Privacy Policy

This policy applies to visitors of the website, people who take the quiz or buy a plan, and people who use the iOS app. If you only browse, we still receive limited technical data described below. If you create an account or subscribe, we also keep the account and billing information described below.

• Account. Email address, the first name you choose to show in the app, and sign-in material such as an access code or a magic link. We use these to create your account, restore access, and send receipts or sign-in messages.
• Quiz and plan. Answers you give in the web or in-app quiz (for example how you like to practice, how much time you have, and what you want help with), the plan profile those answers produce, and the sanctuary plan we generate from them. Before you have an account, quiz answers may sit in your browser. Once you continue, we store them with your email so we can rebuild the plan.
• Practice. A log of sessions you complete: session identifier, duration, source (such as home, library, builder, plan, or a first demo), and completion time. Custom flows you build (name and the poses or practices you picked) are stored on your account.
• Support. Whatever you send to hello@pabuflow.com, including the email address you write from and the contents of the message.

Quiz answers are self-reported wellness preferences. They are not a medical record, and we do not ask for diagnoses, medications, or insurance information.

• Subscription status. Whether a web plan (Stripe) or an App Store plan (Apple, via RevenueCat) is active, which product you bought, and renewal or cancellation state. We do not store your full card number. Stripe and Apple process the payment credentials.
• Product analytics. Pages and screens you open, funnel steps (such as starting checkout), and errors in the website and the iOS app. Both run through PostHog. We do not put your raw email address in event properties. If we need a stable analytics id, we use a hash of the email.
• Site performance. Vercel Analytics and Vercel Speed Insights record aggregated traffic and performance measures for the website.
• Advertising measurement. If you reach us from an ad, or when a purchase or lead is attributed to an ad, we may send Meta a conversion event through the Meta Pixel and the Conversions API. That event can include a hashed email, Meta click or browser identifiers, IP address, user agent, and the page URL. Quiz answers are not sent to Meta and are not used to build an ad audience.

Some settings never need to leave the phone: saved favorites, appearance (light or dark), practice-reminder time, and your chosen soundscape. Reminders are scheduled locally. Deleting the app removes this on-device data; deleting your account removes the server copy of your plan and history.

• Create, save, and restore your sanctuary plan and practice history
• Authenticate you and deliver access codes or sign-in links
• Process subscriptions, receipts, and billing-portal access
• Show the correct entitlement in the app after a web or App Store purchase
• Send service messages you asked for, such as a reminder email about how to cancel
• Measure whether the quiz, paywall, and app are working, and fix failures
• Attribute purchases to ads when advertising is turned on
• Respond to support requests and enforce our terms
• Meet tax, accounting, and other legal duties

We do not use your practice log or quiz answers to sell advertising inside the app. The app does not show third-party ads.

We share information with companies that process it for us, and only for the reasons above. They are not allowed to use it for their own independent marketing.

• Supabase — authentication and the database for profiles, quiz responses, plans, practice history, custom flows, and access codes.
• Stripe — web checkout, invoices, and the customer billing portal.
• Apple — App Store purchases, subscription management, and the iOS app itself.
• RevenueCat — subscription entitlements so the app knows whether a web or App Store plan is active.
• PostHog — product analytics and error reports. Hosted in the United States.
• Meta — ad measurement (Pixel and Conversions API) when those tools are enabled.
• Vercel — hosting for the website, plus Vercel Analytics and Speed Insights.

We may also disclose information if the law requires it, if we need to protect the rights and safety of our users or the public, or as part of a merger or sale of the business. If ownership of Pabu Flow changes, this policy still describes the data that moves with it, and we will update the policy if the new owner’s practices differ.

The website uses a small set of cookies and local storage:

• A PostHog cookie to recognize a browser for analytics
• Meta cookies (such as _fbp and _fbc) when the Meta Pixel is loaded, used to measure ads
• Browser storage for an in-progress quiz, so refreshing the page does not wipe your answers
• An occasional first-party cookie we set so internal testing does not count as a real ad conversion

You can block or delete cookies in your browser. The site still works, but analytics and saved quiz progress may reset. The iOS app does not use browser cookies. Apple’s App Tracking Transparency setting controls whether the app may ask to track you across other companies’ apps and sites.

Account data, quiz responses, plans, practice history, and custom flows stay until you delete your account or ask us to delete them. Access codes expire on their own. Analytics and ad-measurement records are kept only as long as we need them to operate and improve the Service, then deleted or aggregated.

Stripe and Apple keep billing records for their own legal, tax, and fraud obligations after you delete a Pabu Flow account. We cannot erase a charge from their systems. Cancel an App Store subscription in your Apple ID settings; deleting the account does not cancel it.

• Delete your account in the app under Settings → Delete account. That removes the auth user and the rows tied to it: profile, quiz responses, plan, practice log, custom flows, and access codes.
• Ask us to access, correct, or delete personal information by emailing hello@pabuflow.com from the address on the account. We may need to confirm it is you.
• Turn off reminders in Settings, and control sound, favorites, and appearance on the device.
• California residents. You can request to know, delete, and correct personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising except the ad-measurement events described above. You will not be discriminated against for exercising these rights.
• EEA, UK, and Switzerland. Where those laws apply, we process account and purchase data to perform our contract with you, process security and product measurement on the basis of legitimate interests, and process ads measurement where we have a lawful basis to do so. You may object, restrict, or lodge a complaint with your local authority. To exercise a right, email us.

Pabu Flow is not directed to children under 16, and you must be at least 18 to buy a subscription. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, email hello@pabuflow.com and we will delete it.

Account data is stored with access controls so people can read their own rows, and traffic to the site and the API uses encryption in transit. No method of storage or transmission is perfectly secure. Please keep your access code and email account private. If you believe your account was accessed by someone else, write to us.

We are based in the United States. Our processors may store and process information in the United States and in other countries where they operate. Those countries may not offer the same privacy protections as the one where you live. We use this data as described in this policy when you use the Service.

If we change this policy, we will update the date at the top. If a change materially affects how we use information we already hold, we will provide a clearer notice, such as an email or an in-app note, when we are required to or when it is reasonable to do so.

Hanna Solutions LLC
Pabu Flow
hello@pabuflow.com

Terms of Service