Privacy Policy

Last updated: 16 July 2026

This policy describes how The Sanctuary ("we", "the app") handles your information across the mobile app and this website. The short version: we collect what the product needs to work, analytics only with your consent, and we never sell your data.

What we collect

• Account data — your email address and sign-in identity (email/password or Google Sign-In), stored with our backend provider Supabase (EU region).
• Profile & practice data — your dosha assessment results, optional wellbeing check-ins (energy, tension, vikriti), practice history, streaks, and preferences (language, reminders). This is the data the app personalizes your practice with.
• Usage analytics (consent-gated) — if you enable "Help improve The Sanctuary" in Profile, we collect anonymous, aggregated product events (e.g. "a practice was completed") via PostHog (EU cloud). Turning it off stops collection immediately.
• Crash reports — stack traces via Firebase Crashlytics so we can fix bugs. These contain device model and OS version, not your personal content. Can be disabled in Profile.
• Payments — Sanctuary Plus subscriptions are processed by Stripe. We never see or store your card details; we store only your subscription status.
• Install attribution — on first launch the app may read the Google Play install referrer (which campaign or link led to the install). This contains no personal information.

What we don't do

• No selling or renting of personal data. Ever.
• No third-party advertising SDKs, no ad tracking.
• No collection of precise location, contacts, photos, or microphone.

Where your data lives

Account and practice data are stored with Supabase in the European Union. Analytics data (when enabled) is processed by PostHog on EU servers. Voice guidance audio is generated in advance and shipped with the app — nothing you say is recorded.

Your rights

• Access & portability — "Download my data" in Profile exports everything we hold about you as JSON.
• Deletion — "Delete my account" in Profile removes your account and all associated data permanently.
• Consent withdrawal — analytics and crash reporting toggles live in Profile and take effect immediately.
• If you are in the EU/EEA, you additionally have the rights granted by the GDPR, including complaint to a supervisory authority.

Notifications

Practice reminders are local notifications scheduled on your device. They are configured and cancelled entirely on-device; we do not run a push-notification server.

Children

The Sanctuary is not directed at children under 16, and we do not knowingly collect data from them.

Changes

We'll update this page when the policy changes and note the date above. Material changes will be announced in the app.

Contact

Questions or requests: support@thesanctuaryteam.com