Your privacy matters to us. This Privacy Policy explains what data ProgramU collects, how we use it, who we share it with, and the rights you have over your information. ProgramU is operated by ProgramU LLC, a Wyoming limited liability company. If you have questions, reach out at privacy@programu.app.
1. Who This Policy Applies To
This policy covers anyone who uses the ProgramU app or website. ProgramU is currently available to U.S. residents only.
This Privacy Policy applies to all users of the ProgramU mobile application (available on iOS and Android) and the ProgramU website at programu.app. It applies whether you're a current subscriber, a free-tier user, a trial user, or just browsing our website.
ProgramU is currently available to residents of the United States only. International expansion is on our roadmap, but at this time we do not knowingly serve users outside the United States.
ProgramU is intended for adults 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with their information, please contact privacy@programu.app and we will delete it promptly.
2. Information We Collect
We collect what you give us (account info, your intake answers, your journal entries), what the app needs to function (session history, subscription status), and minimal technical info like your app version. We do not collect your location, advertising ID, or device fingerprint.
Account Data
When you create an account, we collect:
- Your email address
- Your display name
- Your profile photo (if you choose to add one)
- Your date of birth (used for age verification only)
Identity and Intake Data
ProgramU is designed around your personal identity vision. To personalize your experience, we collect:
- FutureU intake responses: your description of the life you want, your identity vision, patterns you want to release, ways you want to feel, topics you want excluded, and the name of your future self.
- BeingU 90-day program inputs: your desire, vision, focus, and pattern for the program.
Journal and Reflection Data
If you use our journaling features, we store:
- Daily Identity Check-Ins
- 7PM Lock-In entries
- Living Proof wins you log
- BeingU journal entries
- Long-form program reflections
- Sleep practice records
CollectiveU Participation Data
If you join a CollectiveU group session, we store the intention or word you submit, associated with your account. Aggregate live participant counts are stored without user identifiers. Your CollectiveU intentions are deleted when you delete your account.
Voice Recordings (Optional)
If you opt into our Voice Clone feature, we collect:
- Your voice recordings (used to create a personalized synthesized voice)
- The resulting voice model ID
See Section 4 for details on how we handle biometric voice data.
Usage Data
To keep your library in sync and improve the app, we collect:
- Listening history and play counts
- Generated session metadata (type, focus, creation date, duration)
- In-app preferences (notification settings, default voices, playback options)
- Progress through the 90-day BeingU program
Device Information
ProgramU LLC collects:
- App version (e.g., 1.0.0)
- Operating system platform (iOS or Android)
These are recorded at consent time for audit purposes. We do not collect: device model, IP address, advertising identifiers, precise location, or device fingerprinting data.
Subscription and Payment Information
When you purchase a subscription, Apple or Google processes your payment. ProgramU LLC never receives or stores your credit card, debit card, or bank information. We receive only your subscription status and entitlements, via RevenueCat (see Section 3).
3. Third-Party Services (Sub-Processors)
ProgramU uses other trusted services to do specific jobs — like generating audio, sending emails, or catching crashes. Each one only gets the minimum data it needs to do its job. We don't sell your data to any of them.
ProgramU integrates with the following third-party services. Each receives only the minimum data necessary to perform its function, and none of them receive combined data across our entire user base about you.
| Service | Purpose | What We Send Them |
|---|---|---|
| Anthropic Claude | Generates your AI session scripts | Your FutureU intake context and the session topic you request — nothing else |
| Inworld AI | Converts generated scripts into voice audio; creates voice clones when you opt in | The text of your generated script; your voice recording (if using Voice Clone) |
| Google Firebase | Authentication, database, file storage, cloud functions | Your account data, journal entries, and app data (encrypted) |
| Cloudflare R2 | Stores your generated audio files | Your generated session MP3 files (encrypted) |
| RevenueCat | Manages your subscription and in-app purchases | Your user ID, subscription status, purchase history |
| Resend | Sends transactional emails (account deletion confirmations, etc.) | Your email address and the content of the email |
| Sentry | Catches and diagnoses app crashes and errors | Your user ID and scrubbed error traces. Personal content (journal entries, intake answers, session focus, voice data) is filtered before transmission. |
| Expo | Handles local push notifications scheduled on your device | Nothing leaves your device — all notifications are scheduled locally |
| Apple App Store / Google Play | Processes in-app purchases | Handled per their respective terms; we see only the entitlement result via RevenueCat |
What We Explicitly Do Not Send to Sub-Processors
When ProgramU generates your sessions, we're deliberate about what leaves your device. Anthropic, Inworld, and Sentry never receive:
- Your email address
- Your name or display name
- Your device identifiers
- Your payment information
- Your session library history (only the current session's focus)
- Your Firestore record IDs
4. Biometric and Sensitive Data
If you use Voice Clone, your voice recordings are biometric data. We treat this as the most sensitive type of data we handle. You give explicit, informed consent before any recording, you can withdraw consent and delete it any time, and we don't share it with anyone except the processing service that creates your voice model.
ProgramU offers an optional Voice Clone feature that records and processes your voice to create a personalized text-to-speech voice for your sessions. We treat your voice as biometric data subject to heightened protection.
How We Handle Voice Data
- Voice recordings are used solely to create your personalized voice model — for no other purpose
- Voice recordings are stored securely in Firebase Storage with AES-256 encryption at rest
- Voice recordings are transmitted to Inworld AI (our voice synthesis provider) to create your voice model
- We do not sell, share, or use your voice data for any purpose other than generating your personal audio sessions
- We do not use your voice data to train AI models — neither ours nor any third party's
- We do not retain raw voice recordings after your voice model is generated; only the trained voice model and a reference clip are kept
Your Biometric Consent
Voice Clone is strictly opt-in. Before any recording occurs, ProgramU presents a dedicated biometric consent screen that provides:
- Explicit, informed, unambiguous consent. You must affirmatively agree before we record any voice data. We do not infer consent from continued app usage, default-on settings, or pre-checked boxes.
- Specific purpose disclosure. We tell you exactly what your voice will be used for: generating your personalized session audio.
- Retention disclosure. We tell you how long we will keep your voice data and what triggers its deletion.
- Right to withdraw. You can withdraw consent at any time by deleting your voice clone.
- Risk disclosure. We disclose that synthetic voice generation has inherent risks, including the theoretical possibility of misuse if your voice model were compromised. We mitigate these risks through encryption, access controls, and our agreement with Inworld AI prohibiting any use beyond your sessions.
Your consent is recorded in your account with a timestamp, the consent version, and the specific text shown to you. This record is preserved for audit purposes.
Revoking Consent and Deleting Voice Data
You can revoke your biometric consent and delete your voice clone at any time:
- In the app: Profile → Privacy & Security → Manage Voice Clone → Delete
- Via account deletion: Deleting your account will also delete your voice model from Inworld AI and all voice recordings from our servers
- By email: Send a deletion request to privacy@programu.app
When you revoke consent, we delete your voice recordings from Firebase Storage, your trained voice model from Inworld AI, the reference clip used to maintain voice consistency, and all voice clone metadata in your account. Revocation is permanent. If you later wish to use Voice Clone again, you would need to provide new consent and re-record.
5. How AI Data Processing Works
When you generate a session, your intake answers and session topic go to Anthropic's Claude model to create a personalized script. That script goes to Inworld to be converted into audio. The AI providers don't train on your data and don't keep it after the request.
When you generate a session, here's what happens:
- Your session topic and relevant intake context leave your device and are sent to Anthropic Claude for script generation.
- Anthropic does not train on ProgramU user data — we have not opted into training usage.
- The generated script is sent to Inworld AI for voice synthesis.
- The final MP3 audio is uploaded to Cloudflare R2 and linked to your account.
AI-generated content can contain errors or imperfections. ProgramU filters block obvious safety issues, but AI is not perfect. Use your own judgment when applying any session to your life.
6. How We Use Your Information
We use your information to:
- Provide the core ProgramU service (generate your sessions, sync your library, deliver your subscription)
- Personalize your experience (tailor session content to your identity vision)
- Process payments (via Apple, Google, and RevenueCat)
- Send transactional emails (account verification, account deletion confirmation, etc.)
- Catch and diagnose errors (via Sentry)
- Comply with legal obligations
- Detect and prevent fraud or abuse of the service
We do not use your information to:
- Show you ads or sell ad space
- Train AI models
- Sell, rent, or trade your personal data to anyone
- Build profiles of you for advertising
- Track you across apps or websites
7. Data Security
Your data is encrypted in transit and at rest, using industry-standard security (TLS and AES-256). Only you can access your account data through normal use.
Your data is stored using Google Firebase and Cloudflare R2, both of which employ industry-standard security practices, including:
- TLS encryption for all data transmitted between your device and our servers
- AES-256 encryption for data stored at rest
- Firebase Security Rules that restrict access to authenticated users and authorized system processes
We minimize logging of personal content and scrub sensitive data from error reports before they leave your device.
No system is perfectly secure, and we cannot guarantee absolute security. But we apply modern best practices, and we continuously work to improve our safeguards.
8. Your Rights
You control your data. You can view it, update it, download it, or permanently delete everything. Account deletion is permanent and happens within 24 hours (and always within 30 days).
Access and Correction
- Update your profile information at any time within the app
- Request a copy of your personal data by emailing data@programu.app
Deletion
You can permanently delete your account and all associated data at any time:
- In the app: Profile → Privacy & Security → Delete Account
- By email: privacy@programu.app
Account deletion permanently wipes:
- All journal entries, intake responses, and session history
- Your voice clone model (deleted from Inworld AI)
- Your generated audio files on Cloudflare R2
- Your RevenueCat subscriber record
- Your Firebase Auth account
- Your user root document and all subcollections
Most deletion processes complete within 24 hours. In rare cases involving third-party retention policies, full deletion may take up to 30 days.
Data Portability
Upon request to data@programu.app, we will provide a copy of your personal data in a portable, machine-readable format.
Right to Object
You have the right to object to certain processing activities. To exercise this right, contact privacy@programu.app.
9. Data Retention
We keep your data for as long as your account is active. When you delete your account, we delete your data. There are a few minor exceptions noted below, all outside ProgramU's direct control.
How Long We Keep Your Data
Your data is retained for as long as your account remains active. We do not have automatic scheduled deletion of inactive accounts — your data remains accessible to you until you delete your account or contact us to do so.
What Gets Deleted When You Delete Your Account
- Firebase Auth account → deleted
- Firestore user document and all subcollections → deleted
- Firebase Storage files under your user path → deleted
- Cloudflare R2 generated audio files → deleted
- Inworld AI voice model → deleted
- RevenueCat subscriber record → deleted
What Is Retained After Deletion (and Why)
A small amount of data may persist after deletion, outside ProgramU's direct control:
- RevenueCat historical purchase records: Retained by RevenueCat per payment processor compliance requirements (tax, audit).
- Firebase Cloud Functions logs: Server-side operational logs retained per Google Cloud's default log retention, not user-accessible.
- Firestore automatic backups: Managed by Google Cloud with typical retention of approximately 35 days.
None of this retained data is used to contact you or re-identify you after deletion.
10. Children's Privacy
ProgramU is for adults 18 and older. We don't knowingly collect data from anyone younger.
ProgramU is intended for adults 18 years of age and older. We verify age at onboarding via a date-of-birth gate.
ProgramU LLC does not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal data from a person under 18, we will delete that information immediately.
If you are a parent or guardian who believes we have collected data from a minor, please contact privacy@programu.app and we will remove it promptly.
11. Geographic Availability
ProgramU is available to U.S. residents only at this time. We're working toward international expansion, but it's not available yet.
ProgramU LLC is organized in the State of Wyoming, United States. ProgramU is currently available only to residents of the United States. Our servers and sub-processors are based in the United States, and our crisis resources, customer support, and legal protections are designed for U.S. users.
We do not knowingly serve users outside the United States. The App Store and Google Play listings restrict ProgramU's availability to the U.S. region. If you access ProgramU from outside the United States, your access may be restricted, and we cannot guarantee compliance with the privacy laws of your country.
International expansion to additional countries is on our future roadmap. When we expand to a new region, we will update this Privacy Policy to address the privacy laws of that region (such as the European Union's General Data Protection Regulation, the United Kingdom's UK GDPR, or Canada's PIPEDA). Until then, our compliance and disclosures focus on U.S. federal and state privacy law.
If you are outside the United States and would like to be notified when ProgramU becomes available in your region, you can subscribe to updates at programu.app.
12. California and Other State Residents
If you live in California, Virginia, Colorado, Connecticut, Utah, or any other U.S. state with a comprehensive privacy law, you have additional rights. You can exercise them by emailing privacy@programu.app.
Residents of certain U.S. states have additional rights under applicable privacy laws, including:
- The right to know what personal information we collect
- The right to delete personal information
- The right to correct inaccurate personal information
- The right to opt out of the sale or sharing of personal information (ProgramU does not sell or share personal information)
- The right to limit the use of sensitive personal information
- The right to non-discrimination for exercising your privacy rights
To exercise any of these rights, email privacy@programu.app with your request. We will respond within the timeframe required by applicable law (typically 45 days).
ProgramU LLC does not sell or share personal information for cross-context behavioral advertising.
13. Changes to This Policy
If we make material changes to this policy, we'll notify you in the app and require you to agree to the updated version before continuing.
ProgramU LLC may revise this Privacy Policy from time to time. When we make material changes, we will:
- Post the updated policy on programu.app/privacy-policy.html with a new "Last Updated" date
- Notify you within the app
- Require you to review and accept the updated policy before continuing to use ProgramU
For minor changes (such as typo fixes or formatting updates), we may update the policy without requiring re-acceptance. The current version of this policy is always the version posted at programu.app/privacy-policy.html.
14. Contact Us
For privacy questions, data requests, or to exercise your rights under this policy:
- Privacy questions: privacy@programu.app
- Data requests: data@programu.app
- Safety concerns: safety@programu.app
- General support: support@programu.app
Mailing address:
ProgramU LLC
30 N Gould St Ste N
Sheridan, WY 82801
United States
By using ProgramU, you acknowledge that you have read and understood this Privacy Policy.
— The ProgramU Team