Legal / Privacy
Privacy Policy
How we handle your data, in plain language.
The short version
- Your reflections and check-ins are private. We do not read them, analyse them individually, or share them.
- Co-regulation sessions are never recorded.
- We collect the minimum needed to run Attuned, we never sell data, and we show no ads.
- You can see, export and delete everything, in the app, at any time.
- We only access private content if you report a safety concern or the law requires it.
1. Who we are
Attuned is operated by Attuned UG (haftungsbeschränkt), registered at c/o The Delta Campus, Donaustraße 44, 12043 Berlin, Germany (Amtsgericht Charlottenburg, HRB 286249 B) ("we"). We are the data controller. Contact: rebecca@attuned.world.
2. What we collect and why
| Data | What it includes | Why | Legal basis |
|---|---|---|---|
| Account | Sign in with Apple identifier or email, password hash, age confirmation (18+) | Creating and securing your account | Contract (Art. 6(1)(b)) |
| Check-in states | Your nervous system state entries, stored against a pseudonymous internal ID | Showing you your own states and running your sessions | Explicit consent (Art. 9(2)(a)) |
| Reflections | Voice notes, text notes and diary entries you choose to record | Private to you. Stored so you can revisit them | Explicit consent (Art. 9(2)(a)) |
| Session data | Which self-regulation sessions you play; co-regulation request and session metadata (time, duration, who matched; never content) | Operating the service, matching you with an Anchor, safety | Contract; legitimate interests (safety) |
| Safety reports | Reports you file or that are filed about a session you were in | Investigating and acting on safety concerns | Legitimate interests (safety); legal obligation where applicable |
| Device & diagnostics | Device model, OS version, crash logs | Keeping the app working | Legitimate interests |
| Usage analytics | Aggregated, first-party event counts. Configured so we cannot see any named person's activity | Understanding what to improve | Consent (you can decline in onboarding) |
We ask for your explicit consent to process wellbeing data (check-ins and reflections) during onboarding, separately from accepting the Terms. You can withdraw it at any time in Settings; the app then stops recording this data and you can delete what exists.
3. What we never do
- No advertising, no ad SDKs, no sale or rental of your data, ever.
- No individual-level analysis of reflections or states. Insights we look at are aggregated and cannot single you out.
- No recording of co-regulation sessions. Video is transmitted in real time and is not stored.
- No access to your private content by staff, except in two cases: you report a safety concern relating to it, or we are legally required. Any such access is logged.
4. Who helps us run Attuned
We use two infrastructure providers, both bound by data processing agreements:
- Google Firebase (authentication, database, storage), pinned to EU data centre regions.
- Daily.co (real-time video transport for co-regulation sessions). Session media is transmitted, not stored.
Where any processing involves transfer outside the EU/EEA, it is protected by an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or standard contractual clauses.
5. How long we keep things
| Data | Kept until |
|---|---|
| Reflections and check-ins | You delete them, or you delete your account |
| Co-regulation session metadata | 90 days, then deleted |
| Safety reports and outcomes | 12 months after closure |
| Account data | Account deletion, then removed from live systems within 30 days and from backups within 35 days |
| Consent records | 6 years after account closure (to evidence compliance) |
| Aggregated statistics | Indefinitely (they contain no personal data) |
6. Your rights
You can: access and export your data (in-app export); correct it; delete individual items or your whole account (in-app, immediate); withdraw consent at any time; object to or restrict processing; and complain to a supervisory authority. Our lead authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin, Germany); you may also complain to your local authority. We respond to requests within one month.
7. Age
Attuned is for adults. You must be 18 or older to use it. We do not knowingly process children's data; if we learn an account belongs to someone under 18 we will delete it.
8. Security
Data is encrypted in transit and at rest. Wellbeing data is stored against a pseudonymous identifier, separate from your account identity. Access within the company follows least privilege and is logged. We will notify you and the supervisory authority of any breach as the GDPR requires.
9. Changes
If we change this policy in a way that matters, we will tell you in the app before the change takes effect and ask for fresh consent where the law requires it. Version 1.0, 9 September 2026.
Attuned is a wellbeing tool. It is not therapy, medical care, or a crisis service, and it does not diagnose or treat any condition. Attuned supports moments of calm and regulation; it is not a substitute for professional care. If you are struggling, please speak to a doctor or mental health professional. In an emergency, call 112.
← Back to attuned.world