Privacy Policy

Last updated: March 26, 2026

she affirms ("we", "our", "us") operates the she affirms mobile application (the "App"). This Privacy Policy explains how we collect, use, store, and protect your information when you use our App. We are committed to protecting your privacy and being transparent about our data practices.

1. Data Controller

The data controller responsible for your personal data is:

she affirms
Email: contact@sheaffirms.app

2. Data We Collect

We are committed to minimal data collection. she affirms does not require account creation, login, or email registration. Here is what we collect:

2.1 Pseudonymized Identifiers

  • RevenueCat User ID: A random, pseudonymized identifier generated automatically by RevenueCat for subscription management. This ID is hashed and cannot be directly linked to your identity, but is technically pseudonymous under GDPR. It is not linked to your name, email, or Apple ID.
  • PostHog Pseudonymized ID: A random identifier used for pseudonymized analytics. This ID is hashed and cannot be directly linked to your identity, but is technically pseudonymous under GDPR. It cannot be used to identify you personally.

2.2 Onboarding Responses

During onboarding, we ask you optional questions to personalize your experience. These may include:

  • Your first name
  • Your experience level with affirmations
  • Personal goals and areas of focus (e.g., self-love, confidence, stress relief)
  • Current mood
  • Preferred categories, daily time commitment, and streak goals

All onboarding responses are stored exclusively on your device and are never transmitted to our servers.

2.3 App Usage Analytics

We collect pseudonymized analytics events via PostHog to understand how the App is used and to improve the experience. These events include:

  • Screens viewed and features used
  • Affirmation views, favorites, and shares
  • Streak milestones
  • Category and theme selections
  • Paywall interactions

No personally identifiable information is included in analytics events. User identifiers are hashed using SHA-256 before transmission. IP addresses are anonymized. Session replay and touch capture are disabled.

2.4 Subscription Data

If you subscribe to Premium, Apple processes the payment entirely. We receive only the subscription status (active, expired, trial) through RevenueCat. We never receive or store your payment details, credit card information, or Apple ID credentials.

2.5 Device Information

Basic device information (device type, operating system version, app version) may be collected for debugging and compatibility purposes. IP addresses may be collected by our analytics and crash reporting services but are anonymized and not stored in identifiable form.

3. Data Stored on Your Device

The following data is stored locally on your device using AsyncStorage and is never transmitted to our servers:

  • Your name and onboarding responses
  • Preferences (language, theme, notification settings, selected categories)
  • Streak and daily progress data
  • Favorite affirmations
  • Custom affirmations you create
  • View history and recommendation data

Deleting the App from your device permanently removes all locally stored data.

4. iOS Widgets

If you use the she affirms widget on your Home Screen or Lock Screen, the current affirmation text and theme selection are shared between the App and the widget via a secure iOS App Group container on your device. This data never leaves your device.

5. How We Use Your Data

  • To provide, maintain, and improve the App
  • To personalize your affirmation experience based on your preferences
  • To manage your subscription status
  • To understand App usage patterns through pseudonymized analytics
  • To send daily reminder notifications (only if you opt in)
  • To detect and fix bugs and improve performance

The App uses an algorithmic recommendation system to suggest affirmations based on your selected categories and preferences. This processing is performed entirely on your device and does not involve profiling or automated decisions with legal effects.

6. Legal Basis for Processing

Under the GDPR, we process your data based on the following legal grounds:

  • Consent (Art. 6(1)(a)): Analytics data is only collected after you explicitly grant consent. You can withdraw consent at any time in Settings.
  • Contract performance (Art. 6(1)(b)): Subscription management through RevenueCat is necessary to provide the Premium service you purchased.
  • Legitimate interest (Art. 6(1)(f)): Crash reporting via Sentry is collected to maintain app stability and fix bugs. This processing is minimal, pseudonymized, and does not override your rights.

7. Third-Party Services

We use the following third-party services that may process limited data:

  • RevenueCat: Subscription management and payment status tracking. Receives your pseudonymized user ID and subscription status. Privacy Policy
  • PostHog: Pseudonymized event analytics. Receives pseudonymized usage events (no personally identifiable information). Data is processed on servers in the United States. Privacy Policy
  • Sentry: Crash reporting and performance diagnostics. Receives pseudonymized crash logs and device metadata (device model, OS version) to help us identify and fix bugs. No personally identifiable information is collected. Crash reporting is collected based on our legitimate interest in maintaining app stability and is not dependent on your analytics consent choice. Privacy Policy
  • Apple: Payment processing via the App Store and push notification delivery. Privacy Policy

We have entered into data processing agreements with our third-party service providers to ensure your data is handled in compliance with applicable data protection laws.

We do not sell, rent, or trade your personal data to any third party.

8. Device Permissions

The App may request the following device permissions. All permissions are optional and you can change them at any time in your device settings:

  • Notifications: To send daily affirmation reminders at your chosen time. You can enable or disable this in Settings.
  • Analytics Consent: After onboarding, we ask for your consent before collecting pseudonymized analytics. You can change this at any time in Settings. The App works normally regardless of your choice.
  • Photo Library: Only requested when you use the share feature to save an affirmation image to your gallery.

9. Push Notifications

If you enable daily reminders, we schedule local notifications on your device at the time you choose. Notification content ("Time for your affirmation") is generated locally. We do not use push notifications for marketing or promotional purposes.

10. Content Sharing

When you share an affirmation, the App generates an image containing the illustration and affirmation text. A "sheaffirms.app" watermark is included for free users (Premium users can disable it). No personal data is included in shared images.

11. Children's Privacy

The App is designed for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at contact@sheaffirms.app and we will promptly delete such data.

12. Data Retention

  • Local data: Stored on your device until you delete the App or clear app data.
  • Analytics data: Pseudonymized analytics events are retained by PostHog for up to 12 months, then automatically deleted.
  • Subscription data: Retained by RevenueCat for as long as your subscription exists, in accordance with their retention policy.

13. Data Security

All network communication uses TLS/SSL encryption. Local data is stored in your device's sandboxed app storage, protected by iOS security mechanisms. We do not store sensitive data on external servers.

14. International Data Transfers

Pseudonymized analytics data may be processed by PostHog on servers located in the United States. These transfers are conducted in compliance with applicable data protection regulations, including the EU-U.S. Data Privacy Framework where applicable.

15. Your Rights

Depending on your location, you may have the following rights under applicable privacy laws (including GDPR, LGPD, CCPA, and others):

  • Access: Request information about what data we hold about you
  • Deletion: Request deletion of your data
  • Correction: Request correction of inaccurate data
  • Portability: Request a copy of your data in a portable format
  • Opt-out: Opt out of analytics tracking using the analytics toggle in Settings or by contacting us
  • Withdraw consent: Withdraw previously given consent at any time
  • Lodge a complaint: File a complaint with your local data protection authority

Since most of your data is stored locally on your device, you can exercise many of these rights by simply deleting the App. For data held by our third-party services, contact us at contact@sheaffirms.app and we will process your request within 30 days.

16. California Privacy Rights (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. To exercise your rights, contact us at contact@sheaffirms.app.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy with a new "Last updated" date. Continued use of the App after changes constitutes acceptance of the updated policy.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

contact@sheaffirms.app