HZen · HerZen · HisZen

Privacy Policy

Last updated: June 15, 2026

1. Who we are

HZen ("we", "us", "the app") is a mental-wellness and community application. This Privacy Policy explains what information we collect when you use HZen on the web, why we collect it, and the choices you have.

2. Information we collect

We collect the following data when you create and use an HZen account:

• Account identifiers: Your email address (from Google Sign-In) and a Supabase-issued user ID.
• Profile data you provide: First name, last name, anonymous community name (pseudonym), short bio, color-palette preference.
• Onboarding answers: Your responses to the onboarding flow - what you hope to focus on, what has hurt, intensity rating, plan choice. These shape the in-app recommendations.
• Community content: Messages you post in Community Circles and direct messages you exchange with other users. Both are tagged with your anonymous community name only - never your real name or email.
• Social graph: Friend connections and friend requests (anonymous-name keyed), the list of users you have blocked, and reports you have filed against other users.
• Subscription state: Free / Premium / Signature plan flag stored against your user ID.
• Payment data: If you subscribe, payment details are collected and stored by Stripe. HZen never sees or stores your card number - we only receive a subscription status and a Stripe customer ID.
• Device + technical data: Standard server logs (IP address, user agent, timestamps) used for security, abuse prevention, and basic operational analytics.

3. How we use it

• To provide and personalize the service (saved progress, content recommendations, community visibility).
• To enforce community guidelines (process reports, apply blocks, prevent abuse).
• To process subscription payments and grant access to gated content tiers.
• To contact you about service issues or material changes to this policy. We do not send marketing email without separate opt-in.

4. Third-party services

HZen relies on the following providers, each of which has its own privacy policy:

• Google Sign-In - authentication (policy)
• Supabase - auth, database, user profiles (policy)
• Stripe - subscription billing (policy)
• Render - backend hosting (policy)
• Netlify - web frontend hosting (policy)
• Google Gemini - optional member-requested monthly journal reflections, only after explicit per-request consent (policy)

Optional AI monthly reflections

Premium and Signature members may choose to request a private monthly reflection. We send only the month’s journal text that you explicitly approve at the time of the request, together with limited in-app trend data, to our AI processing provider to create that reflection. We do not use journal text for this feature without that request and consent. We retain the generated reflection and a technical fingerprint used to know when it is out of date; we do not retain a duplicate of the journal text or the provider prompt for this feature. The reflection is private to you and is not visible to healers or administrators. It is not therapy, a diagnosis, crisis support, or medical advice.

5. What we do not do

• We do not sell your personal information.
• We do not share community posts or direct messages with advertisers.
• We do not expose your real name, email, or Google account inside Community Circles or DMs - those use your anonymous community name only.

6. Data retention

We retain your account data for as long as your account exists. When you delete your account (see next section), we wipe your friends, blocks, direct messages, leaderboard entry, and pending reports from our store. Circle messages you posted are anonymized - the text remains so that conversation threads stay readable, but your name is replaced with "[deleted user]".

7. Deleting your account

You can delete your account from inside the app at any time: Profile → Delete account. Deletion is immediate and irreversible. You can also email us at the address below to request deletion if you are unable to access the app. Full steps, what is deleted or kept, and store-subscription notes are on our Delete your HZen account page.

8. Your rights

Depending on where you live (GDPR / CCPA / similar), you may have the right to access, correct, port, or delete your personal information, and to object to certain processing. To exercise these rights, contact us at the address below. We will respond within a reasonable time (typically within 30 days).

9. Children's privacy

HZen is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, please contact us and we will delete it.

10. Security

We use industry-standard transport encryption (HTTPS/TLS) and rely on Supabase's managed authentication for session handling. No system is perfectly secure; if we ever become aware of a breach involving your data, we will notify affected users in accordance with applicable law.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated in-app and via the "Last updated" date above.

12. Contact

Questions or requests about this policy: app@hzenai.com