Privacy Policy for Look Within

Effective date: July 14, 2026 Last updated: October 27, 2026

Look Within ("Look Within," "we," "us," or "our") provides a mobile application designed to support users on a personal recovery journey (the "App" or "Service"). This Privacy Policy explains what information we collect, how we use and protect it, who we share it with, and the rights you have over your own data.

Please read this policy carefully. Because Look Within is designed for people navigating mental health and addiction recovery, we have written this policy to be more protective than the minimum required by law in most jurisdictions, but you should still understand exactly what you are agreeing to before you create an account.

How we handle health information, and your rights under Washington's My Health My Data Act and similar laws, is explained in our Consumer Health Data Privacy Policy.

1. Who This Policy Covers

This policy applies to anyone who downloads, installs, or uses the Look Within mobile application, regardless of where you live. We specifically call out protections for:

• Residents of Canada, whose data is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.
• Residents of the United States, including specific rights for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
• Residents of the European Economic Area, United Kingdom, or Switzerland, who are afforded rights consistent with the General Data Protection Regulation (GDPR), to the extent the App is used in those regions.

Where this policy grants a right to only one group by law, we make reasonable efforts to extend the same right to all users as a matter of practice, except where doing so is not technically feasible.

Important note on health information: Look Within is a self-directed wellness and peer-support tool. It is not a healthcare provider, is not delivered by or through a licensed healthcare provider, and is not a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA). Information you enter in the App is not medical-record data protected by HIPAA. We treat it with HIPAA-comparable care as a matter of our own policy (see Section 6), but you should not rely on HIPAA-specific legal protections when using this App.

2. Information We Collect

2.1 Information you provide directly

• Account information: email address, and, if you choose to sign in with Google, your name, email address, and profile photo as provided by Google.
• Recovery and wellness data: journal entries, daily check-ins, mood ratings, energy levels, meditation minutes, identified triggers, coping strategies, "honesty check-in" reflections, recovery goals, addiction type(s) you disclose, streak and credit history, and any free-text notes you write.
• Onboarding details: first name, age, gender (optional fields you may choose to skip).
• Emergency contacts: names, phone numbers, and relationship labels for people you choose to add as emergency/support contacts. You are responsible for obtaining that person's consent before adding their information.
• Coping toolkits you create or interact with: titles, descriptions, links, and whether you mark a toolkit as public for other users to see. If you make one public, you choose the display name shown with it.
• Support communications: anything you submit through the in-app Support form, including your email and the content of your message.

2.2 Information collected automatically

• Authentication data: securely managed by Firebase Authentication (Google), including sign-in timestamps and a unique user identifier.
• Device and technical data: app version, operating system and general device type, collected to keep the App stable and secure.
• Error reports (Firebase Crashlytics): when something goes wrong, the error message is sent to Firebase Crashlytics, linked to your account ID. Error reports never include your journal, check-ins or other content you enter.
• App integrity checks (Firebase App Check): your device confirms to Google that requests come from a genuine copy of the App (Play Integrity on Android, App Attest on iOS).
• Approximate location, only when you ask: if you tap "Find Centers Near Me" and agree, your phone's location is rounded to about 10 km on your device and sent to Google's Gemini AI to find nearby treatment centres. If you search by city instead, the city you type is sent. We do not store your location or the search results.

2.3 Subscription and payment information

If you purchase a subscription, payment is processed entirely by Google Play Billing (Android) or Apple's App Store (iOS) and, for subscription management, RevenueCat. We do not receive or store your credit card number, billing address, or other payment card details. We do receive limited transaction metadata (subscription tier, purchase date, renewal status, and a device/purchase identifier) needed to unlock paid features for your account.

2.4 Information we do not collect

We do not collect precise GPS location (the centre finder only ever sends an approximate location, as described above), contacts from your device's address book, photos, microphone, or camera data unless you explicitly choose to provide something equivalent as text (e.g., typing a contact's phone number yourself). We do not use analytics or advertising trackers, and we do not track which screens you visit.

3. How We Use Your Information

We use the information above only to:

1. Create and secure your account, and authenticate you when you sign in.
2. Provide the App's core features: tracking your streak, showing your journal/check-in history, calculating achievements, and personalizing your dashboard.
3. Process and manage subscriptions you purchase.
4. Find treatment centres near you or in a city you choose, when you ask.
5. Respond to support requests you send us.
6. Diagnose crashes, fix bugs, and maintain the security and reliability of the App.
7. Comply with legal obligations, and protect the rights, safety, and property of our users and ourselves.

We do not use your recovery, journal, or mental-health-related data for advertising, and we do not sell that data to third parties, under any circumstances.

4. Who We Share Information With

We do not sell your personal information. We share information only with:

• Google Firebase (Google LLC), our backend infrastructure provider, hosting authentication and your account/recovery data (Firestore database), app integrity checks (App Check) and error reports (Crashlytics). Google processes this data on our behalf under its own data processing terms and industry-standard security certifications.
• Google Gemini, via Firebase AI Logic (Google LLC), which finds treatment centres when you use the centre finder. It receives only your approximate location or the city you type, and the search request. We do not use your data to train AI models.
• Microsoft (Microsoft 365), which delivers and stores support requests and email you send to info@lookwithin.co. Support requests are removed from our database once they reach our inbox.
• RevenueCat, Inc., our subscription management provider, which receives purchase/transaction metadata (not your data content) to validate and manage subscriptions across app stores.
• Google Play / Apple App Store, for processing payments if you subscribe, under their own respective privacy policies.
• Public toolkit content you choose to share: if you mark a coping toolkit as "public," its title, description, items and the display name you choose become visible to other signed-in users of the App. They never see your email. Anything you mark public is, by definition, no longer private.
• Law enforcement or regulators, only where we are legally compelled to do so (e.g., a valid court order), or where we believe in good faith it is necessary to prevent imminent harm to you or others.
• A successor entity, if Look Within is ever involved in a merger, acquisition, or sale of assets, subject to that entity being bound by protections at least as strong as this policy, and with advance notice to you.

We do not share your data with data brokers, advertising networks, or analytics companies that build cross-app advertising profiles.

5. Crisis and Emergency Situations

Look Within is a self-help and peer-support tool. It is not a crisis service, and does not monitor your entries in real time for signs of risk. If you are in crisis or believe you or someone else is in danger, please contact your local emergency number (911 in Canada/US), or a crisis line such as the 988 Suicide & Crisis Lifeline (US) or Talk Suicide Canada (1-833-456-4566). Do not rely on this App for emergency support.

6. How We Protect Your Information

• All data in transit is encrypted (HTTPS/TLS).
• Your account and recovery data are stored in Google Firestore, access-controlled so that only you can read or write your own records (enforced at the database security-rules level, not just in the app's user interface).
• We follow the principle of least privilege internally: access to production data is restricted and logged.
• No method of storage or transmission is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify affected users and relevant regulators as required by applicable law (including PIPEDA breach-of-security-safeguards requirements and, where applicable, U.S. state breach notification laws), without undue delay.

7. Data Retention

We retain your account and recovery data for as long as your account remains active. Deleting your account in the App removes your data from our production systems immediately; for requests made by email, we delete it within 30 days, except where we are required to retain limited records (e.g., transaction records) for legal, tax, or fraud-prevention purposes, in which case that residual data is retained only as long as legally required and is not used for any other purpose.

8. Your Rights and Choices

Regardless of where you live, you have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data (available in-app, or by contacting us; see Section 12).
• Export your data: in the App, open the menu, tap Support, then Your health data > Download my data for a machine-readable copy (JSON) of everything.
• Withdraw consent to health-data collection at any time, in the same Your health data section, or skip optional onboarding fields like age and gender.
• Object to or restrict certain processing, where applicable under your local law.

California residents additionally have the right to know what categories of personal information are collected/sold/disclosed (see Section 4; we do not sell data), and the right to non-discrimination for exercising these rights.

EEA/UK/Swiss residents additionally have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights that is not already a button in the App, contact us using the information in Section 12. We respond to every request within 30 days.

9. Children's Privacy

Look Within is intended for users 18 years of age and older, given the nature of addiction-recovery content. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will delete that account and associated data. If you believe a minor has created an account, please contact us immediately.

10. International Data Transfers

Because our infrastructure provider (Google Firebase) operates globally, your information may be processed in countries other than your own, including the United States. Where required, we rely on standard contractual safeguards (such as Google's own compliance with GDPR Standard Contractual Clauses) to protect data transferred internationally.

11. Changes to This Policy

We may update this policy as the App evolves. If we make material changes, we will notify you via an in-app notice or email before the changes take effect, and update the "Last updated" date above. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this policy or your personal data, contact:

Ticex Labs
Privacy Officer, Ticex Labs
Email: info@lookwithin.co

The Privacy Officer, Ticex Labs, is responsible for protecting your personal information. We answer every request within 30 days.

If you are located in Canada and are not satisfied with our response, you may also contact the Office of the Privacy Commissioner of Canada. If you are located in the EEA/UK, you may contact your local supervisory authority.

This document is a working draft intended to give Look Within strong, genuine privacy protections appropriate for a mental-health-adjacent app. It has not yet been reviewed by a lawyer.