Privacy Policy

We collect the following, depending on how you use Astelos:

• Account information: your name, email address, and a securely hashed password. If your coach invites you, we associate your account with that coach.
• Profile and preferences: profile photo (optional), time zone, notification preferences, coaching tone, and cadence.
• Behavioral data you create: goals, actions, weekly check-ins, reflections, friction tags, and the scores and labels we compute from them.
• Calendar data: if you grant calendar access, we read and write events to sync your plan. We only access this with your permission.
• Photos: if you set a profile picture, we access the image you choose.
• Device and push tokens: a push notification token so we can send reminders and alerts you have enabled.
• Payment information: if you subscribe, payments are processed by Stripe. We do not store your full card details.
• Usage and diagnostics: app interactions, performance, and error data to keep the service reliable.

Biometrics: if you enable Face ID or fingerprint unlock, that authentication is handled by your device's operating system. We never receive or store your biometric data.

• Provide the core product: goal setting, execution tracking, and scoring.
• Compute your Score and behavioral state labels, and surface recovery prompts.
• Send reminders, check-in nudges, and alerts you have enabled.
• If you have a coach, share your relevant progress data with that coach.
• Process subscriptions and prevent fraud.
• Maintain security, debug issues, and improve the product.

We do not sell your personal information. We share it only as follows:

• Your coach: if you are linked to a coach, that coach can see your goals, check-ins, scores, and progress in order to coach you.
• Service providers that operate the product under contract: Stripe (payments), Google Firebase (push notifications), PostHog (product analytics), Sentry (error monitoring), Resend (email), Neon (database hosting), and Vercel (application hosting).
• Legal and safety: when required by law or to protect rights, safety, and the integrity of the service.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

We keep your information while your account is active. When you delete your account, we delete or anonymize your personal data within 30 days, except where we must retain limited records for legal, accounting, or security reasons.

• Access and export: you can request or export your data from Settings.
• Delete your account: you can permanently delete your account and associated data directly in the app under Settings, or by emailing us.
• Permissions: you can revoke calendar, photo, notification, and biometric permissions at any time in your device settings.
• Depending on where you live, you may have additional rights to access, correct, or restrict processing of your data. Contact us to exercise them.

We protect your data with encryption in transit, hashed passwords, access controls, and reputable infrastructure providers. No system is perfectly secure, but we work to keep your information safe.

Astelos is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has provided us information, contact us and we will delete it.

We operate in the United States. If you use Astelos from outside the U.S., you understand your information will be processed in the U.S. under this policy.

We may update this policy. We will revise the date above and, for material changes, provide notice in the app or by email.

Questions about this policy or your data? Email privacy@astelos.io.