01. Who we are
HZen (“we”, “us”, or “the sanctuary”) is a private daily wellness platform designed for calm reflection, somatic breathwork, and mindful restoration. This Privacy Policy details what information we collect when you use HZen, why we collect it, how it is safeguarded, and the rights you retain over your data.
02. Information we collect
When you create an account and engage with HZen, we collect only data necessary to power your sanctuary experience:
- Account identifiers: Your email address (provided securely via Google Sign-In) and a Supabase-issued internal user identifier.
- Profile attributes: First name, last name, anonymous community name (pseudonym), optional short bio, and chosen theme or color preference.
- Verification photo (optional): If you choose to verify your account, a live selfie taken in-app to confirm human identity and reduce spam. This photo is stored in an encrypted administrative bucket and is permanently deleted upon account removal (see Section 6).
- Onboarding intentions: Your responses during onboarding regarding areas of focus, stress intensity ratings, and plan choice, used solely to recommend suitable daily practices.
- Community content: Reflections you post in Community Circles and direct messages between confirmed friends. Posts and messages are displayed with your pseudonym only — never your real name or email.
- Social graph & safety data: Friend connections, pending requests, user blocks, and safety reports filed to maintain community integrity.
- Subscription status: Tier flag (Free, Premium, or Signature) associated with your user ID.
- Payment data: Billed securely via Stripe. HZen never sees, processes, or stores your credit card number — only a Stripe customer ID and tokenized transaction state.
- Technical & server logs: Standard operational telemetry (IP address, user agent, timestamps) for security monitoring and abuse mitigation.
03. How we use your data
- To personalize your daily sanctuary practice, deliver audio sessions, and track personal completion metrics.
- To enforce community safety guidelines, investigate user reports, and maintain an abuse-free environment.
- To process membership billing and unlock subscriber-exclusive modules.
- To communicate critical service updates or material policy changes. We do not send marketing email without separate opt-in.
04. Third-party infrastructure providers
HZen partners with industry-leading infrastructure providers. Each operates under strict confidentiality and privacy agreements:
05. What we never do
- We never sell, rent, or trade your personal information or journal entries.
- We never share Community Circle discussions or direct messages with advertising brokers.
- We never display your real name, email address, or Google account details in Community Circles or DMs.
- We never sell or distribute verification photos. They are never used for commercial facial recognition, biometric matching, or advertising.
06. Data retention & safety
We retain your personal account data for as long as your account is active. When you delete your account (see Section 7), all personal profile records, friends lists, direct messages, verification photos, and private journal entries are permanently purged from our primary database.
Community posts: Posts you contributed in public Community Circles are anonymized upon account deletion; the text remains so ongoing discussion threads remain intelligible, but the author label is permanently replaced with [deleted user].
Face verification photos: Verification photos are housed in an isolated, encrypted storage bucket accessible only by authorized compliance administrators for verification audits. When an account is deleted, the verification photo is permanently erased.
07. Deleting your account
You have full control over your presence in HZen. You can trigger permanent, immediate account deletion at any time in the app at Profile → Delete account, or by visiting our dedicated account deletion guide.
If you are unable to access your account, email team@hzenai.com from your registered Google address to request manual deletion.
08. Your privacy rights (GDPR, CCPA & global)
Regardless of your physical location, HZen provides comprehensive data privacy rights:
- Access & Portability: Request a complete export of your personal data stored within HZen.
- Correction: Update or rectify inaccurate profile attributes at any time in your account settings.
- Erasure: Permanently delete your account and associated personal wellness records.
- Restriction & Objection: Opt out of non-essential processing or marketing communications.
To exercise any of these statutory rights, contact us at team@hzenai.com. We respond to all verified requests within 30 days.
09. Children’s privacy
HZen is designed for adults and adolescents aged 13 and older. We do not knowingly collect or solicit personal information from children under the age of 13. If you become aware that a child under 13 has provided personal information to HZen, please contact us immediately so we can remove the data.
10. Security standards
We employ robust administrative, technical, and physical safeguards to protect your personal information, including 256-bit TLS/HTTPS transit encryption, strict database row-level security (RLS), and tokenized OAuth session credentials. While no system is invulnerable, our security architecture ensures data isolation and defense in depth.
11. Changes to this policy
We may revise this Privacy Policy to reflect technical, operational, or legal developments. Substantive modifications will be highlighted within the app and denoted by the revised “Last updated” timestamp at the top of this document.
12. Contact us
For privacy concerns, data export requests, or questions regarding our practices, please contact our Data Protection team at: team@hzenai.com.
Review our governing terms: Terms of Use · Wellness Disclaimer · Unsubscribe from Marketing.