Privacy Policy

1. What we collect

• Account data: your name, email address and hashed password.
• Diary data: what you log in each connected Pal — pain check-ins and activities (PainPal), mood and stress (BrainPal), sleep, weight, measurements and energy (HealthPal), including times and any notes you add.
• Budget data (CashPal): the names and amounts of planned income and expenses and the balances you enter yourself. CashPal never connects to your bank and we never ask for bank details.
• Subscription data: which Pals you have connected, trial dates and your plan.
• Usage & device data: log files, IP address, browser and device information, and timestamps, used to keep the Service secure and working.
• Cookies: essential cookies needed to keep you signed in and remember your preferences, and optional analytics cookies only where you have consented.

2. Why we process it

We process personal data in accordance with the EU General Data Protection Regulation (GDPR). We rely on the following legal bases:

• Performance of a contract — to provide the Service to you and manage your account.
• Legitimate interests — to keep the Service secure, prevent abuse and improve the product.
• Consent — for non-essential analytics cookies, where applicable. You may withdraw consent at any time.

3. Rule-based features (no AI)

None of the Pals use artificial intelligence at this time. All tips, patterns and insights in the app are calculated with simple rules on your own device from your own logs. If we ever introduce an AI feature, we will explain it here before it goes live.

4. Sharing and sub-processors

We share personal data only with service providers acting on our instructions: our cloud hosting and database provider, our email provider, and error-monitoring tools. We do not sell personal data, and we do not share your diary with third parties for their own purposes.

5. Data location and international transfers

Your account and diary data are stored in the European Union. Where personal data is ever transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

6. Retention

We keep your data for as long as your account is active. When you delete your account, your profile and diary entries are permanently removed from our active systems. Backups are rotated on a defined schedule.

7. Your rights

You have the right to access, rectify, erase, restrict or port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. You can download your data yourself from the My Account page, and you can delete your account there too. You may also lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

8. Security

We use industry-standard measures to protect personal data, including encryption in transit and at rest, row-level access controls so only you can read your diary, and optional two-factor authentication. No system is perfectly secure; if a personal data breach affects your data, we will notify you and the relevant authorities as required by law.

9. Children

The Service is not directed to individuals under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in advance by email or through the Service. The date at the top of this page indicates when the policy was last revised.

11. Contact

For privacy questions or to exercise your rights, contact us at compliance@onepal.com.