Full Privacy Policy
Privacy Policy
This Privacy Policy explains how Being Phoenix, LLC ("Being Phoenix," "we," "us," "our") collects, uses, shares, and protects information when you use the PAL app and the hellopal.app website (together, the "Services").
If you do not agree with this Privacy Policy, please do not use the Services.
1) Who this applies to
This Privacy Policy applies to users of the Services. The Services are intended for individuals 18 years and older.
2) Information we collect
We collect information in these main ways: (a) information you provide, (b) information collected automatically, (c) information from the third-party service you use to sign in, and (d) purchase and optional-integration data. Each is described below.
A. Information you provide
• Profile information you provide at onboarding: such as your birthday, pronouns, and the focus areas or interests you select. We use these to personalize your experience. (Your account name and email are received through your sign-in provider - see Section 2C.)
• User Content: content you enter into the app, including messages, reflections, journal-style entries, mood/emotion inputs, and related notes ("User Content").
• Support communications: information you provide when you contact support (e.g., emails, bug reports, screenshots you choose to send).
B. Information collected automatically
• Device and app information: device type, operating system, app version, language, time zone, and similar technical details.
• Usage data: interactions with the Services (e.g., screens viewed, feature usage, session duration), performance logs, and crash reports.
• Location: With your permission, PAL may request precise (GPS-level) location to provide location-relevant features. Providing location is optional - PAL works without it. When you do not grant location access, we infer approximate location (e.g., city/region) from your IP address for security and basic analytics.
C. Information from third-party sign-in
When you create an account using Google or Apple sign-in, we receive basic account information from that provider (your name and email address) to create and secure your account. We never receive your Google or Apple password.
If you use Apple's Sign in with Apple and choose to hide your email, we receive an Apple private-relay address instead of your personal email.
D. Purchases
PAL offers subscriptions through Apple's App Store. Apple processes all payments as in-app purchases; we never receive your full payment card details. We receive purchase-related metadata, such as subscription status, product identifier, and purchase or renewal dates, to provide and manage access to paid features.
E. Optional integrations
Apple Health data: if you choose to connect Apple Health, we receive daily summaries of certain health and activity data types as described in Section 5.
3) How we use information
We use information to:
• Provide and operate the Services (including account login, saving your entries, and delivering requested features).
• Help PAL remember what matters and connect it over time, reflecting your own inputs back to you and generating summaries and insights based on your usage.
• Personalize your experience.
• Maintain safety and security (detecting abuse, preventing unauthorized access, and protecting user accounts).
• Improve and debug the Services (analyzing performance, fixing crashes, and improving product quality).
• Communicate with you (support responses, important service updates, and administrative messages).
• Comply with legal obligations and enforce our Terms.
4) How AI processing works (and model training)
PAL uses artificial intelligence to generate responses and summaries. To do this, and only with your permission, PAL sends relevant information to a third-party AI provider: the content of your conversations and check-ins, profile details you have provided (such as your name, pronouns, birthday, and focus areas), account identifiers, and, if you connect Apple Health, daily Health summaries. We currently use OpenAI for this, solely to provide PAL's features to you, under contractual terms that require the same or equal protection of your data as described in this Privacy Policy.
PAL's patterns, trends, and insights are calculated by our own software, not by a third-party AI provider.
• Our AI provider does not use data submitted through its API to train or improve its models.
• We do not use your User Content to train AI models that are deployed to other users.
• Our AI provider may retain inputs and outputs for a limited period (up to 30 days) to monitor for and prevent abuse, after which they are deleted, unless retention is legally required.
• We may use your inputs to personalize and improve your own PAL experience.
• We may review User Content, including de-identified content with names and identifying details removed, to evaluate and improve how PAL responds for everyone. For example, refining our prompts and safety guardrails, measuring where PAL's responses fall short, and testing improvements before we ship them. This improves the Services themselves; it does not train AI models.
• We may use aggregated and anonymized usage patterns and system-level metrics to improve product performance and reliability (for example, measuring feature adoption or crash rates).
Like most software services, we may retain limited logs for security, troubleshooting, and compliance.
5) Apple Health & Apple Watch data (HealthKit)
If you choose to connect Apple Health, PAL reads certain health and activity data from your iPhone's HealthKit store, which includes data your Apple Watch or other connected devices write into HealthKit, to help surface patterns between your physical signals (such as sleep and heart-rate variability) and the emotional patterns you log in PAL.Connecting Apple Health is optional. PAL works without it, and you can disconnect at any time.
A. What we read
With your permission, PAL may read the following data types from HealthKit:
• Resting heart rate
• Heart rate variability (HRV)
• Sleep (time asleep and time in bed)
• Steps
• Active energy burned
• Mindfulness minutes
• Workouts (type, duration, energy burned)
PAL does not write any data back into Apple Health. PAL does not access Clinical Health Records.
B. How it's stored
Health data is aggregated on your device into daily summaries (for example, average HRV for a given day, or total sleep minutes for a given day) before any data is sent to our backend. We do not store raw HealthKit samples on our servers.Daily summaries are stored in our Firebase (Google Cloud) database, encrypted in transit and at rest. Consistent with Apple's HealthKit requirements, we do not store any HealthKit-sourced data in iCloud.
C. How we use it
We use Apple Health data only to:
• power PAL's pattern analysis and longitudinal insights (for example, correlations between sleep, HRV, and the emotional patterns you log in PAL);
• personalize the experience we show you in the app;
• improve service reliability through aggregated, de-identified diagnostics.
D. How we do not use it
We do not use Apple Health data for advertising or marketing, and we do not sell it. With your permission, we share daily Health summaries with our AI provider (see Section 4) solely to generate your responses and summaries. We do not share Apple Health data with any other third parties, and we do not use it to train AI models that are deployed to other users.
E. Your controls
You can revoke PAL's access to any or all Health data types at any time:
• In iOS: Settings → Privacy & Security → Health → PAL, or open the Health app → Sharing → Apps and Services → PAL.
• In PAL: Profile → Account Management → turn off Connect Apple Health.
When you disconnect, PAL will stop reading new Health data, and we will delete the daily Health summaries we have stored for you from our backend within 30 days. You may also request earlier deletion by contacting
support@hellopal.app.
6) How we share information
We do not sell your personal information.
We may share information in the following circumstances:
A. Sharing you initiate
PAL lets you export or share your own summaries (for example, with a therapist or someone you trust). This happens only when you choose it, and you control what is shared and with whom.
B. Service providers (processors)
We use third-party vendors to help operate the Services, such as:
• cloud hosting and databases,
• authentication,
• analytics and crash reporting,
• email/support tooling,
• subscription and payment management,
• AI processing provider (OpenAI; see Section 4).
These providers process information on our behalf under contractual obligations consistent with this Privacy Policy. For example, we use Firebase (Google) for authentication and database services.
C. Legal and safety
We may disclose information if we believe it is reasonably necessary to:
• comply with law, regulation, legal process, or a lawful request,
• protect the rights, safety, and security of our users, the public, or our Services,
• investigate fraud, security incidents, or violations of our Terms.
D. Business transfers
If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to appropriate safeguards.
7) Data retention
We retain personal information for as long as necessary to:
• provide the Services,
• maintain business records,
• comply with legal obligations,
• resolve disputes, and
• enforce agreements.
Retention periods vary depending on the type of data and why we collected it. Apple Health data is subject to the additional retention and deletion commitments described in Section 5.
8) Your choices and rights
Depending on where you live, you may have rights to:
• access, correct, or delete certain personal information,
• object to or restrict certain processing, and
• request information about our data practices.
Account deletion. You can delete your account and associated data in the app at
Profile → Account Management → Delete Account, or by contacting us at
support@hellopal.app. We may retain limited information where required for legal, security, or operational reasons.
For users in the European Economic Area (EEA) and United Kingdom. If you are located in the EEA or UK, the following additional terms apply.
Data controller. Being Phoenix, LLC is the controller of your personal data. See Section 13 for contact details.
Legal bases for processing. We process your personal data on these legal bases:
• Performance of a contract: to create your account, save your entries, and provide the features you request.
• Consent: for optional features such as precise location, Apple Health integration, and any marketing communications. You may withdraw consent at any time without affecting processing already carried out.
• Legitimate interests: to secure the Services, prevent abuse, and improve and debug the product, balanced against your rights and freedoms.
• Legal obligation: to comply with applicable law.
Special-category data. Some User Content you choose to share (for example, information concerning your mental or physical health) and any Apple Health data may constitute special-category data. Where we process such data, we rely on your
explicit consent, which you may withdraw at any time.
Your rights. Subject to applicable law, you have the right to: access your personal data; correct inaccurate data; delete your data ("right to erasure"); restrict or object to certain processing; data portability; and withdraw consent. To exercise any of these, contact
legal@hellopal.app.
Complaints. You have the right to lodge a complaint with your local data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).
9) Security
We use reasonable administrative, technical, and organizational measures designed to protect information. Account data and User Content are encrypted in transit (via TLS) and at rest. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
10) International transfers
If you access the Services from outside the United States, your information may be processed and stored in countries where we or our service providers operate. These countries may have different data protection laws than your country.
Where we transfer personal data from the EEA or UK to the United States or another country that has not received an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, or another lawful transfer mechanism.
11) Children
The Services are not directed to children under 18, and we do not knowingly collect personal information from children.
12) Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date above. If changes are material, we may provide additional notice.
13) Contact us
Being Phoenix, LLC has designated a Data Protection Officer responsible for overseeing compliance with this Policy and with applicable data protection laws, including Singapore's Personal Data Protection Act 2012 and Bermuda's Personal Information Protection Act 2016.
You may contact our Data Protection Officer to access or correct your personal data, withdraw consent, request deletion, or raise a privacy complaint:
• Email:
legal@hellopal.app (privacy/legal)
• Mail: Being Phoenix, LLC; 418 Broadway, Ste N, Albany, NY 12207, USA
For product support:
support@hellopal.app (support)
Data controller: Being Phoenix, LLC (address above).
.svg)
