Your data is yours. Actually.

Your account (name, email, a scrypt-hashed password — we cannot read it) and your wellness record: check-ins, practices, scores, journal entries, meals, face-scan photos, biometrics, cycle logs (if enabled), experiments, orders, and settings. All of it is stored in your own per-user space on the instance. Face photos and pulse measurements are processed on your device; photos are stored only in your own media folder, and pulse camera frames never leave your phone — only the final number does.

Only what a feature you use requires — and we name each one. The Sage, the Meal Lens, the Concierge, and the weekly letter send the relevant context of your request — for the Meal Lens, the meal photo and description you submit — to our AI provider (Anthropic) to generate the answer; under their commercial terms it is not used to train their models and is retained briefly (currently up to 30 days) for abuse monitoring. Push notifications travel through your browser's push service (Apple, Google, or Mozilla); their payload is the note itself (a first name, a streak, a practice title). Email letters, if you enter an address, go through our transactional email provider. Oura, if you connect it: we hold access tokens (encrypted) and pull your daily sleep, heart-rate variability, resting heart rate, and steps until you disconnect, which revokes them. Stripe, when billing is live, handles payment details — we never see your card. Vendor links from the Concierge take you to that vendor's site under their policy. Nothing else leaves; there are no analytics or advertising SDKs.

Cheerayu collects information that is, by its nature, about your health: conditions you list, check-ins, biometrics, cycle logs, face-scan photos, and meal photos. We collect it only when you enter or enable it, on the basis of your consent given at sign-up and at each opt-in (cycle tracking, wearables, notifications), and we use it solely to run the features you use. We do not sell it, share it with advertisers, or use it for any purpose you have not chosen. You may withdraw consent by disabling a feature or deleting your account. Where consumer health-data laws apply (for example Washington's My Health My Data Act, the GDPR's special-category rules, or the CCPA), this section is our consumer health data privacy notice.

Your rights, wherever you are: access and export everything (Settings → Export), correct it (edit your Blueprint and profile at any time), delete it (Settings → Delete account — immediate, irreversible, including photos), restrict or object to processing by turning a feature off, and complain to your local data-protection authority. Requests we cannot self-serve: privacy@cheerayu.com, answered within 30 days.

Retention. Your record stays as long as your account does. Security logs: 14 days. AI provider transit copies: per their terms above. Backups on the instance: rolling 14 days. After deletion, your data is gone from the live system immediately and from backups within 14 days.

Controller. Cheerayu (cheerayu.com) is the controller of this data. Children. Cheerayu is for adults 18 and over; we do not knowingly collect information from anyone younger, and we delete it if we learn we have. International transfers. Your instance runs where it is deployed (currently a single region); AI requests are processed by Anthropic under their data-processing terms.

One cookie: your session (httpOnly, signed — it keeps you logged in). No third-party cookies. Server logs record security-relevant events (logins, failures) with IP addresses for abuse protection, rotate daily, and are deleted after 14 days. Logs never contain passwords, tokens, or your content.

Cycle tracking is opt-in, never shared with household circles, and erasable in one tap. Household circles share presence only — name, streak, practiced-today — never scores, journals, or content. The marketplace ledger contains no personal identifiers.

Export everything as one JSON file, any time, from Settings. Restore from that file. Delete your account in Settings: user record, wellness record, and media are erased and circle memberships purged — immediately, not after a review queue.

If this policy changes materially, the change will be dated here before it takes effect. Questions: privacy@cheerayu.com.