BuddhaUR — Privacy Policy

1) What we collect

Your account

If you sign up with email: your email address and a hashed password. If you use Sign in with Apple or Sign in with Google: the account identifier Apple or Google gives us, and the email address they share. We also keep timestamps, such as when the account was created.

What you write and say

Your questions and messages, the teacher's replies, your onboarding answers, quiz and reflection answers, and meditation notes. If you use voice input, the app records a short clip and sends it to our server, which sends it to OpenAI to turn into text. Our server deletes its copy of the audio once it is transcribed.

Memories

Short notes the app keeps from your conversations, such as a preference or an interest, so later answers fit you. They are picked out by fixed rules, not by an AI model. Memories saved from conversations are also sent to OpenAI to make an embedding (a numeric form) so they can be searched, except ones marked as sensitive. You can see and delete your memories in Settings.

Practice and learning

Meditation sessions (start, length and optional notes), lessons, quizzes and scores, Daily Dhamma talks, streaks, and your time zone.

Support payments

Whether you support BuddhaUR, which plan, where you bought it, and when it renews or ends. Our code never asks for or stores your card number: Apple or Google takes it for a payment made in the iPhone or Android app, and RevenueCat's checkout takes it for a payment made in the web app.

How you found us

If you arrive from a link with campaign tags (or, on Android, from a Play Store referral), we save those tags with your account once, to learn which channels bring people to BuddhaUR.

Device and technical data

App version, platform, device model, operating system and language, request data in our server logs (including your IP address), and error reports. Our analytics tool assigns its own device ID; on phones it can also read the identifier your phone gives to apps from the same maker (the iOS vendor ID or Android app set ID). We don't ask for your advertising ID, and we don't read your location, contacts or photos.

Before you have an account

If you type a question before signing up, on the website or in the app, we send it to OpenAI to write a teaching for you.

On the website

We use Amplitude to record page views, clicks and some choices, such as the answer you pick in a challenge quiz or the question you open in the FAQ, along with your IP address and a device ID stored in a cookie. A challenge quiz answer is also kept in your browser, so the page remembers it.

Teachings you share

You can share a teaching by link. The link's page shows the teaching, not your question, and it expires after 180 days. You can also publish a question and its teaching to our public collection of teachings. Before it is published, we use OpenAI to rewrite your question to remove names, places and employers, and you can edit it; the teaching's text is not rewritten. Published teachings have no set expiry; write to us to have one taken down.

2) How we use it

• To give you teachings, answers, lessons and practice, and to fit them to you.
• To take and manage support payments.
• To send email: a welcome, practice emails, and account emails such as password resets. Every optional email has an unsubscribe link.
• To keep the service secure, limit abuse (for example with rate limits), and fix problems.
• To understand how BuddhaUR is used. Our analytics use a device ID and, once you sign in, your account ID. They are not anonymous.
• To answer you when you write to us.

3) Who we share it with

These providers receive data from us or from the apps:

• OpenAI: what it needs to write answers, teachings, Daily Dhamma talks, learning paths, quiz feedback and share cards: your messages and the relevant context, such as memories, goals and practice history. Also voice clips to transcribe, questions asked before sign-up, questions you publish (to remove names), and memory text for embeddings. OpenAI keeps API data under its own policies.
• MongoDB Atlas: our database, where your account and records are stored, along with IP addresses used for rate limits.
• Render: hosts our server, the website and the computer version, and so handles every request sent to them. Its logs include IP addresses, account IDs and, for Contact Support messages, your email address.
• Cloudflare: carries traffic to our server.
• RevenueCat: your account ID, purchase records, and the device and platform details its software collects, and ordinary request data such as your IP address, to manage support plans on every platform. On iPhone it also receives Apple's ad-attribution token, which tells us whether an install came from an Apple Search Ads ad.
• Apple and Google: payments made in the iPhone or Android app go through Apple's App Store or Google Play, which hold your payment details. If you sign in with Apple or Google, they handle that sign-in. In the web app, their sign-in buttons load from their servers, which lets them see the visit.
• Stripe: takes card payments made in the web app, through RevenueCat Web Billing. It also takes one-time gifts started from our website, which are completed on a Stripe-hosted checkout page. For a gift, Stripe receives what you enter there (such as your card details, name and email) and a tag saying where on our website you started. We do not send Stripe your BuddhaUR account ID.
• Amplitude: product analytics: what you do in the apps and on the website (for example lessons, quiz scores, meditation lengths, plan and campaign details), with device details, linked to your device and, once you sign in, your account. Our server also sends Amplitude email and purchase events.
• Sentry: error reports from the apps and our server: stack traces, the app's recent steps, device and platform details, sampled performance data, and your account ID.
• SendGrid: sends our email. It receives your address and the email itself, which can include your question and part of a teaching. Messages you send with Contact Support also go through SendGrid, with your rating, platform, app version, email address and account ID. SendGrid tells us about deliveries, opens, clicked links, bounces (with the reason), spam reports and unsubscribes.
• Expo: delivers app updates to phones, and sees your IP address, platform, the app's update version and an install ID when it does.
• Cloudinary: serves our story and reel videos and images, and sees your IP address and browser details like any web server.
• Google Fonts: the website loads its font from Google, which sees your IP address and browser details.
• Skylark Creations: our own usage log records, for each AI request, your account ID, the model used, the part of the app that asked, the amount of text processed, timing, the result and any error message. It does not record what you wrote.
• SuttaCentral: receives nothing unless you open one of its links.

Your data may be processed in the United States and other countries where these providers operate. We may also disclose data when the law requires it.

4) No selling, no ads

We do not sell or rent personal data or share it with data brokers. BuddhaUR shows no ads, and we don't use your data to target ads to you in other companies' apps or websites.

5) Cookies and browser storage

The website uses an Amplitude cookie for analytics and keeps your visit's campaign tags in session storage. The computer version keeps your sign-in, settings, onboarding answers and first-visit source in your browser's local storage. Signing out removes your sign-in token.

6) How long we keep it, and deleting it

While you have an account: we keep your account and records, except that the least recently updated memories are removed when there are too many, and link shares expire after 180 days. You can delete memories one at a time or all at once in Settings. Other records, such as conversations and meditation sessions, are removed when you delete your account.

Deleting your account: in the app, go to Settings → Danger zone → Delete Account. This removes your account and its private records from our database straight away. Teachings you shared or published stay online, no longer linked to your account: link shares until they expire, published teachings until you ask us to take them down. Deleting your account does not ask our providers to delete what they already received; they keep it under their own retention rules, and our database backups may hold a copy until they age out. We may keep records the law requires, such as payment records.

Rate limits: IP addresses used to limit abuse are kept for about two hours.

7) Your rights and choices

In the app: you can change your email and password, see and delete memories, and delete your account.

By email: for a copy of your data, or any other request about it, write to us at the address below.

GDPR (EEA/UK): you have rights of access, rectification, erasure, portability, restriction and objection. We rely on contract and legitimate interests to process most data; you may object to processing based on legitimate interests.

CCPA/CPRA (California): if it applies to us, residents may request access, deletion and information about disclosures. We do not sell or "share" personal information for cross-context behavioral advertising.

8) Security

Our apps and website talk to our server over HTTPS. Passwords are hashed with bcrypt. Each account can reach only its own private data, and rate limits slow down abuse. MongoDB Atlas encrypts the data it stores. No system is perfectly secure, so please protect your device and password.

9) Children

BuddhaUR is for people 13 and older. We don't ask for your age at sign-up. If we learn that an account belongs to a child under 13, we will delete it. A parent or guardian who believes a child has used BuddhaUR can write to us.

10) Links to other sites

Citations, credits and social links can open other sites, such as SuttaCentral, Freesound (the credit for our meditation gong) or Instagram. Their own privacy policies apply there.

11) Changes to this policy

We will update this policy when our practices or the law change, and tell you about material changes in the app or by email. Continuing to use BuddhaUR means you accept the updated policy.

12) Contact us

Skylark Creations LLC

Email: hello@buddha-ur.com