Privacy Policy for Look Within

Effective date: July 14, 2026 Last updated: July 14, 2026

Look Within ("Look Within," "we," "us," or "our") provides a mobile application designed to support users on a personal recovery journey (the "App" or "Service"). This Privacy Policy explains what information we collect, how we use and protect it, who we share it with, and the rights you have over your own data.

Please read this policy carefully. Because Look Within is designed for people navigating mental health and addiction recovery, we have written this policy to be more protective than the minimum required by law in most jurisdictions — but you should still understand exactly what you are agreeing to before you create an account.

1. Who This Policy Covers

This policy applies to anyone who downloads, installs, or uses the Look Within mobile application, regardless of where you live. We specifically call out protections for:

• Residents of Canada, whose data is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.
• Residents of the United States, including specific rights for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
• Residents of the European Economic Area, United Kingdom, or Switzerland, who are afforded rights consistent with the General Data Protection Regulation (GDPR), to the extent the App is used in those regions.

Where this policy grants a right to only one group by law, we make reasonable efforts to extend the same right to all users as a matter of practice, except where doing so is not technically feasible.

Important note on health information: Look Within is a self-directed wellness and peer-support tool. It is not a healthcare provider, is not delivered by or through a licensed healthcare provider, and is not a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA). Information you enter in the App is not medical-record data protected by HIPAA. We treat it with HIPAA-comparable care as a matter of our own policy (see Section 6), but you should not rely on HIPAA-specific legal protections when using this App.

2. Information We Collect

2.1 Information you provide directly

• Account information: email address, and — if you choose to sign in with Google — your name, email address, and profile photo as provided by Google.
• Recovery and wellness data: journal entries, daily check-ins, mood ratings, energy levels, meditation minutes, identified triggers, coping strategies, "honesty check-in" reflections, recovery goals, addiction type(s) you disclose, streak and credit history, and any free-text notes you write.
• Onboarding details: first name, age, gender (optional fields you may choose to skip).
• Emergency contacts: names, phone numbers, and relationship labels for people you choose to add as emergency/support contacts. You are responsible for obtaining that person's consent before adding their information.
• Coping toolkits you create or interact with: titles, descriptions, links, and whether you mark a toolkit as public for other users to see.
• Support communications: anything you submit through the in-app Support form, including your email and the content of your message.

2.2 Information collected automatically

• Authentication data: securely managed by Firebase Authentication (Google), including sign-in timestamps and a unique user identifier.
• Device and technical data: app version, operating system, general device type, and crash/error diagnostics, collected to keep the App stable and secure.
• Usage data: which screens you visit and general in-app activity, used only to understand feature usage and improve the App — not sold or used for advertising.

2.3 Subscription and payment information

If you purchase a subscription, payment is processed entirely by Google Play Billing (Android) or Apple's App Store (iOS) and, for subscription management, RevenueCat. We do not receive or store your credit card number, billing address, or other payment card details. We do receive limited transaction metadata (subscription tier, purchase date, renewal status, and a device/purchase identifier) needed to unlock paid features for your account.

2.4 Information we do not collect

We do not intentionally collect precise GPS location, contacts from your device's address book, photos, microphone, or camera data unless you explicitly choose to provide something equivalent as text (e.g., typing a contact's phone number yourself).

3. How We Use Your Information

We use the information above only to:

1. Create and secure your account, and authenticate you when you sign in.
2. Provide the App's core features — tracking your streak, showing your journal/check-in history, calculating achievements, and personalizing your dashboard.
3. Process and manage subscriptions you purchase.
4. Respond to support requests you send us.
5. Diagnose crashes, fix bugs, and maintain the security and reliability of the App.
6. Understand aggregate, non-identifying usage patterns to improve features.
7. Comply with legal obligations, and protect the rights, safety, and property of our users and ourselves.

We do not use your recovery, journal, or mental-health-related data for advertising, and we do not sell that data to third parties, under any circumstances.

4. Who We Share Information With

We do not sell your personal information. We share information only with:

• Google Firebase (Google LLC) — our backend infrastructure provider, hosting authentication and your account/recovery data (Firestore database). Google processes this data on our behalf under its own data processing terms and industry-standard security certifications.
• RevenueCat, Inc. — our subscription management provider, which receives purchase/transaction metadata (not your data content) to validate and manage subscriptions across app stores.
• Google Play / Apple App Store — for processing payments if you subscribe, under their own respective privacy policies.
• Public toolkit content you choose to share: if you mark a coping toolkit as "public," its title, description, and content become visible to other users of the App. Anything you mark public is, by definition, no longer private.
• Law enforcement or regulators, only where we are legally compelled to do so (e.g., a valid court order), or where we believe in good faith it is necessary to prevent imminent harm to you or others.
• A successor entity, if Look Within is ever involved in a merger, acquisition, or sale of assets — subject to that entity being bound by protections at least as strong as this policy, and with advance notice to you.

We do not share your data with data brokers, advertising networks, or analytics companies that build cross-app advertising profiles.

5. Crisis and Emergency Situations

Look Within is a self-help and peer-support tool. It is not a crisis service, and does not monitor your entries in real time for signs of risk. If you are in crisis or believe you or someone else is in danger, please contact your local emergency number (911 in Canada/US), or a crisis line such as the 988 Suicide & Crisis Lifeline (US) or Talk Suicide Canada (1-833-456-4566). Do not rely on this App for emergency support.

6. How We Protect Your Information

• All data in transit is encrypted (HTTPS/TLS).
• Your account and recovery data are stored in Google Firestore, access-controlled so that only you can read or write your own records (enforced at the database security-rules level, not just in the app's user interface).
• We follow the principle of least privilege internally — access to production data is restricted and logged.
• No method of storage or transmission is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify affected users and relevant regulators as required by applicable law (including PIPEDA breach-of-security-safeguards requirements and, where applicable, U.S. state breach notification laws), without undue delay.

7. Data Retention

We retain your account and recovery data for as long as your account remains active. If you delete your account (Section 8), we will delete your personal data from our production systems within 30 days, except where we are required to retain limited records (e.g., transaction records) for legal, tax, or fraud-prevention purposes, in which case that residual data is retained only as long as legally required and is not used for any other purpose.

8. Your Rights and Choices

Regardless of where you live, you have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data (available in-app, or by contacting us — see Section 12).
• Export your data in a portable format upon request.
• Withdraw consent for optional data collection (e.g., skip onboarding fields like age/gender) at any time, without losing access to core features.
• Object to or restrict certain processing, where applicable under your local law.

California residents additionally have the right to know what categories of personal information are collected/sold/disclosed (see Section 4 — we do not sell data), and the right to non-discrimination for exercising these rights.

EEA/UK/Swiss residents additionally have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us using the information in Section 12. We will respond within the time required by applicable law (generally 30 days).

9. Children's Privacy

Look Within is intended for users 18 years of age and older, given the nature of addiction-recovery content. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will delete that account and associated data. If you believe a minor has created an account, please contact us immediately.

10. International Data Transfers

Because our infrastructure provider (Google Firebase) operates globally, your information may be processed in countries other than your own, including the United States. Where required, we rely on standard contractual safeguards (such as Google's own compliance with GDPR Standard Contractual Clauses) to protect data transferred internationally.

11. Changes to This Policy

We may update this policy as the App evolves. If we make material changes, we will notify you via an in-app notice or email before the changes take effect, and update the "Last updated" date above. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this policy or your personal data, contact:

Brendan Tallett, Look Within Email: brendantallett@gmail.com

If you are located in Canada and are not satisfied with our response, you may also contact the Office of the Privacy Commissioner of Canada. If you are located in the EEA/UK, you may contact your local supervisory authority.

This document is a working draft intended to give Look Within strong, genuine privacy protections appropriate for a mental-health-adjacent app. It has not yet been reviewed by a lawyer.