Privacy Policy

Introduction

At CalmSignal, we are deeply committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mental wellness applications and services.

CalmSignal is designed with privacy at its core. We believe your mental health data is deeply personal and should remain under your control.

On-Device Processing

Your data stays on your device. All stress detection analysis, including text pattern analysis and physiological data processing, happens directly on your device. We do not send your:

• Typed text or messages
• Keyboard usage patterns
• Real-time sensor data
• Location information

to our servers or any third parties for processing.

Information We Collect

1. Account Information

When you create an account, we collect:

• Email address
• Password (encrypted)
• Display name (optional)

2. Health & Wellness Data (Optional)

If you choose to sync data with our cloud dashboard, we may store:

• Aggregated stress level scores (not raw text)
• Historical trends and patterns
• Physiological metrics from wearables (heart rate, HRV)
• Intervention effectiveness data

Note: All cloud sync is optional. You can use CalmSignal entirely offline with no data leaving your device.

3. Technical Information

• Device type and operating system
• App version
• Crash reports (with your consent)

4. Analytics (Optional)

With your explicit consent, we collect anonymous usage statistics to improve the app:

• Feature usage frequency
• App performance metrics
• General usage patterns (anonymized)

How We Use Your Information

• Provide Services: Deliver personalized mental wellness insights and interventions
• Improve Our App: Analyze aggregated data to enhance our algorithms and features
• Account Management: Maintain your account and provide customer support
• Security: Detect and prevent fraud or abuse
• Communication: Send important updates about our services (you can opt out)

Data Sharing & Disclosure

We do not sell your personal information. We only share data in the following limited circumstances:

• With Your Consent: When you explicitly authorize us to share information
• Service Providers: Trusted third parties who assist in operating our services (e.g., cloud hosting), under strict confidentiality agreements
• Legal Requirements: When required by law or to protect rights and safety
• Business Transfers: In the event of a merger or acquisition (with notice to you)

Wearable Device Integration

If you connect wearable devices (Apple Watch, Wear OS, Fitbit, etc.):

• We access only the health metrics you authorize (heart rate, steps, sleep, HRV)
• Data is processed locally on your device first
• Only aggregated insights are synced to the cloud (if enabled)
• You can revoke access at any time through your device settings

Browser Extension

Our browser extension for Chrome, Firefox, and Safari:

• Analyzes text locally in your browser
• Does not transmit the content of your messages to our servers
• Only sends anonymized stress level indicators (if cloud sync is enabled)
• Does not track your browsing history
• Works on specified domains only (Gmail, Slack, WhatsApp Web, etc.)

Data Security

We implement industry-standard security measures:

• End-to-end encryption for data in transit (TLS 1.3)
• Encryption at rest for stored data (AES-256)
• Regular security audits and penetration testing
• Secure authentication with bcrypt password hashing
• Two-factor authentication (optional)

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

Your Rights & Choices

You have the following rights regarding your data:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Export: Download your data in a portable format
• Opt-Out: Disable analytics, notifications, or cloud sync
• Portability: Transfer your data to another service

To exercise these rights, contact us at privacy@calmsignal.app

Children's Privacy

CalmSignal is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

International Users

CalmSignal is operated from the United States. If you are accessing our services from outside the U.S., your information may be transferred to, stored, and processed in the U.S. or other countries. We comply with applicable data protection laws, including GDPR for EU users.

Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

• Account information: Until you delete your account
• Health data: Until you delete it or your account (or as required by law)
• Analytics data: Anonymized and aggregated after 90 days
• Backup data: Deleted within 30 days of account deletion

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new policy on this page
• Updating the "Last Updated" date
• Sending you an email notification (for material changes)
• In-app notification

Your continued use of CalmSignal after changes constitutes acceptance of the updated policy.

Data Controller and Processor

Data Controller: CalmSignal Global Services Ltd. is the data controller for personal information collected through the CalmSignal application. As the data controller, CalmSignal Global Services Ltd. determines the purposes and means of processing your personal information.

Data Processor: GRiT Technologies acts as a data processor on behalf of CalmSignal Global Services Ltd., providing development, publishing, and technical support services. GRiT Technologies processes personal information only in accordance with the instructions of CalmSignal Global Services Ltd. and this Privacy Policy.

Third-Party Publishing: CalmSignal is published on app stores (Google Play Store and Apple App Store) by GRiT Technologies on behalf of CalmSignal Global Services Ltd. This arrangement does not affect your rights or our obligations under this Privacy Policy.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

GDPR Compliance (EU Users)

If you are in the European Economic Area (EEA), you have additional rights under GDPR:

• Right to be informed about data collection and use
• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

Our lawful basis for processing your data is your consent, which you can withdraw at any time.

CCPA Compliance (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect and how we use it
• Right to delete your personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your rights