Privacy & data

Account, preferences, lesson progress, mood and water check-ins you log, and audit records of high-value actions. We do not collect raw AI prompts or Field Lab notes — those stay on your device.

We personalise the academy, prevent abuse, and improve content. We never sell your data. We use anonymous, aggregated analytics when enabled (PostHog) and respect Do-Not-Track.

Your account and progress are stored in EU-region Supabase Postgres. Server logs and error reports use EU-region Sentry. Field Lab notes, streaks, and XP are device-local.

OpenAI processes AI prompts in real time (we scrub PII first). Sentry handles error tracking. Resend handles email. PostHog handles optional analytics. Upstash handles rate-limit counters. Each is contractually bound by a data-processing agreement.

You can access, port, correct, or delete your data at any time. Use the buttons above. We respond to requests within 30 days. You can also lodge a complaint with your local data-protection authority.

Some processors operate globally (e.g. OpenAI). Where data leaves the EEA we rely on Standard Contractual Clauses. You can use the academy without enabling AI features.

When you click Delete, we immediately scrub identifying fields (email, name, phone). After 30 days, all rows tied to your account are permanently removed. Pseudonymised statistics may persist for population health research.

Email dpo@redi.healthcare with any questions or formal requests. We acknowledge within 72 hours and resolve within 30 days, as required by GDPR.