Privacy Policy
Version 15 · Last Updated: October 15, 2026
Your privacy matters to us. This Privacy Policy explains what data ProgramU collects, how we use it, who we share it with, and the rights you have over your information. ProgramU is operated by ProgramU LLC, a Wyoming limited liability company. If you have questions, reach out at privacy@programu.app.
1. Who This Policy Applies To
This Privacy Policy applies to all users of the ProgramU mobile application (available on iOS and Android) and the ProgramU website at programu.app. It applies whether you are a current subscriber, a free-tier user, a trial user, or just browsing our website. ProgramU is offered in the countries where it is available on the App Store or Google Play. It is not offered in mainland China, Russia, or countries and regions subject to comprehensive United States sanctions, and it may not be available in some other countries. If you live outside the United States, Section 11 explains how your information is transferred to the United States and Section 16 lists the rights you have where you live. A French version of this Policy is available for people in Quebec. ProgramU is intended for adults 18 years of age and older (or the age of majority where you live, if higher). We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with their information, please contact privacy@programu.app and we will delete it promptly.
2. Information We Collect
Account Data: • Your email address • Your display name • Your profile photo (if you choose to add one) • Your date of birth (used for age verification only) Identity and Intake Data: • ReflectU intake responses (your description of the life you want, identity vision, patterns to release, ways you want to feel, topics excluded, a chosen name for ReflectU) • BeingU 90-day program inputs (desire, vision, focus, pattern) Journal and Reflection Data: • Freeform Journal entries (available with or without a program), including whether an entry was written in response to a Kaion journal prompt and, if so, the prompt text • Daily Identity Check-Ins • 7PM Identity Reflection entries • Living Proof wins • BeingU journal entries • Long-form program reflections • Sleep practice records ReflectU Chat history and metadata: If you use ReflectU Chat (a conversational AI that reflects your own thoughts back to you to help you find clarity), we store: • The text of your messages and the assistant's responses, in conversation threads tied to your account • Thread metadata: timestamps, message counts, themes extracted by our summarizer, and rolling summaries used to keep the mirror coherent across turns • A snapshot of your recent ProgramU activity (last 7 days of journals/reflections, recent wins, recent sessions) refreshed every 24 hours per active thread, used to ground the assistant's reflection in what is actually happening for you We NEVER log message content to error-reporting tools (Sentry) or operational logs. Only metadata (thread id, message length, latency, token usage, filter triggers) is recorded for cost and safety analytics. ProgramU Time Capsule content: The text of letters you write to your future self, any photos you attach (up to 3 per letter), and the scheduled delivery date you choose. Letters are stored until their delivery date, at which point they are emailed to you at the address on your account. A delivered letter remains stored in your account until you seal a new one (which replaces it) or delete your account. CollectiveU Participation Data: If you join a live CollectiveU session, a presence marker keyed to your account exists for the length of the session so the live count can be measured; it is removed when you leave or disconnect, and only the aggregate count is kept. Separately, your own account records that you played a CollectiveU session (a per-account play count and timestamp, live or replay) — the same kind of listening history described under Usage Data below. Other participants never see this, and it is never combined with the aggregate counts. Voice Recordings (Optional): If you opt into our Voice Clone feature, your voice sample is sent through a ProgramU server function to Inworld AI and is not kept on ProgramU servers. We retain only the resulting voice model identifier. See Section 4 for details. Usage Data: • Listening history and play counts • App activity timestamps (such as when you last opened the app) • Feature-usage counters (for example, which onboarding steps you complete or which home-screen actions you tap), stored as daily per-account counts • Your credit balance and the record of how credits were granted, carried over and spent • Generated session metadata • In-app preferences • Progress through the 90-day BeingU program Device Information: We collect app version and operating system platform (iOS, Android, or web) at consent time for audit purposes. If the app crashes or hits an error, our crash reporter (Sentry) receives the device model and operating-system version with the report so we can reproduce the problem. If you allow notifications, we store the push token your device issues. We do NOT collect advertising identifiers, precise location or device fingerprinting data, and we do not use IP addresses to identify or locate you beyond the country-level use described under Region. Region: Your country (from your App Store or Google Play account, your device's region setting, or the country you choose in Profile → Settings → Region), your device's time zone, and its language setting. We use them to show crisis lines for your country first, to show our legal terms in French first in Canada or when your device is set to French, to avoid sending notifications during night-time hours where you are, and to apply the email consent rules where you live. They are not used to track your location. On the website, we also use the country your internet connection appears to come from, which our hosting provider, Vercel, works out from your IP address as each page loads, to show crisis lines for your country first, to show our legal terms in French first in Canada, to tell you whether you can buy on the website, and to limit website analytics to visitors in the United States. If you're signed in and the app hasn't already given us your country, we save this country to your account, so that crisis lines and email rules follow where you are. We don't store your IP address. Subscription and payment information: When you subscribe to a paid tier, payment processing depends on the platform: • On iOS: Apple In-App Purchase (Apple handles your payment details; ProgramU receives only your subscription status and transaction identifier) • On Android: Google Play Billing (Google handles your payment details; ProgramU receives only your subscription status and transaction identifier) • On the website: Link and Stripe (web purchases are sold through Link, Stripe's merchant-of-record service. Link and Stripe handle your payment details — credit card, debit card, Apple Pay, Google Pay, or other supported methods — and your name, billing address and country, which they use to take the payment and calculate and pay sales tax; ProgramU receives only your subscription status, transaction identifiers, your country, and the email address associated with the transaction) For iOS and Android subscriptions, your subscription state is also mirrored to RevenueCat for unified entitlement management. RevenueCat receives your user ID and subscription state; it does not receive your payment card details. Web app subscriptions purchased through Stripe are NOT routed through RevenueCat — ProgramU records your entitlement directly from Stripe. What You Choose to Share: Much of what ProgramU holds is what you choose to write or say: journal entries, intake answers, focus text and conversations with Kaion. Share only what you are comfortable sharing, and please do not share other people's health information or other sensitive details about them.
3. Third-Party Services (Sub-Processors)
We use the following third-party sub-processors to operate ProgramU. Each processes only the data necessary for its function: • Firebase (Google Cloud): Authentication, Firestore database, Cloud Functions, Cloud Run, Firebase Storage, Cloud Logging. Stores your account data, journal entries, session metadata, voice clone identifiers, generated session scripts, and operational telemetry. Data is encrypted at rest (AES-256, Google-managed keys) and in transit (TLS). Region: us-central1. • Cloudflare R2: Object storage for generated session audio files (.mp3). Files are stored at user-scoped paths and encrypted at rest with provider-managed keys. Audio files are served via Cloudflare's public CDN URLs. • Anthropic: AI text generation for session scripts, BeingU phase content, refined focus, suggested resources, ReflectU post-conversation summaries, and Kaion's memory notes. For session/script generation, Anthropic receives the system prompt, your relevant intake context, and your focus text on each request. For ReflectU summaries, Anthropic receives the transcript of a completed ReflectU conversation so it can generate the short summary, themes, and energy reading saved with that conversation, and, when personalization is on, pick out the short notes Kaion remembers (see Section 14). Anthropic does NOT power ReflectU's live voice or text conversation (see the OpenAI and Inworld entries below). Anthropic also runs our AI safety check: it receives ReflectU text messages, voice-call transcripts, and any other entry that is not clearly in English, only to recognize crisis language in any language (see our Trust & Safety page). Anthropic does not train on our API traffic — we have not opted into training usage and have confirmed this is the default for our enterprise API access. Per Anthropic's enterprise API terms, request/response data may be retained for up to 30 days for abuse-detection purposes unless otherwise contracted. • OpenAI: AI text generation that powers ReflectU's live conversational responses (both voice and text), using OpenAI's GPT-6 models. For each turn of a ReflectU conversation, the model receives the persona instructions, your conversation history, and your message (your transcribed speech, in voice mode) so it can generate ReflectU's reply. Requests reach OpenAI through Inworld's routing infrastructure (see the Inworld entry). OpenAI processes this data per its API terms; we do not use this data to train any model. • Google (Google AI Studio / Gemini): the backup for our AI safety check when Anthropic is unavailable, reached through Inworld's routing infrastructure. Google processes this data per its API terms; we do not use this data to train any model. • Inworld: ReflectU speech-to-text (STT), text-to-speech (TTS), and AI model routing, plus voice synthesis for generated sessions. For generated sessions, Inworld receives the session script text and the voice ID to synthesize. For ReflectU live voice conversations, Inworld transcribes your spoken audio (STT), routes the conversation to an AI model for the response, and synthesizes the reply back into speech (TTS). Inworld acts as a ROUTER for the conversational AI step: ProgramU's choice is OpenAI's GPT-6 models, but if that model is unavailable or fails, Inworld's routing infrastructure may automatically route the request to a comparable third-party AI model or provider, which is outside ProgramU's direct control. If you create a voice clone, your voice sample passes through a ProgramU server function to Inworld to generate your voice model; we do not keep the raw recording on our servers (see §4 for voice clone details). Inworld may also use a smaller AI model for brief helper steps, such as a short filler line on a call while the reply is prepared. Inworld processes only what is needed to transcribe, route, generate, and synthesize your audio. • Apple App Store and Google Play Store: In-app purchase processing for iOS and Android subscriptions, respectively. Each handles your payment details per their own privacy policies and terms. • Stripe and Link: Web purchases are sold through Link, Stripe's merchant-of-record service. They handle your payment card details, name, billing address, transaction processing, sales tax, fraud checks, receipts and payment support, and receive your email address and a user identifier to connect the purchase to your ProgramU account. Their privacy policies and PCI compliance govern the data on their systems, and you can ask Link directly to delete your Link account. • RevenueCat: Unified subscription entitlement management for iOS and Android subscriptions only. Receives your user ID, platform (iOS/Android), subscription tier, plan duration, and transaction identifier. Does not receive your payment card details. Web app subscriptions are not processed through RevenueCat. • Apple Sign-In and Google Sign-In: Optional authentication providers. Used only if you choose to sign in via Apple or Google instead of email/password. Each provider processes your authentication credentials per their own privacy policies. • Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM): Push notification delivery for iOS and Android, respectively. Receive your device push token and the notification payload to deliver notifications to your device. • Expo Push Service: ProgramU's push notification orchestration layer. When the server schedules a notification (e.g., BeingU phase ready, CollectiveU session start), the notification payload and your Expo push token are sent to Expo's push service, which forwards to APNs or FCM for delivery to your device. Notification content does not include sensitive personal data such as journal text or session content. • Expo Application Services (EAS Update): delivers updates to the app's code between store releases. When the app checks for an update, Expo receives the request (app version, platform and an installation identifier the app generates); no personal content. • Resend: Email delivery. Sends account-related emails (verification, sign-in links, account deletion confirmation, ProgramU Time Capsule letter delivery on scheduled dates) and a small number of emails about your trial and your account (for example, when your trial is about to end, or if you have not been back in a while). Every email that is not strictly about your account carries a one-click unsubscribe; outside the United States we send them only if you opted in. Receives your email address and the email content at the time of send. • Sentry: Error and crash reporting. Receives your user ID, application stack traces, and operational breadcrumbs. Personal content (journal entries, intake answers, session focus, voice data) is filtered out of error reports before transmission. Sentry retains reports per its default retention policy (~90 days). • PostHog (ProgramU website and web app only): Product analytics and session replay for the web experience — page views, feature-usage events, and session recordings to help us understand and improve the website and web app. Limited to United States visitors; PostHog is not loaded and no session recording occurs for visitors in the EU or UK. PostHog does not receive your journal entries, session content, voice data, or payment details. The ProgramU mobile apps use no analytics SDK. • Vercel Analytics and Speed Insights (ProgramU website only): Privacy-friendly, aggregate web traffic and performance metrics. Collects anonymized page-view and performance data to monitor site health; does not use cross-site tracking cookies and does not identify individual users. What we do NOT send to sub-processors: • We do NOT send your email address, display name, payment card details, or device identifiers to Anthropic, OpenAI, Google, Inworld, or Sentry beyond what is described above. • Voice clone records at Inworld are tagged with an opaque random handle, not your account identifier. • We do NOT use any third-party advertising networks or behavioral advertising pixels. The ProgramU mobile apps use no analytics SDKs; the ProgramU website uses first-party product analytics (PostHog, Vercel Analytics) limited to United States visitors, as described above — never to track you across other companies' apps or websites.
4. Biometric and Sensitive Data
ProgramU offers an optional Voice Clone feature that creates a personalized text-to-speech voice for your sessions. We treat your voice as biometric data subject to heightened protection. Voice Clone Data Handling. If you choose to create a voice clone (available with Full Access), here is exactly how your voice sample is handled: 1. You record a short voice sample directly in the ProgramU app or web app. 2. The sample is sent, encrypted in transit via TLS, to a ProgramU server function, which passes it to Inworld AI to create your voice model. If the recording's format has to be converted first, the function writes it to temporary storage for the few seconds the conversion takes, then deletes it. 3. We do NOT keep your raw voice recording. It is never written to Firebase Storage or any ProgramU database, and no copy remains on ProgramU servers once your voice model is created. 4. Inworld generates your voice model from the sample and returns a voice model identifier. Only the model identifier is stored in your ProgramU account (under your user profile in Firestore). 5. Your voice model lives at Inworld. Inworld stores it under an opaque random handle that contains no link to your ProgramU account identifier. 6. Subsequent session synthesis uses your voice model identifier to request audio from Inworld for that session's script. The voice model itself never leaves Inworld. Your Biometric Consent: Voice Clone is strictly opt-in. Before any recording occurs, ProgramU presents a dedicated biometric consent screen that provides: • Explicit, informed, unambiguous consent — you must affirmatively agree before we record. We do not infer consent from continued app usage, default-on settings, or pre-checked boxes. • Specific purpose disclosure — we tell you exactly what your voice will be used for. • Storage and retention disclosure — exactly what is stored where, and what triggers deletion. • Right to withdraw — you can withdraw consent any time by deleting your voice clone. • Risk disclosure — we disclose that synthetic voice generation has inherent risks, including the theoretical possibility of misuse if your voice model were compromised. Your consent is recorded with a timestamp, the consent version, and the platform you signed up from. Retention Schedule for Voice Data: Your voice model is kept only while your voice clone exists. We permanently destroy it (and the model identifier) when you delete your voice clone, when you delete your account, or three years after your last interaction with ProgramU, whichever comes first. We never sell, lease, trade or otherwise profit from voice data, and we do not disclose it except to Inworld as described above, with your consent, or where the law requires. Right to withdraw voice clone consent: You can delete your voice clone at any time from Profile → My Voice Clone. This permanently removes the voice model from Inworld and clears the model identifier from your ProgramU account. Existing audio files generated with the voice clone before deletion remain in your account unless you separately delete them. You may also revoke consent by deleting your account or by emailing privacy@programu.app. Health-Related Information: Journal entries, intake answers, Kaion conversations and the focus you write for a session can reveal information about your mental or physical health. Many countries treat this as sensitive information that needs your explicit consent, including Canada (and Quebec), Malaysia, India, South Africa and the Philippines. We ask for that consent in the app before you first share this kind of information, we use it only to provide and personalize ProgramU as this Policy describes, and you can withdraw it at any time by deleting the content, turning off personalization, or deleting your account.
5. How AI Data Processing Works
When you generate a session: 1. Your session topic and relevant intake context leave your device and are sent to Anthropic Claude for script generation. 2. The generated script is sent to Inworld AI for voice synthesis. 3. The final MP3 audio is uploaded to Cloudflare R2 and linked to your account. AI training and your data: • Anthropic (session script text generation, ReflectU post-conversation summaries, and Kaion's memory notes): Anthropic does not train on ProgramU's API traffic. We have not opted into training usage, and Anthropic's enterprise API defaults exclude our traffic from training datasets. • OpenAI (ReflectU live conversational responses): OpenAI processes your ReflectU conversation turns to generate ReflectU's replies. We do not use this data to train any model, and we process it under OpenAI's API terms. See Section 14 for the full ReflectU data flow, including how Inworld's routing may fall back to a comparable model if OpenAI's model is unavailable. • Google (Gemini — backup for the AI safety check): Google processes a message only when our primary safety check is unavailable. We do not use this data to train any model, and we process it under Google's API terms. • Inworld (ReflectU speech-to-text, text-to-speech, AI routing, and session voice synthesis): Inworld processes your voice sample, session scripts, spoken audio, and conversation text to perform transcription, routing, and synthesis tasks. Inworld's product policy governs whether and how it may use this data for service improvement. We have requested that Inworld not use our customer data for model training; you may contact privacy@programu.app for the most current status of this arrangement. • We never use your journal entries, intake answers, session focus text, voice recordings, ReflectU conversations, or any other personal content to train any AI model that we or any third party operates. AI-generated content can contain errors or imperfections. ProgramU filters block obvious safety issues, but AI is not perfect. Use your own judgment when applying any session to your life. Automated Safety Checks and Human Review: Our crisis check and content filters are automated. When one of them stops a message, a save or a generation, that decision is made by automated processing. If you think it was a mistake, email support@programu.app: a person will review it, tell you the main reasons, and you can give us your side. The check itself keeps only a record that it ran (when, where in the app and which kind), not what you wrote.
6. How We Use Your Information
We use your information to: • Provide the core ProgramU service (generate your sessions, sync your library, deliver your subscription) • Personalize your experience (tailor sessions, your 90-day program and Kaion to your identity vision and your activity), only if you choose it: we ask everyone when they sign up or accept updated terms, and you can change it anytime in Profile → Personalization in the app or Account → Personalization on the website • Process payments (via Apple, Google, Stripe, and RevenueCat) • Send account emails (verification, deletion confirmation, Time Capsule delivery) and a few emails about your trial and your account, each with an unsubscribe link (outside the United States, only if you opted in) • Catch and diagnose errors (via Sentry) • Understand how the app is used — which screens and features are reached — using counters stored in our own database (no third-party analytics) • Comply with legal obligations • Detect and prevent fraud or abuse of the service We do NOT use your information to: • Show you ads or sell ad space • Train AI models • Sell, rent, or trade your personal data to anyone • Build profiles of you for advertising • Track you across apps or websites Your responsibility when using ProgramU sessions: ProgramU sessions — including subliminal, meditation, hypnosis, EFT tapping, BeingU programs, ReflectU sessions, and CollectiveU sessions — are designed to produce states of relaxation, focus, identity-level reflection, suggestibility, and (in the case of hypnosis sessions) trance. These states can affect your alertness, attention, and awareness. You agree to use ProgramU sessions only in environments where altered states of attention will not endanger you or others. Specifically: • Do not listen to ProgramU sessions while driving, operating machinery, exercising in any environment requiring full attention, or performing any task that requires alertness. • Hypnosis sessions induce a trance-like state. Use only when seated or lying down in a safe environment. • Sleep hypnosis sessions are designed to guide you into sleep and do not include an awakening sequence. Use only when you are ready to sleep. • You are responsible for choosing when and where to engage with sessions. ProgramU is not liable for any consequence resulting from your use of sessions in inappropriate contexts. By using ProgramU, you acknowledge that you have read, understood, and accepted this responsibility. AI-generated content: All ProgramU sessions, BeingU phase content, ReflectU outputs, and refined focus text are AI-generated. AI systems can produce errors, unintended outputs, and content that may not perfectly match your input. ProgramU continuously refines its AI models, prompts, and safety filters — content generated today may differ from content generated tomorrow as the system improves. You acknowledge that AI-generated content is inherent to the service and not a defect. Use your judgment. If a session, paragraph, or AI output does not feel right for you, skip it and try a different one. Your judgment is the final filter on any AI output. Legal disclosures: we may disclose information where required by law or legal process; to enforce our Terms of Service; to respond to a payment dispute with records of the subscription and acceptance; or to protect the rights, property, or safety of ProgramU LLC, our users, or the public.
7. Data Security
Your data is stored using Google Firebase and Cloudflare R2, both of which employ industry-standard security practices, including: • TLS encryption for all data transmitted between your device and our servers • AES-256 encryption for data stored at rest • Firebase Security Rules that restrict access to authenticated users and authorized system processes We minimize logging of personal content and scrub sensitive data from error reports before they leave your device. No system is perfectly secure, and we cannot guarantee absolute security. But we apply modern best practices and continuously work to improve our safeguards.
8. Your Rights
Access and Correction: • Update your profile information at any time within the app • Request a copy of your personal data by emailing privacy@programu.app Deletion: You can permanently delete your account and all associated data at any time: • In the app: Profile → Privacy & Security → Delete Account • On the web: programu.app/delete-account • By email: privacy@programu.app Account deletion permanently wipes: • All journal entries, intake responses, and session history • Your voice clone model (deleted from Inworld AI) • Your generated audio files on Cloudflare R2 • Your RevenueCat subscriber record • Your web (programu.app) subscription, which is cancelled immediately with no further charges, and your Stripe customer profile and saved payment methods • Your Firebase Auth account • Your user root document and all subcollections Deleting your account cannot cancel a subscription bought through the App Store or Google Play. Cancel it in your Apple or Google Play subscription settings first, or it will keep renewing. Most deletion processes complete within 24 hours. In rare cases, full deletion may take up to 30 days. Data Portability: Upon request to privacy@programu.app, we will provide a copy of your personal data in a portable, machine-readable format. Right to Object: You have the right to object to certain processing activities. Contact privacy@programu.app to exercise this right. More Rights Where You Live: If the law where you live gives you more rights or a shorter deadline, we follow it; Section 16 lists them by country. We answer requests within 30 days, or sooner where your law requires (for example, 20 working days in New Zealand and 21 days in Malaysia). We may need to confirm your identity before acting on a request.
9. Data Retention
How Long We Keep Your Data: Your data is retained for as long as your account remains active. We do not have automatic scheduled deletion of inactive accounts — your data remains accessible to you until you delete your account or contact us to do so. What Gets Deleted When You Delete Your Account: • Firebase Auth account → deleted • Firestore user document and all subcollections → deleted • Firebase Storage files under your user path → deleted • Cloudflare R2 generated audio files → deleted • Inworld AI voice model → deleted • RevenueCat subscriber record → deleted • Stripe (web) subscription → cancelled; Stripe customer profile and saved payment methods → deleted (transaction records are retained, see below) After account deletion, data may persist briefly at the following sub-processors, governed by their own retention policies: • Firestore automatic backups (managed by Google Cloud): up to 35 days • Firestore Point-In-Time Recovery (PITR): 7-day rolling window for disaster recovery • Firebase Cloud Functions logs (server-side operational logs): ~30 days, retained by Google Cloud Logging • Cloud Run worker logs (BeingU generation): ~30 days, retained by Google Cloud Logging • Cloudflare R2 audit logs: per Cloudflare's default retention policy • RevenueCat historical purchase records: retained per payment processor compliance requirements (typically 7 years for tax and audit compliance) • Stripe historical transaction records: retained per payment processor compliance requirements (typically 7 years for tax and audit compliance) • Apple App Store and Google Play Store: transaction history is retained at the Apple ID or Google Account level, governed by Apple's and Google's privacy policies • Resend transactional email send history: typically 30 days to 1 year per Resend's platform retention • Sentry error reports: tied to your account UID at the time of error; retained per Sentry's default policy (~90 days). Sentry error reports are NOT retroactively deleted when your ProgramU account is deleted. • Inworld voice model: deleted from Inworld when you delete your voice clone or your account • Anthropic API request/response data: per Anthropic's enterprise API terms, up to ~30 days for abuse-detection purposes ReflectU Chat retention: • Conversation threads are retained indefinitely while your account is active. You can review, switch between, or implicitly archive past threads via the chat interface. • When you delete your account, all ReflectU Chat threads and messages are wiped from ProgramU within minutes (subject to the sub-processor timelines above). • Per-thread analytics records (metadata only — never message content) are kept under analytics/reflectuChat for cost and safety analysis; they are tied to a one-way hash of your user id, not to your account record. ProgramU itself wipes your account data (Firestore, Firebase Storage, R2) at the time of deletion request, typically within minutes. Sub-processor retention timelines above are outside ProgramU's direct control but are disclosed for transparency. What ProgramU keeps after deletion: • A minimal deletion record: your account's internal ID and the dates the deletion was requested and completed. It contains no personal details or content, and is kept indefinitely so a deleted account is never billed or recreated. • A deletion audit record: the same dates, the address the confirmation email was sent to, and a checklist of which data categories were removed, kept as proof the deletion happened. It contains none of your content. • Emails you sent to our support inbox, kept separately so we can answer them. Email support@programu.app if you want them deleted. None of this retained data is used to contact you or re-identify you after deletion.
10. Children's Privacy
ProgramU is intended for adults 18 years of age and older (or the age of majority where you live, if higher). We verify age at onboarding via a date-of-birth gate. ProgramU LLC does not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal data from a person under 18, we will delete that information immediately. If you are a parent or guardian who believes we have collected data from a minor, please contact privacy@programu.app.
11. Where We Operate and International Transfers
ProgramU LLC is organized in the State of Wyoming, United States. ProgramU is offered in the countries where it is available on the App Store or Google Play. It is not offered in mainland China, Russia, or countries and regions subject to comprehensive United States sanctions. Where Your Information Is Stored: We store your information in the United States (Google Cloud, region us-central1). Our sub-processors (Section 3) process it in the United States and in other countries where they operate. If you live outside the United States, your personal information is transferred to the United States, where privacy laws may differ from those where you live, and where it may be accessible to courts, law enforcement and national security authorities under U.S. law. How We Protect Transfers: We transfer your information only as needed to provide ProgramU. Our sub-processors are bound by written agreements that require them to protect it to a standard comparable to this Policy. Where the law of your country relies on consent for transfers abroad, we ask for your consent in the app. For people in Quebec, we assessed these transfers before making them, as Quebec law requires. For information from the European Economic Area, Switzerland and the United Kingdom, we rely on the safeguards in our providers' data processing terms, such as the European Commission's standard contractual clauses (with the UK addendum and the Swiss adjustments), or on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the provider is certified. We do not sell your personal information.
12. California and Other State Residents
Residents of certain U.S. states have additional rights under applicable privacy laws, including: • The right to know what personal information we collect • The right to delete personal information • The right to correct inaccurate personal information • The right to opt out of the sale or sharing of personal information (ProgramU does not sell or share personal information) • The right to limit the use of sensitive personal information • The right to non-discrimination for exercising your privacy rights To exercise any of these rights, email privacy@programu.app with your request. We will respond within the timeframe required by applicable law (typically 45 days). ProgramU LLC does not sell or share personal information for cross-context behavioral advertising. Consumer Health Data (Washington and Nevada): If you live in Washington or Nevada, our Consumer Health Data Privacy Policy at programu.app/consumer-health-data explains what health-related information we collect, why, who receives it, and how to use your rights, including how to appeal our decision on a request.
13. Changes to This Policy
ProgramU LLC may revise this Privacy Policy from time to time. When we make material changes, we will: 1. Post the updated policy on programu.app/privacy with a new "Last Updated" date 2. Notify you within the app 3. Require you to review and accept the updated policy before continuing to use ProgramU For minor changes (such as typo fixes or formatting updates), we may update the policy without requiring re-acceptance. The current version of this policy is always the version posted at programu.app/privacy.
14. ReflectU AI Conversations (Voice and Text) — Data Flow
ReflectU offers an AI-powered conversation experience, in both voice and text; its persona is named Kaion. This section describes the specific data handling for ReflectU conversations, beyond what is covered in Section 3 (Third-Party Services). The conversational AI behind ReflectU: ReflectU's live conversational responses — for both voice and text — are generated by OpenAI's GPT-6 models, reached through Inworld's routing infrastructure. Because Inworld acts as a ROUTER, if that model is unavailable or fails, Inworld's routing infrastructure may automatically route the request to a comparable third-party AI model or provider, which is outside ProgramU's direct control. Anthropic's Claude does NOT power the live ReflectU conversation; Anthropic is used only to generate the short summary, themes, and energy reading saved after a conversation ends, and the notes Kaion remembers (see below and Section 3). Live voice data flow: When you start a ReflectU voice session, the data flows like this, in real time: 1. Your spoken audio is transmitted to Inworld and transcribed to text (speech-to-text / STT). 2. The transcribed text, along with the persona instructions and conversation history, is sent — via Inworld's router — to OpenAI's model (or, on fallback, a comparable model) to generate ReflectU's reply. 3. The reply text is synthesized back into speech by Inworld (text-to-speech / TTS) and played to you. In text mode, the same model-via-Inworld step generates the reply; the STT and TTS steps do not apply. Kaion's language: If you choose a language other than English in Profile → Settings → Kaion's language, Kaion replies in that language, and on calls in that language Inworld transcribes and speaks it. The setting is stored in your account; the rest of the app stays in English. What Kaion can see about your ProgramU life: When your personalization master toggle is ON, each conversation may include context from your account so Kaion's guidance is grounded in your actual work: your identity intake, your 90-day program status, recent session titles, which of your sessions you finished playing and when (and your listening streak), your most recent freeform Journal entries (including which of his prompts an entry answered), and the notes Kaion remembers (below). Turning personalization OFF excludes this personal context (the EducateU article catalog, which is not personal data, may still be included). Journal content shared this way is used only to generate the conversation and is governed by the same provider terms as the rest of the conversation. What Kaion remembers: After a conversation, an AI step (Anthropic's Claude) picks out a few short notes worth remembering, for example what you're working on, what has helped, and how you like to work, and saves them to your account. Kaion reads them in later conversations so you don't have to repeat yourself. You can see every note in Profile → Identity Profile & Memory → What Kaion has learned, change or delete any of them, add your own, or forget everything at once. The notes are used only to shape Kaion's replies to you, are never used to train AI models, and are deleted when you delete your account. If personalization is OFF, Kaion neither saves nor uses them. Your voice and the data flow: Your live-call voice audio is transmitted to Inworld solely so it can be transcribed for the conversation. It is NOT used to create a voiceprint, NOT used to train any model, and is NOT retained by ProgramU — raw call audio exists in transit only between your device and Inworld and is never written to ProgramU servers. (The optional Voice Clone feature, which is a separate opt-in, is governed by Section 4 — Biometric and Sensitive Data.) OpenAI, Inworld, and any fallback provider may process and retain conversation data per their own privacy policies (for Inworld, inworld.ai/privacy). Zero Data Retention status: ProgramU does not currently have a Zero Data Retention (ZDR) agreement with Inworld. This means Inworld — and the AI model provider it routes to (OpenAI, or a comparable fallback provider) — may retain conversation data for some period per their default platform retention policies. ZDR is offered by Inworld only on higher service tiers; we intend to adopt it as we scale, but it is not in place today. You may contact privacy@programu.app for the most current status. Treat all ReflectU conversation content (voice and text) as data that is processed by third parties under Inworld's and the routed model provider's terms. Voice transcript storage in ProgramU: After each ReflectU voice conversation ends, a transcript of the conversation (the text of what was said by both you and the AI) is stored in your ProgramU account under users/{your-uid}/reflectuCalls/{callId}/transcript. This is so you can revisit conversations via the in-app history view. Transcripts include: • The role (user / assistant) of each turn • The text content of each turn • Timestamps and call duration • A short summary, themes, and energy reading generated by our summarizer for each call Deletion: Voice call transcripts are deleted when you delete your ProgramU account (see Section 8 — Your Rights). Per-conversation deletion within an active account is on our roadmap for a future release; for now, the only way to remove a single transcript is to delete your account or contact privacy@programu.app. What is NOT stored: • Raw audio recordings of the conversation are not stored on ProgramU servers. Audio exists in transit only between your device and Inworld AI. • Your voice clone (a separate optional feature) is governed by Section 4 — Biometric and Sensitive Data. Consent flow: Before your first ReflectU voice conversation, ProgramU presents a one-time disclaimer modal explaining the AI nature of the experience and how to access crisis resources. Tapping "I understand — start the call" records your consent (timestamp + version) at users/{your-uid}/preferences/reflectuCall. Subsequent voice calls do not require re-consenting unless the disclaimer version changes. Every chat and every call also shows a line reminding you that Kaion is an AI, not a person, and can make mistakes. Reported Replies and Sessions: If you report a Kaion reply or a generated session, we store the reported text (for a session, its title and a link to it), where it came from (chat, call, session or the Report AI content screen), your note if you add one, and the time, under your account. A person at ProgramU reads it to review the report. We are told by email that a report arrived; the email does not contain what was reported. Reports are deleted with your account. CollectiveU Feedback: After a CollectiveU session you can tap a thumbs up or down and, if something went wrong, pick a reason (for example, audio cut out). We store your choice, the session it refers to, whether it was live or a replay, and your platform, under your account and in a list our team reviews. No free text is collected there. These records are deleted with your account.
15. Contact Us
For privacy questions, data requests, or to exercise your rights: • Privacy questions: privacy@programu.app • Data requests: privacy@programu.app • Safety concerns: support@programu.app • General support: support@programu.app Privacy Officer: Zachary Fleshman, Founder — privacy@programu.app. This person is our privacy officer in Canada, Australia and New Zealand; the person in charge of the protection of personal information in Quebec; our data protection officer in Singapore and the Philippines; our grievance officer in India; and our information officer in South Africa. Mailing address: ProgramU LLC 30 N Gould St Ste N Sheridan, WY 82801 United States Thanks for trusting us with your work. We take that trust seriously. — The ProgramU Team
16. Your Rights by Country
Everyone Outside the United States: Wherever you live, you can ask us for a copy of your personal information, correct it, delete it, and withdraw any consent you gave, and you can complain to your data protection authority. The law where you live may give you more; the country sections below cover the countries whose laws we have mapped in detail. To use any of these rights, email privacy@programu.app. We would appreciate the chance to put things right first. Canada: You can access and correct your personal information and withdraw your consent. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Quebec: You can also ask for the computerized personal information you gave us in a structured, commonly used technological format. Personalization, which profiles you, stays off until you choose to turn it on (Section 6). We use your country only for the purposes in Section 2, never to track your location. You can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). Australia: You can access and correct your personal information under the Australian Privacy Principles. Your information is disclosed to recipients in the United States and in the other countries where our sub-processors operate (Section 3). You can complain to us first, and then to the Office of the Australian Information Commissioner (oaic.gov.au). New Zealand: You can access and correct your personal information under the Privacy Act 2020, and we answer within 20 working days. If we collect information about you from someone else (for example, your subscription status from Apple or Google), we will make sure you know. You can complain to the Office of the Privacy Commissioner (privacy.org.nz). Malaysia: You can access your personal data (we answer within 21 days) and correct it, withdraw your consent, ask us to stop processing that is likely to cause you damage or distress, and ask us to stop using your data for direct marketing. You can complain to the Personal Data Protection Commissioner (pdp.gov.my). Singapore: You can access your personal data and ask how it has been used or disclosed in the past year, correct it, and withdraw your consent. Our data protection officer is listed in Section 15. You can complain to the Personal Data Protection Commission (pdpc.gov.sg). India: You can ask for a summary of your personal data and how we process it; have it corrected, completed, updated or erased; withdraw your consent as easily as you gave it; and nominate someone to exercise your rights if you die or cannot act. You can ask for this Policy in English or in any language listed in the Eighth Schedule to the Constitution of India. Our grievance officer (Section 15) acknowledges complaints within 48 hours and resolves them within one month. After using our grievance process, you can complain to the Data Protection Board of India. South Africa: You can access, correct and delete your personal information, object to its processing, withdraw your consent, and refuse direct marketing. You can complain to the Information Regulator (inforegulator.org.za). Philippines: You have the rights to be informed, to access, to object, to correct, to erasure or blocking, to data portability and to damages. You can complain to the National Privacy Commission (privacy.gov.ph). European Economic Area, Switzerland and the United Kingdom: ProgramU LLC is the controller of your personal data. We use it on these legal bases: to provide the Service you signed up for (contract); with your consent, for personalization and for marketing emails, and with your explicit consent, for health-related information you choose to share (you can withdraw consent at any time); for our legitimate interests in keeping the Service safe, secure and working, and in improving it; and to comply with the law. You can access, correct and delete your personal data, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. To have an account you need to give us an email address (or sign in with Apple or Google), your date of birth, and the name and identity vision you enter when you start; without them we can't provide the Service. Everything else is up to you, though some features need what you write for them (a session needs a focus, for example). We do not make decisions with legal or similarly significant effects about you based solely on automated processing, and a person can review our automated safety checks (Section 5). Your data is transferred to the United States as described in Section 11. You can complain to the data protection authority where you live or work, to the Federal Data Protection and Information Commissioner in Switzerland (edoeb.admin.ch), or to the Information Commissioner's Office in the United Kingdom (ico.org.uk). Data Breaches: If a breach of your personal information puts you at real risk of significant harm, we will tell you, and the regulators your law requires, within the time it requires.
By continuing to use ProgramU, you acknowledge that you have read and understood this Privacy Policy.