01. Who we are
HZen (“we”, “us”, or “the sanctuary”) is a private daily wellness platform designed for calm reflection, somatic breathwork, and mindful restoration. This Privacy Policy details what information we collect when you use HZen, why we collect it, how it is safeguarded, and the rights you retain over your data.
02. Information we collect
When you create an account and engage with HZen, we collect only data necessary to power your sanctuary experience:
- Account identifiers: Your email address, provided when you sign in with Google or with Apple (if you use Apple’s “Hide My Email”, we receive a private relay address instead), and a Supabase-issued internal user identifier.
- Profile attributes: First name, last name, anonymous community name (pseudonym), optional short bio, and chosen theme or color preference.
- Onboarding intentions: Your responses during onboarding regarding areas of focus, stress intensity ratings, and plan choice, used to recommend suitable daily practices.
- Daily check-ins and your care profile: Your Daily Arrival answers (how you are arriving, the part of your life asking for attention, how much you are carrying, and the support you would like), the choices you make after a practice, and your optional care profile. These are shared with your HZen care team (our healers) so they can support you. Your private journal is never shared with them.
- Community content: Reflections you post in Community Circles and your direct messages with other members. Posts and messages show your pseudonym; your real name is shown only to members who follow you and whom you follow back. Your email address is never shown.
- Social graph & safety data: Who you follow and who follows you, message requests, blocks, mutes, and safety reports filed to maintain community integrity.
- Subscription status: Your membership (trial, Premium, or Signature) associated with your user ID.
- Payment data: On the web, billing is handled by Stripe. In the mobile apps, subscriptions are purchased through the Apple App Store or Google Play and managed with RevenueCat. HZen never sees, processes, or stores your card number — only a customer or purchase identifier and the state of your subscription.
- Notifications: If you allow notifications on your phone, a device push token so we can send the reminders and community updates you choose. You can switch each kind off in Settings.
- Technical & server logs: Standard operational telemetry (IP address, user agent, timestamps) for security monitoring and abuse mitigation.
- Crash reports (mobile app): If the HZen app crashes or hits an unexpected error, it sends a crash report to Sentry so we can fix the problem. A report contains the technical details of the error, your device model, operating system and app version. It never includes your journal entries, messages, reflections, name, email address or IP address, and it is not linked to your account or used for advertising or tracking.
03. How we use your data
- To personalize your daily sanctuary practice, deliver audio sessions, and track personal completion metrics.
- To let your HZen care team support you, using your Daily Arrival answers, practice check-ins, and care profile (never your private journal).
- To send the reminders and community notifications you have switched on, and to find and fix app crashes.
- To enforce community safety guidelines, investigate user reports, and maintain an abuse-free environment.
- To process membership billing and unlock subscriber-exclusive modules.
- To communicate critical service updates or material policy changes. We do not send marketing email without separate opt-in.
04. Third-party infrastructure providers
HZen partners with industry-leading infrastructure providers. Each operates under strict confidentiality and privacy agreements:
05. What we never do
- We never sell, rent, or trade your personal information or journal entries.
- We never share Community Circle discussions or direct messages with advertising brokers.
- We never display your email address or your Google or Apple account details in Community Circles or DMs, and your real name only to members you both follow.
- We never use your photos or any image of you for facial recognition, biometric matching, or advertising.
06. Data retention & safety
We retain your personal account data for as long as your account is active. When you delete your account (see Section 7), all personal profile records, follow lists, direct messages, and private journal entries are permanently purged from our primary database.
Community posts: Posts you contributed in public Community Circles are anonymized upon account deletion; the text remains so ongoing discussion threads remain intelligible, but the author label is permanently replaced with [deleted user].
Verification photos: HZen no longer asks for a verification photo. Every photo collected before this change was permanently deleted on October 22, 2026, and none is stored today.
07. Deleting your account
You have full control over your presence in HZen. You can trigger permanent, immediate account deletion at any time, in the HZen app or on hzenai.com, at Settings → Account → Delete my account, or by following our dedicated account deletion guide. Deleting your account does not cancel a subscription bought through the App Store or Google Play; cancel it in your store settings.
If you are unable to access your account, email team@hzenai.com from the email address on your account to request manual deletion.
08. Your privacy rights (GDPR, CCPA & global)
Regardless of your physical location, HZen provides comprehensive data privacy rights:
- Access & Portability: Request a complete export of your personal data stored within HZen.
- Correction: Update or rectify inaccurate profile attributes at any time in your account settings.
- Erasure: Permanently delete your account and associated personal wellness records.
- Restriction & Objection: Opt out of non-essential processing or marketing communications.
To exercise any of these statutory rights, contact us at team@hzenai.com. We respond to all verified requests within 30 days.
09. Children’s privacy
HZen is designed for adults and adolescents aged 13 and older. We do not knowingly collect or solicit personal information from children under the age of 13. If you become aware that a child under 13 has provided personal information to HZen, please contact us immediately so we can remove the data.
10. Security standards
We employ robust administrative, technical, and physical safeguards to protect your personal information, including 256-bit TLS/HTTPS transit encryption, strict database row-level security (RLS), and tokenized OAuth session credentials. While no system is invulnerable, our security architecture ensures data isolation and defense in depth.
11. Changes to this policy
We may revise this Privacy Policy to reflect technical, operational, or legal developments. Substantive modifications will be highlighted within the app and denoted by the revised “Last updated” timestamp at the top of this document.
12. Contact us
For privacy concerns, data export requests, or questions regarding our practices, please contact our Data Protection team at: team@hzenai.com.
Review our governing terms: Terms of Use · Wellness Disclaimer · Unsubscribe from Marketing.