Privacy Policy

1. Information We Collect

We collect only what is necessary to provide you with meaningful insights and a personalized experience. We collect it in two ways. You give it to us when you type, speak or add it in the app. The app also sends usage data by itself.

2. How We Use Your Information

Your data serves one primary purpose: to help you hear yourself clearly. We use it to:

• Power Your Inner Council: Your journal entries shape how your 10 inner parts (Warrior, Sage, Lover, etc.) respond, so they speak with YOUR wisdom, not generic advice
• Pattern Recognition: Show you when you've been here before, connecting past insights to present situations
• Personalize Experience: Understand which archetypes are loudest so your Council responds authentically
• Improve Service: Enhance features based on usage data. This data is tied to your account identifier rather than your name, which makes it pseudonymous, not anonymous.
• Measure Our Ads: Tell Meta and Google when someone installs, signs up or subscribes, so we can see which of our own ads work. See Section 6.
• Communicate: Send important updates about your account or the service

3. Data Security & Encryption

We implement industry-standard security measures to protect your inner work:

• Encryption at Rest: Your journal entries and council conversations are encrypted in our database with a key that belongs to you alone (AES-256-GCM). Those keys are protected by Google Cloud Key Management Service.
• Secure Transmission: All data is transmitted via SSL/TLS encryption
• Server-Held Keys: Encryption keys are held server-side; we are not end-to-end encrypted
• Access Controls: Strict authentication and authorization protocols
• Access Control: Row-level security so your data is reachable only by you, with administrative access logged

4. Your Rights & Control

You have complete sovereignty over your data:

• Access: View all data we have about you at any time
• Export: Download your complete data in standard formats
• Correction: Update or correct any information
• Deletion: Permanently delete your account and all associated data
• Portability: Transfer your data to other services
• Restriction: Limit how we process certain data
• Withdraw consent: InnerOS cannot work without the AI services in Section 5, so you withdraw your consent to them by deleting your account in the app (Profile, then Delete Account). From that moment nothing more is sent to them, and we delete your data as described in Data Retention.

5. AI and Your Inner Council

Our AI serves as a mirror, not a judge. Here's how we handle AI processing:

• Journal Analysis: Your journal entries ARE read by AI so your Inner Council can respond. This is how your 10 voices speak with YOUR wisdom
• Pattern Recognition: AI identifies recurring themes and connects past entries to present questions
• Your Data Only: Your Inner Council draws only on your own entries. We don't mix your data with other users
• What goes to AI services: To run your council, the app sends four kinds of data to third-party AI services. They are your text (journal entries, council messages and memory lines), your voice (the audio from the microphone), the photos you attach, and your profile details (name, age, gender and goals). Section 6 names each service and says what it gets.
• Your agreement comes first: New users read this list on the profile step and tap "Agree and continue". Until they do, nothing goes to these AI services. The link to this policy is on the same screen.
• Who writes the replies: OpenAI runs the AI models that write your council's replies, the daily card and the Sunday Letter, and that read your messages for safety. Your entries are processed to answer you, and for nothing else. We do not sell them and we do not train our own models on them.
• Photos: A photo you attach to a journal entry or a council chat is sent to OpenAI as an image, so the AI can answer what you shared. We keep the photo in your account until you delete it. A profile picture is only stored and shown back to you. It is not sent to any AI service.
• Voice: When you use the microphone, your audio streams through our server to ElevenLabs, which turns it into text while you speak. InnerOS does not save the audio. When your council speaks, the text of its reply goes to ElevenLabs, which turns it into audio.
• Scoring and labeling: TypeSafe scores and labels your words. It reads your check-ins, your council messages and the lines your council remembers, and it helps pick the mode of each reply, the next step to offer, and which archetypes are active. We send the text, and for some checks your recent messages and the council's reply. We do not send your account ID or email address.
• Memory: Your council remembers what you tell it, with the date, so it can reflect your own words back to you. To find the right lines later, Google Cloud (Vertex AI) turns each line into a numeric embedding. You can see, edit, and delete what it remembers on the Memory screen.
• Automated safety checks: Your entries and messages are read by an automated safety check, so the app can offer support resources if you may be in crisis. The check runs on OpenAI and TypeSafe.
• People at InnerOS: Our team does not read your entries. The only exceptions are when you ask us to, for example for support, or when the law requires it.
• Built on Jungian Psychology: Our archetype framework is based on Carl Jung's work and Internal Family Systems (IFS)

6. Third-Party Services

These are the companies that receive your data. For each one, we say what it gets, how it gets it, and what it does with it.

AI services

• OpenAI: Runs the AI models that write your council's replies, the daily card and the Sunday Letter, and that read your messages for safety. It gets your text (journal entries, council messages and memory lines), your profile details (name, age, gender and goals) and the photos you attach. Our server sends them when you use the app. OpenAI uses them to answer you. In InnerOS Practice it also drafts session notes from transcripts and, if ElevenLabs fails, turns voice notes into text. Under OpenAI's API data policy, data sent through its API is not used to train its models.
• ElevenLabs: Turns your speech into text (speech-to-text) while you use the microphone, and turns your council's replies into spoken audio. It gets your voice audio, streamed live from the app through our server, and the text of the replies it speaks. InnerOS does not store the audio. We have opted out of ElevenLabs using our content to train its models.
• Google Cloud (Vertex AI): Turns your memory lines and messages into numeric embeddings, so the council can find what is relevant in your own words. It gets that text from our server. In InnerOS Practice it also reads documents a therapist uploads. Under Google Cloud's terms, Vertex AI does not use your data to train Google's models. Google Cloud also hosts our servers (Cloud Run) and holds the keys that protect your entries (Cloud Key Management Service).
• TypeSafe: Scores and labels your words, for example which archetypes are active and what kind of reply fits. It gets your check-ins, your council messages, the lines your council remembers and, for some checks, your recent messages and the council's reply. Our server sends the text. We do not send your account ID or email address. TypeSafe does not train its models on this data, and model improvement is turned off for our account.

Infrastructure

• Supabase: Database, sign-in and file storage. Holds your account, your entries (encrypted) and the photos you attach.
• Resend: Sends our emails to you, and practitioner notifications. It gets your email address and the message.
• Expo: Delivers push notifications to your device.

Payments

• RevenueCat: Manages subscriptions in the mobile app. It knows you by your InnerOS account ID, and gets your purchase and subscription status.
• Apple App Store and Google Play: Take your payment and handle billing. We never see your card number.

Analytics and ads

• PostHog: Product analytics and crash reports, so we can see which features are used and fix errors. It gets app events from the app, tied to your account identifier. It does not record your screen. We keep your journal and council text out of these events. Hosted in the United States.
• Meta (Meta SDK): Gets app events so we can measure our own ads: install, app open, sign-up, finishing onboarding, completing a council session, starting checkout, and starting a trial or subscribing (with plan, price and currency). It runs on Android and on iOS. On iOS it runs without the IDFA: advertiser ID collection is off, and the app does not ask for tracking permission.
• Google Analytics for Firebase: Gets app events (first open and sign-up) so we can measure our own Google ads. On Android, the advertising ID can be used. On iOS there is no IDFA and ad personalization is off.
• Our website, inneros.ai (Meta Pixel): On inneros.ai, the Meta Pixel loads in your browser and records each page you view. It also records when you finish the quiz or the council taste on the site, and when you tap through to the app store. We use this to see which of our Meta ads lead to those steps. It does not get your quiz answers or anything you type.
• Our website, inneros.ai (Google Analytics): Google Analytics records page views, scrolls and clicks, and these steps: starting or finishing the taste or the quiz, tapping through to the app store, and booking steps on Practice pages. We use it to see which pages and searches bring people to us. We send only a short list of fields chosen so that none of them names a person. The email you give on the quiz is not sent to Google.
• Google Calendar (InnerOS Practice, therapists only): When a therapist connects their Google Calendar, we access calendar.events (to create session events with Google Meet links) and calendar.freebusy (to read available slots, with no event titles or details). We never read or store existing calendar content. Therapists can disconnect at any time from Settings > Calendar.

The same protection, everywhere. Each company above handles your data under a contract (data processing terms) that requires protection at least equal to this policy. Meta and Google get app events under their own business tools terms. We send them no journal or council text, no account ID and no email address.

Limited Use of Google user data. InnerOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use the Google user data we access only to provide and improve the user-facing features of InnerOS Practice, specifically, creating session calendar events with Google Meet links and reading a therapist's availability. We do not use Google user data for any other purpose. In particular, we do not use it to serve advertisements, we do not use it (or transfer it) to develop, improve, or train generalized or non-personalized AI and/or machine-learning models, it is never sent to any AI service, and we do not sell it or transfer it to third parties except as necessary to provide these features, to comply with applicable law, or as part of a merger or acquisition with notice to affected users.

We never sell your personal data. We do not use data brokers. We do not track you across other companies' apps and websites, and on iOS we do not use the IDFA and do not ask for tracking permission.

7. InnerOS Practice: Therapists & Clients

InnerOS Practice is a separate product within InnerOS for mental health professionals and their clients. If you use InnerOS Practice (either as a therapist or as a client booking sessions through a therapist's page), the following applies in addition to the rest of this policy.

Data we collect from therapists:

• Profile & credentials: Name, photo, bio, specialisations, languages, years of experience, approach, and service details you add to your public profile
• Availability & calendar: Your connected Google Calendar free/busy slots (no existing event titles or details are ever read or stored). See Section 6 for full scope details.
• Payment & payout data: Bank account or UPI details you provide for receiving session payments, processed via Razorpay. We do not store full card or account numbers. Razorpay holds them under PCI-DSS compliance.
• Session notes: Clinical notes about your sessions, whether you write them yourself or approve a draft. Where a session was transcribed, the draft is written by OpenAI from that transcript and is yours to edit or delete before it becomes a note. Notes are encrypted at rest, are visible only to you, and are never read by our team. The transcript goes to OpenAI only to write the draft. Under OpenAI's API data policy, data sent through its API is not used to train its models, and we do not train our own models on your notes.
• Communication logs: WhatsApp message delivery status for booking confirmations and reminders sent on your behalf.

Data we collect from clients (people booking with a therapist):

• Booking data: Name, phone number (WhatsApp), selected service, and appointment time
• Intake responses: Answers to any intake questions set by the therapist
• Consent records: Timestamp and record of consent given before the first session
• Payment status: Whether a session was paid, pending, or waived, with no raw card data

How data is shared within InnerOS Practice:

• A therapist can see the booking, intake, and payment status of their own clients only
• A client's data is never shared across different therapists
• InnerOS acts as a data processor on behalf of therapists. Therapists are the data controller for their clients' personal data
• We do not train our own models on client booking or intake data

Third-party services used by InnerOS Practice:

• Razorpay: Payment processing for session fees (PCI-DSS compliant)
• Resend: Practitioner email notifications
• ElevenLabs (with OpenAI as a backup): Turns a voice note a client sends by WhatsApp, or speaks on a public booking page, into text
• WhatsApp Business API (Meta): Sending booking confirmations, reminders, and calendar invites to clients on behalf of therapists
• Google Calendar: Therapist calendar sync, see Section 6
• Google Meet: Conference links embedded in session calendar invites, created automatically on confirmed bookings

Clients can request deletion of their booking and intake data by contacting the therapist directly or emailing [email protected], or by writing to our Grievance Officer at [email protected]. Practitioners who want their Practice account closed can request it at the same address.

8. Data Retention

We retain your data only as long as necessary:

• Active Accounts: Data retained while account is active
• Deleted Accounts: When you delete your account we remove your login and the records tied to it. Some rows are retained in anonymised form where we are required to keep them, such as financial records of a paid session.
• Backups: Encrypted backups retained for 90 days
• Anonymized Data: May be retained for research and improvement

9. Children's Privacy

InnerOS is designed for adults on a journey of self-discovery. We do not knowingly collect data from anyone under 18 years of age. If we discover such data, we will promptly delete it.

10. International Data Transfers

InnerOS is operated by INNEROS TECHNOLOGIES PRIVATE LIMITED, an Indian company, and we are a Data Fiduciary under India's Digital Personal Data Protection Act, 2023. Most of the services listed in Section 6 process data outside India, including in the United States and the European Union. This includes the AI services (OpenAI, ElevenLabs, Google Cloud and TypeSafe). Each works under a data processing agreement with transfer safeguards, and we hold a transfer impact assessment for our database provider. We are not a HIPAA covered entity and do not claim HIPAA compliance.

If you live in the European Union or the United Kingdom, the GDPR also applies to you. You have the rights in Section 4, plus the right to withdraw your consent at any time and to complain to your local data protection authority. Transfers to providers outside the EU and UK rely on Standard Contractual Clauses.

11. Changes to This Policy

As InnerOS evolves, so might this policy. We will:

• Notify you of significant changes via email
• Provide 30 days notice before changes take effect
• Allow data export if you disagree with changes
• Maintain a version history of all policy changes

12. Contact Us

For privacy-related questions or to exercise your data rights:

• Email: [email protected]
• Grievance Officer: [email protected]
• Website: inneros.ai/contact

Under the Digital Personal Data Protection Act, 2023 (India), you can raise a grievance about how we handle your personal data with our Grievance Officer. We acknowledge every grievance within 3 working days and respond within 30 days.