfectly secure. If a breach affects information we hold, we will tell you and the authorities as the law requires.

Where information is processed

Our providers may process information in the United States and other countries. Where the law requires it, they rely on recognised safeguards for international transfers, such as standard contractual clauses.

If you need help right now

Calmivelle cannot call anyone for you. If you are in danger, or might act on thoughts of harming yourself, call your local emergency number now. These lines were checked on 29 September 2026, and the app lists more for your region, offline, in its Support tab:

Anywhere: your local emergency number. The free directory Find a helpline lists verified lines in more than 175 countries.
United States: 911. Call or text 988. Text HOME to 741741.
Canada: 9-1-1. Call or text 9-8-8.
United Kingdom: 999. Samaritans on 116 123. Text SHOUT to 85258.
Ireland: 999 or 112. Samaritans on 116 123.
Australia: 000. Lifeline on 13 11 14.
New Zealand: 111. Call or text 1737.
India: 112. Tele-MANAS on 14416.

Changes to this policy

When how the app handles information changes, we update this page. If a change needs a new choice from you, such as new AI consent, the app asks you again. This policy took effect on 30 September 2026. Related pages: Terms of Use and About.

Calmivelle - CBT & Sleep: Privacy Policy