Privacy Policy

The data controller responsible for your personal data is: Kevin Pugliese Quebec, Canada Email: contact@attraya.app As the data controller, we determine the purposes and means of processing your personal data in accordance with applicable privacy laws.

Welcome to Attraya ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our spiritual wellness and manifestation ritual app. By using Attraya, you consent to the data practices described in this policy.

We collect the following categories of information: • Account Information: Email address and name when you create an account via Apple Sign-In or Google Sign-In. • Onboarding Data: First name, gender, age range, manifestation goals and categories, personal obstacles, consistency patterns, and belief level — collected during the onboarding process to personalize your experience. • User Content: Your affirmations, daily rituals, manifestation data, feedback messages, and testimonials you create or submit within the app. • Preferences: App settings, language preferences, notification preferences, timezone (auto-detected from your device), and theme choices. • Device Information: Device type, operating system, unique device identifiers, push notification tokens (Firebase Cloud Messaging), and app version. • Advertising & Attribution Identifiers: Your Identifier for Advertisers (IDFA) if you grant tracking permission via Apple's App Tracking Transparency prompt, and your Identifier for Vendors (IDFV). We also collect a Tenjin Analytics Installation ID through the Tenjin SDK, which we link to your account user ID to attribute app installs, in-app session activity, and subscription events to specific advertising campaigns. • Usage Data: How you interact with the app, features used, session duration, and crash reports. • Payment Information: Subscription status and transaction history (payment details are processed securely through Apple's in-app purchase system, not stored by us).

We use your data for the following purposes: • Service Delivery: To provide and personalize your Attraya experience, including ritual tracking, affirmation amplification, and progress monitoring. • Communications: To send ritual reminders, notifications, and important service updates. • Sync & Backup: To sync your data across devices and maintain your account. • Improvement: To analyze usage patterns, fix bugs, and develop new features. • Advertising & Campaign Measurement: To measure ad performance and attribute app installs, session activity, and subscription purchases to advertising campaigns through Tenjin, our mobile measurement partner (MMP). Tenjin receives device identifiers, your account user ID, session and app-interaction data, and subscription/purchase events (forwarded through our subscription provider RevenueCat), and may forward attribution data to advertising networks we work with such as Meta (Facebook), Google Ads, or TikTok Ads for return-on-ad-spend and lifetime-value measurement. • Legal Compliance: To comply with applicable laws and protect our legal rights.

We do NOT sell your personal data. We may share data with: • Service Providers: Third-party providers for cloud hosting, analytics, authentication, push notifications, and payment processing. These providers are contractually bound to protect your data. • Advertising Partners: We share certain data with Tenjin, our mobile measurement partner (MMP), through their SDK and through our subscription provider (RevenueCat). The data shared includes: device identifiers (IDFA if granted via Apple's App Tracking Transparency prompt, and IDFV); a Tenjin Analytics Installation ID linked to your account user ID; session activity and in-app interaction data auto-collected by the Tenjin SDK; and subscription and purchase events (forwarded via RevenueCat) for return-on-ad-spend and lifetime-value measurement. Tenjin uses this data to attribute app installs and in-app conversions to advertising campaigns and may forward attribution data to advertising networks we work with (such as Meta, Google Ads, or TikTok Ads). We do not embed any ad network SDK directly in the app. For more information about how Tenjin uses your data, visit Tenjin's Privacy Policy at https://www.tenjin.com/privacy. • Legal Requirements: When required by law, court order, or to protect our rights and safety. • With Your Consent: Third parties you explicitly authorize. Your affirmations and rituals remain private and are never shared publicly.

We use the following third-party service providers to operate and improve Attraya. Each provider processes your data only as necessary to deliver their services: • Supabase (database, authentication, cloud hosting) — Privacy Policy: https://supabase.com/privacy • PostHog (analytics, session replay, error tracking) — Privacy Policy: https://posthog.com/privacy • RevenueCat (subscription management) — Privacy Policy: https://www.revenuecat.com/privacy • Firebase Cloud Messaging by Google (push notifications) — Privacy Policy: https://firebase.google.com/support/privacy • Apple (Sign-In with Apple, in-app purchases, payment processing) — Privacy Policy: https://www.apple.com/legal/privacy • Google (Google Sign-In) — Privacy Policy: https://policies.google.com/privacy • Tenjin (mobile measurement partner for ad attribution and campaign analytics) — Privacy Policy: https://www.tenjin.com/privacy All payments are processed through Apple's in-app purchase system. We do not directly store your payment card details. These providers are contractually bound to protect your data.

If you choose to submit a testimonial or success story through the app, you grant us a perpetual, worldwide, royalty-free, non-exclusive license to use, reproduce, modify, publish, and display your testimonial for: • Marketing and promotional purposes on our website, app, and social media • Social proof within the app to inspire other users • Future community features within the app • Advertising and publicity materials • Case studies and press releases Testimonials may be displayed with your chosen display name (anonymous, first name only, or display name) as selected at submission. We may edit testimonials for length, clarity, or formatting while preserving their meaning. You may request removal of your testimonial at any time by: using the testimonial management feature in the app settings, or contacting us at contact@attraya.app. Upon receiving your request, we will remove your testimonial from our active displays within 30 days. Note that previously distributed materials or cached versions may take longer to update. By submitting a testimonial, you represent that it reflects your genuine experience and does not contain false, misleading, or defamatory content.

You can delete your account at any time directly from the app using either of these methods: • Settings > Delete Account (available to all users) • From the subscription screen when dismissing the paywall (available to users without an active subscription) When you delete your account, the following data will be permanently removed within 30 days: • Your profile information (name, email, gender, preferences) • All affirmations and their repetition history • All rituals and daily progress data • Onboarding data and personalization answers • Testimonials you submitted • Feedback messages • Push notification tokens IMPORTANT — SUBSCRIPTIONS: Deleting your account does NOT automatically cancel your Apple subscription. You must cancel your subscription separately through your device's Settings > Apple ID > Subscriptions before deleting your account, otherwise Apple will continue to bill you. Data we may retain after deletion: • Anonymized usage analytics (cannot be linked back to you) • Records required by law for accounting, tax, or legal compliance purposes • Transaction history as required by Apple's payment processing You will receive confirmation once your account deletion is complete. If you have questions about the deletion process, contact us at contact@attraya.app.

We retain your data for as long as your account is active or as needed to provide services. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal, accounting, or security purposes. Anonymized usage data may be retained for analytics purposes.

We implement industry-standard security measures including: encryption of data in transit (TLS/SSL) and at rest; secure authentication via OAuth providers; regular security assessments; and access controls limiting who can access your data. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

As a mobile application, Attraya does NOT use browser cookies. However, we use the following technologies to improve our service: • ANALYTICS: We use PostHog, a privacy-focused analytics platform, to understand how users interact with the app. This includes tracking app usage patterns, feature engagement, and user flows to improve the user experience. • SESSION REPLAY: PostHog may record anonymized session replays to help us identify usability issues and bugs. These recordings capture app interactions but do not record sensitive data like passwords or payment information. • ERROR TRACKING: We automatically collect crash reports and error logs to identify and fix technical issues. This data includes device information, app state, and error details. • DEVICE IDENTIFIERS: We collect device identifiers for analytics, push notification delivery, and fraud prevention. • PUSH NOTIFICATION TOKENS: We store Firebase Cloud Messaging (FCM) tokens to deliver push notifications you have opted into. • ADVERTISING SDK: We use the Tenjin SDK, a mobile measurement partner (MMP), to attribute app installs and in-app conversions to advertising campaigns and measure campaign performance. The Tenjin SDK collects device identifiers, a Tenjin Analytics Installation ID linked to your account user ID, session activity, and in-app interaction data. It also receives subscription and purchase events forwarded through our subscription provider (RevenueCat) for return-on-ad-spend and lifetime-value measurement. The SDK respects your App Tracking Transparency (ATT) choice — if you deny tracking permission, the SDK does not access your IDFA. Tenjin may forward attribution data to advertising networks we work with (such as Meta, Google Ads, or TikTok Ads). No ad network SDK is embedded directly in the app. You can limit analytics collection by adjusting your device settings or contacting us to opt out. You can opt out of interest-based advertising by adjusting your device settings (go to Settings > Privacy & Security > Tracking). Note that some data collection is necessary for the app to function properly.

Attraya is a mobile application and does not respond to web browser "Do Not Track" (DNT) signals, as these signals are designed for web browsers and are not applicable to mobile apps. For mobile devices, you can limit tracking by: • Adjusting your device's privacy settings • Disabling personalized advertising in your device settings • Contacting us to request opt-out from analytics Note that opting out of analytics does not affect the core functionality of the app.

Depending on your location, you may have the following rights: • Access: Request a copy of your personal data. • Correction: Request correction of inaccurate data. • Deletion: Request deletion of your account and data. • Portability: Request your data in a portable format. • Opt-Out: Opt out of marketing communications. • Withdraw Consent: Withdraw consent for data processing. To exercise these rights, contact us at contact@attraya.app, use the Send Feedback feature in the app, or delete your account through Settings.

If you are in the European Economic Area or United Kingdom, you have additional rights under GDPR including: the right to lodge a complaint with a supervisory authority; the right to object to processing based on legitimate interests; and the right to restrict processing in certain circumstances. Our legal basis for processing is: consent (for optional features), contract performance (to provide the service), and legitimate interests (for analytics and improvement).

If you are a California resident, you have the right to: know what personal information we collect and how it is used; request deletion of your personal information; opt out of the sale or sharing of personal information; and not be discriminated against for exercising your rights. IMPORTANT — ADVERTISING DATA SHARING: Our use of the Tenjin SDK (mobile measurement partner) may constitute "sharing" of personal information for cross-context behavioral advertising under the CCPA/CPRA. The categories of information shared include device identifiers and app install data. Tenjin may forward this data to advertising networks we work with. You can opt out of this sharing by denying tracking permission when prompted or contacting us at contact@attraya.app. To make a CCPA request, contact us through the app or at contact@attraya.app. We will respond within 45 days.

If you are a Canadian resident, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, Quebec's Law 25 (Act respecting the protection of personal information in the private sector). You have the right to: • Access your personal information held by us • Request correction of inaccurate information • Withdraw consent for the collection, use, or disclosure of your information • File a complaint with the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec We process your data based on your consent and our legitimate business interests. You may withdraw consent at any time by contacting us or deleting your account. To exercise your rights, contact us at contact@attraya.app.

We process your personal data based on the following legal grounds: • Consent: For optional features such as push notifications, testimonials, and marketing communications. You may withdraw consent at any time. • Contract Performance: To provide the Attraya service, manage your account, process subscriptions, and deliver the features you signed up for. • Legitimate Interests: For analytics, app improvement, security monitoring, and fraud prevention, balanced against your privacy rights. • Consent (Advertising): On iOS, we request your explicit consent via Apple's App Tracking Transparency prompt before sharing device identifiers with Tenjin, our mobile measurement partner, for ad attribution. You may deny or revoke this consent at any time through your device settings.

Attraya is not intended for children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately and we will delete the information.

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this privacy policy and applicable laws.

We may update this privacy policy periodically. We will notify you of material changes through the app or by updating the "Last updated" date. Your continued use after changes constitutes acceptance. We recommend reviewing this policy regularly.

If you have questions about this privacy policy or wish to exercise your rights, please contact us at contact@attraya.app or through the Send Feedback feature in the app.