Privacy Policy

Who we are

InnerMy is made by MB „Sylvia labs“, a company registered in Lithuania (company code 307285042, VAT LT100018725314), with its registered office at J. Savickio g. 4-7, LT-01108 Vilnius, Lithuania. We are the data controller for the personal data described in this policy. You can reach us at support@innermy.com.

The short version

InnerMy is currently being prepared for private testing. Available sign-in and purchase features can differ between test builds.

Data we collect

Account information

When you create an account we store your email address and a securely hashed password, or the identifier provided by the sign-in service you chose (such as Apple or Google). We use this to log you in, keep your progress, and contact you about your account.

Your activity in the app

• The goals you select and the answers you give in the recommendation questionnaire.
• Which programs and sessions you open, how much of each session you listened to, and your listening time and completed sessions.
• Settings such as reminders and language.

We store this so the app can recommend programs, resume sessions where you stopped, and show your progress on any device you log in from.

Health-related information

Some questionnaire answers and goals can reveal information about your health or lifestyle, for example a habit you want to change. These are sensitive data. Their purpose is to personalise program recommendations and, when saved to your signed-in account, make those preferences available across your devices through Firebase.

This processing requires your separate, explicit consent. Answering a questionnaire, accepting general terms or continuing to use the app does not by itself constitute that consent. During private testing, do not enter real health-related information unless your build has first presented a separate consent choice. The in-app consent and withdrawal controls are currently being completed and verified.

You can withdraw consent or request removal of stored questionnaire answers by emailing support@innermy.com; you do not have to delete your entire account to make this request. Withdrawal does not affect the lawfulness of earlier processing. These answers are not used for advertising, sold, or sent to analytics providers as event content.

Purchases

Where purchasing is available, Apple App Store or Google Play processes the payment. We do not receive your card number. RevenueCat helps us identify the selected product, validate purchase information and manage subscription access. This involves an app user identifier, purchase or transaction identifiers, subscription status and dates, and technical app, device and platform information. Subscription information can be linked to your InnerMy account so access follows the correct account. RevenueCat is not used to receive questionnaire answers or private journal or chat text.

Store and subscription integration is still being tested. This policy does not mean that live purchases are available in every build.

Optional analytics and technical data

Google Analytics for Firebase (GA4) is optional. Collection is off by default until you choose to allow it. You can refuse or later turn it off through the app's Privacy choices without losing access to the core app.

• Usage events: generic screen views, onboarding steps, session starts and completions, listening-duration ranges and generic error categories.
• Technical information: app version, platform, device and operating-system information, app-instance identifiers and session information collected by the analytics SDK. Google may derive approximate geographic information from an IP address; this is not GPS or precise location access.
• Identifiers: analytics data is pseudonymous, not necessarily anonymous. An app-instance identifier can distinguish an installation without including your name.

Our analytics events do not include your name, email, raw account UID, questionnaire answers, journal entries, Inny messages, programme titles, audio URLs or secrets. Advertising storage, advertising personalisation and advertising user-data features are disabled. We do not use session replay or cross-app advertising tracking.

Firebase Crashlytics and Firebase Performance Monitoring are not active in the current configuration. The app includes AppsFlyer (AppsFlyer Ltd.). If you turn on optional usage statistics, the app sends AppsFlyer four generic conversion events: onboarding completed, registration completed (sign-in method), offer viewed (placement), and checkout started (plan name). These events do not include your name, email, user ID, questionnaire answers, journal or Inny messages, or purchase amounts. The AppsFlyer SDK may process technical device and installation identifiers. The app disables IDFA/GAID collection and Apple Search Ads attribution. While usage statistics are off, the app does not submit these conversion events.

Support messages

If you email us, we keep the conversation for as long as needed to help you and delete it within 90 days of the last message.

What we do not collect

We do not request precise location, contacts, photos, microphone or camera data for the features described here, or import records from health-record services. Optional analytics can include approximate geographic information as described above. Questionnaire answers may themselves reveal health information. We do not use advertising identifiers or show third-party ads.

Why we are allowed to use your data

Under the General Data Protection Regulation (GDPR), we rely on performance of our contract with you to operate your account and requested services; consent for optional analytics; separate explicit consent for health-related personalisation; our legitimate interest in protecting the service against abuse and handling support; and legal obligations for records we are required to retain. Refusing optional analytics is not treated as refusing the service. Where consent is required, it can be withdrawn.

Who we share data with

• Firebase / Google provides authentication and storage for account and progress data. Google Analytics for Firebase processes optional analytics when allowed. See Firebase privacy information and the applicable Firebase Data Processing Terms.
• RevenueCat provides the subscription-management functions described above. See RevenueCat's privacy information.
• AppsFlyer (AppsFlyer Ltd.) processes optional conversion events after you enable usage statistics and may process technical device and installation identifiers, as described above.
• Apple and Google handle app distribution, available sign-in services and store payments under their own privacy policies.
• Website hosting and email providers process website requests and messages you send to support.

Some providers process data outside the European Economic Area, including in the United States. Transfers require an applicable GDPR transfer mechanism, such as an adequacy decision or standard contractual clauses. You can contact us for details about the safeguards applicable to your data. A provider's own privacy policy applies where it acts as an independent controller.

We do not sell personal data or share it with advertisers. We may disclose data where required by law or necessary to protect users or the service. If ownership of the service changes, we will provide any notice required before personal data is used for a materially different purpose.

Emails and notifications

We send emails about your account when needed, for example to confirm a purchase or a deletion request. We send news or offers only if you opt in, and every such email has an unsubscribe link. Push notifications are sent only if you allow them, and you can turn them off in your phone's settings at any time.

How long we keep data

Account and activity data are kept while your account exists. When you delete your account, they are removed from our systems within 30 days, except records we must keep for legal reasons (such as purchase records) and anonymous statistics that cannot identify you. Google Analytics is configured to retain event-level data for 2 months and user-level data for 14 months. The user-level retention period restarts when new activity is recorded. These settings do not determine the retention of most standard aggregated reports. Turning analytics off stops future optional collection but does not by itself erase data already processed. You can contact us with an access or deletion request. Crashlytics is not active in the current configuration.

Your rights

You have the right to access, correct, delete, or restrict the processing of your personal data, to receive it in a portable format, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting earlier processing. Most of this you can do yourself in the app: edit your profile, or delete your account under Settings → My account. For anything else, email support@innermy.com and we will respond within 30 days. You can also complain to your data protection authority; in Lithuania that is the State Data Protection Inspectorate (VDAI).

Residents of California and other US states with privacy laws have similar rights, including the right to know what is collected and the right to delete it. We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act.

Deleting your account

See Delete your account for step-by-step instructions.

Children

InnerMy is not directed at children. You must be at least 16 years old, or the age of digital consent in your country if higher, to create an account. If you believe a child has given us personal data, contact us and we will delete it.

Security

Data is sent over encrypted connections (TLS) and stored by Firebase with encryption at rest, with access limited to the people who need it to operate the service. Passwords are handled by Firebase Authentication and are never stored in plain text. No system is perfectly secure, so please use a strong, unique password.

This website

The InnerMy website does not use cookies, analytics scripts, tracking pixels, or third-party fonts or scripts; nothing on it is loaded from another domain. Our hosting provider keeps standard server logs (IP address, browser type, pages requested) for security purposes for up to 30 days.

Changes to this policy

If we change this policy in a meaningful way we will update the date at the top and, for significant changes, show a notice in the app. A policy update or continued use does not grant consent for new optional processing. Where a change needs your consent, we will ask separately before that processing begins.

Contact

MB „Sylvia labs“
J. Savickio g. 4-7, LT-01108 Vilnius, Lithuania
support@innermy.com