PEACEHABIT · PRIVACY

Privacy Policy

Version 0.1 · Last updated 27 September 2026

Pre-release draft. This policy describes the current preview build. Before public launch, the operator must confirm the hosting and storage regions, provider agreements, data-retention schedule and account-deletion workflow, then publish this policy at a public web address.

This policy explains how Peacehabit handles personal data when you use the Peacehabit website or app (“Service”). We aim to collect only what the current features need. We do not sell personal data and the current preview does not include advertising or an analytics SDK.

1. Who is responsible for your data

The data controller is:

“Peacehabit”, “we” and “us” refer to this business operating the Peacehabit brand.

2. Data we process

3. AI testing and preview features

When enabled for an approved test account, AI Studio sends your selected intention and optional note to OpenAI to write an English meditation, then sends the generated text to OpenAI to create a synthetic voice recording. You must confirm this processing before each request. Do not include sensitive personal information or information about other people. AI guidance is not medical advice.

Cloudflare processes the generation job and privately stores your generated script, recording, credit balance and job history under your account identifier. The optional note is removed from the active job record after success or failure. You can delete completed recordings from your personal library; a minimal job and credit record remains to prevent duplicate charges or refunds. Provider logs and retention depend on their service settings and must be confirmed before public launch.

Google Play subscription checkout and AI-credit purchases are not active. The displayed €2.49/month Premium amount is a preview of a planned offer; the current build does not take subscription payments. The “Daily reminder” and “Wi-Fi downloads only” settings currently save preference choices; they do not activate push notifications or offline downloads.

4. Why we use data and our legal bases

• Provide the Service and your account: create and secure your login, save your profile, preferences and favourites, stream recordings, and restore practice progress. Legal basis: performing the service contract with you.
• Keep the Service reliable and secure: diagnose technical problems, prevent abuse and protect accounts and systems. Legal basis: our legitimate interests in operating a secure service, balanced against your rights.
• Answer support and privacy requests: communicate with you and verify requests where needed. Legal basis: our legitimate interests and, where applicable, meeting legal duties.
• Meet legal and accounting duties: if paid features are introduced, handle records required by law. Legal basis: compliance with legal obligations.

We do not use the current preview to make decisions about you with legal or similarly significant effects. We do not use your choices to diagnose a health condition.

5. Service providers and sharing

We share data only with service providers where needed to run the Service, respond to you or comply with law:

• Supabase: account authentication and the database holding registered profiles, preferences, favourites and Premium entitlement status. The project region is determined by the Supabase project configuration.
• Cloudflare: private object storage and the audio/progress delivery service. It processes requested audio and practice progress associated with a random account identifier, and may process technical request information for security and delivery.
• Website/app delivery platform: the platform serving a given preview or deployment processes the network requests necessary to load the app. The final public hosting provider will be identified when the public deployment is selected.
• Google Fonts: the current web preview requests typefaces from Google Fonts. When a device loads those fonts, Google may receive technical request data such as the device’s IP address. We can replace remote fonts with locally hosted fonts before public launch.

We require providers to process personal data only for their services and under applicable agreements. We may also disclose data where required by law or necessary to protect users, the Service or legal rights. We do not sell or rent personal data.

Providers may process data in or outside the European Economic Area depending on their configuration and service. Before public launch, we will confirm the project regions and applicable transfer safeguards with each provider. The providers’ own privacy notices and terms also apply to their services.

6. How long we keep data

We keep registered account data while your account is active and for only as long afterward as needed to complete a verified deletion request, resolve a dispute, protect the Service or meet a legal obligation. Preferences, favourites and practice progress are linked to your account and are intended to be removed when the account is deleted. Limited security or backup copies may remain for the provider’s normal backup cycle and will not be restored to active use except as needed for disaster recovery or legal reasons.

Guest data stays in local browser storage until you clear it or remove the app/browser data. Support correspondence is kept only as long as needed to resolve the request and meet applicable record-keeping duties. Exact provider log and backup periods depend on provider settings and are being confirmed before public launch.

7. Your choices and data-protection rights

Subject to the conditions in data-protection law, you may ask us to:

• confirm whether we process your personal data and provide a copy;
• correct inaccurate or incomplete data;
• erase data or restrict its use;
• provide data you supplied in a portable format;
• object to processing based on legitimate interests; and
• withdraw consent where processing is based on consent.

Use the account’s export option for a current copy of profile and activity information, or email info@peacehabit.com to exercise a right or request account deletion. We may ask you to verify your identity before acting. We normally respond within one month, as required by the GDPR, and will explain if a lawful extension applies.

You may also complain to the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, SI-1000 Ljubljana, gp.ip@ip-rs.si.

8. Account deletion

You can request deletion from the account area in the app or through our web account-deletion page. We verify the request, remove the account and associated Peacehabit data from active systems, and ask providers to remove data they process for us where applicable. We may retain specific records only where required or permitted by law, and will explain that to you. A future Google Play subscription must be cancelled separately in Google Play.

9. Security

We use access controls and service-provider security measures appropriate to a small online service. No internet transmission or storage system can be guaranteed completely secure. Please use a unique password, keep your device protected and contact us promptly if you suspect account misuse.

10. Children

Peacehabit is not designed specifically for children and we do not knowingly ask children to provide personal data. A parent or guardian who believes a child has created an account can contact us so we can review and address the request.

11. Changes to this policy

We may revise this policy when the app or its providers change. We will update the date and make the new version available in the app. If a change materially affects your rights or how we use data, we will provide any notice required by law.

12. Contact

Privacy questions or requests: info@peacehabit.com, or write to ANIMATIONIKO, Niko Balazic s.p., Panonska ulica 32, 9231 Beltinci, Slovenia.