Legal

Privacy Policy

Effective: 11 February 2025 | Last updated: 23 September 2026

Actulyze is designed around personal reflection, so privacy matters.

This policy explains how Actulyze Pty Ltd collects, uses, discloses, stores and protects personal information when you use the Actulyze website, mobile app, subscriptions, support services and communications, together called the Service.

Actulyze Pty Ltd (ABN 79 690 780 799), based in Melbourne, Victoria, Australia, is responsible for the personal information described in this policy. You can contact us about privacy at support@actulyze.com.

In this policy, 'personal information' includes information that identifies you or can reasonably be linked to you. 'Sensitive information' and 'consumer health data' include information about your physical, mental or emotional wellbeing where applicable law treats it that way.

We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where applicable, we also comply with privacy laws in the United States and New Zealand.

We collect account and contact information such as your display name, email address, login method, age or eligibility confirmation, optional postcode, account type, account settings, communication preferences and subscription status. If you use Actulyze as a guest, we may assign an anonymous account identifier so your activity can be saved and later transferred if you register.

We collect information you choose to enter or create in the app. This may include emotional check-ins; emotion or mood labels; intensity, energy or stress ratings; body-map selections; journal entries, voice recordings, notes and guided reflections; and ratings or tags connected with them.

We collect responses to onboarding, emotional regulation, self-parenting and self-expression assessments. The Service may generate scores, summaries, profiles, results, progress views or practice suggestions from those responses.

We collect activity and progress information such as practices, exercises or games selected and completed; session type, duration and completion; learning enrolment and progress; goals and habits; saved content; streaks; experience points; achievements and badges; and feedback or support messages.

We collect technical and usage information needed to operate, understand and protect the Service. This may include your IP address, device and browser type, operating system, app version, language, platform-provided device or app identifiers, notification token and preferences, pages or features used, interaction events, crash information, diagnostics and security events. We process permitted device and app identifiers for security, fraud and trial-abuse prevention.

If you make a purchase, we collect transaction information such as your plan, subscription status and app-store transaction or receipt identifiers. Payments made through Apple, Google or another payment provider are processed by that provider. Actulyze does not receive or store your full payment-card number or bank account details.

We collect messages and information you send when you contact support, join a launch or marketing list, respond to a survey or otherwise communicate with us. On our website, we may use cookies or similar technologies for essential functions, preferences, security and limited analytics.

We collect information directly from you when you create an account, complete a check-in or assessment, write or record a journal entry, choose a practice, save content, contact us or change a setting. Some technical and usage information is collected automatically from the app, website or device.

If you choose Google sign-in, Google may provide the name, email address and profile image you authorise. If you choose Sign in with Apple, Apple may provide your name and email address, including an Apple private relay address if you hide your email. We do not receive your password from Google or Apple.

We may receive limited subscription or transaction status from an app store or subscription platform. We do not obtain consumer health data from data brokers.

Guest accounts use an anonymous identifier and may store information locally on your device and synchronise it with our systems. If you later register, your guest activity may be transferred to the registered account. Data stored only on your device may be lost if you delete the app before registering or using the in-app deletion control.

With your permission, the app may write the start time, end time and duration of completed mindfulness sessions to Apple HealthKit or Google Health Connect. Actulyze does not read health information from those services.

HealthKit and Health Connect information is not used for advertising, marketing or data mining; sold to third parties; or used for purposes unrelated to health and fitness. We do not store HealthKit health information in iCloud. Information written to a connected health platform is also governed by that platform's privacy terms. You can revoke write permission in the relevant health app. Revoking permission stops future writes but does not remove entries already saved there.

If you choose voice journalling, your device asks for microphone permission before recording and displays a recording indicator while the microphone is active.

We use personal information to create and manage your account; provide check-ins, journalling, assessments, emotional-regulation practices, mindfulness exercises, learning content and other features you request; personalise the Service; synchronise information across devices; save and display activity and progress; administer purchases; respond to support requests; send service, security and account messages; deliver notifications you choose; maintain, troubleshoot and improve the Service; prevent misuse; comply with law; and establish or defend legal claims.

Actulyze uses rule-based processes to calculate assessment scores, generate progress views and suggest practices or content. These outputs are informational and do not make decisions about employment, credit, insurance, healthcare access or another legal right or benefit.

We may use de-identified or aggregated information to understand how the Service performs and improve it. We do not attempt to re-identify information that we have de-identified.

Your check-ins, feelings, moods, wellbeing responses, assessment answers, selected practices, journals, voice recordings and free-text entries may reveal information about your physical or psychological health. We treat this as sensitive health information. We collect it only where reasonably necessary to provide Actulyze and with your consent, unless the law permits otherwise.

Where consent is required, we ask for a clear affirmative choice at or before collection. Consent to sensitive or consumer health data practices is not bundled into acceptance of our Terms. You may withdraw consent for future collection or use, although features that depend on that information may then stop working.

We do not use the content of your wellbeing activity for targeted advertising or marketing profiles. We do not sell personal information or consumer health data, disclose consumer health data to data brokers, advertisers, employers or insurers, or share personal information for cross-context behavioural advertising.

We do not use personal information to train third-party artificial-intelligence models or send wellbeing content to a third-party AI system without your express consent.

We disclose information only where reasonably necessary for the purposes described in this policy.

We use Supabase for cloud database services, authentication and data synchronisation. Synced account and app information may be stored in Supabase's Sydney, Australia region.

We use Sentry to identify errors and crashes. Sentry may receive a pseudonymous user identifier, device type, operating system, app version, error stack traces and navigation breadcrumbs. We configure error reporting to exclude email addresses and other directly identifying information and to sanitise usernames before transmission.

We use Firebase Cloud Messaging to deliver notifications you choose to receive. Firebase may process a notification token and limited device information for that purpose.

Google and Apple process information when you choose their sign-in services. Apple, Google or another app store or payment provider may process limited account, transaction and receipt information when it handles a purchase. Those organisations also process information under their own privacy policies.

We may use contracted providers for hosting, security, app operations, email, customer support, crash reporting and, if you make a purchase, subscriptions and payments. They may access only the information reasonably required for their role, must act on our instructions and must protect it under contractual and legal obligations.

We may disclose information to professional advisers, auditors, insurers or authorities where reasonably necessary or required or authorised by law. If Actulyze is involved in a proposed sale, merger, financing or reorganisation, information may be disclosed subject to appropriate confidentiality and privacy protections.

This section applies to consumer health data covered by United States state laws, including the Washington My Health My Data Act and Nevada's consumer health data law.

The consumer health data we may collect includes information you provide about moods, emotions and wellbeing; responses to check-ins, prompts and assessments; journals, notes or recordings; practices selected or completed; progress and saved activity; support messages containing wellbeing information; and profiles, results or inferences generated from those interactions.

We collect this information directly from you and from your interactions with the Service. We use it to provide the features you request, personalise your experience, display your activity and progress, support and secure your account, troubleshoot the Service and meet legal obligations.

Depending on the feature used, we may disclose an account identifier and the wellbeing content needed to store, process or deliver that feature to cloud hosting, storage, app-functionality, authentication, security or support providers. Diagnostics providers receive technical performance information and are not intended to receive the content of your check-ins. We do not currently disclose consumer health data to a separate Actulyze affiliate.

We do not sell consumer health data. If that practice ever changed, we would first provide the notice, consent and separate authorisation required by law. We obtain consent before collecting or sharing consumer health data where required, unless the processing is necessary to provide a product or service you specifically request. Where separate consent for sharing is required, it will not be bundled with consent to collect.

You may ask whether we hold your consumer health data, access it, obtain a list of third parties or affiliates that received it, withdraw consent for future collection or sharing, correct it where applicable, or ask us to delete it. Send a request to support@actulyze.com or use the privacy and account controls provided in the app.

We will respond within the period required by law. For requests under Washington law, this is generally no later than 45 days, with one permitted 45-day extension where reasonably necessary and explained to you. If we deny a request, we will explain why and how to appeal. You may appeal by replying to our decision with the word 'Appeal'.

When a valid deletion request covers consumer health data, we will notify relevant processors, service providers and other recipients as required. Data in backups or archives will be deleted within the period required by law, including within six months where Washington law applies.

We will not discriminate against you for exercising a privacy right. We do not use geofencing around healthcare facilities to identify or track people, collect consumer health data or send health-related messages or advertising.

The mobile app does not use web cookies. Our website may use essential cookies and similar technologies to operate, remember settings, prevent fraud and maintain security. We may also use limited analytics to understand whether the website and app function correctly and which features are used. Where consent is required, optional technologies will not be activated until you choose to allow them.

We do not use analytics or error-reporting services for advertising. We do not permit advertising partners or data brokers to collect personally identifiable information through Actulyze over time and across unaffiliated websites or services.

Some browsers send a 'Do Not Track' signal. Because there is no consistent industry standard, the website does not currently respond to Do Not Track signals. Where required, we recognise legally valid opt-out preference signals, including Global Privacy Control. Because Actulyze does not sell personal information or share it for cross-context behavioural advertising, an opt-out signal should not change those current practices.

We may send messages needed to provide the Service, such as account, subscription, security, privacy and important product notices. These are service communications and may continue even if you opt out of marketing.

We send promotional email or messages only where permitted by law. You can unsubscribe using the link in a message or by contacting us. We do not use the content of your wellbeing activity to target marketing.

If you opt in to push notifications, they may include check-in reminders, achievement or streak updates and report summaries. You can change notification preferences in the app or in your device settings at any time.

We keep account and wellbeing information while your account is active and for as long as reasonably needed to provide the Service. Support communications are kept while needed to resolve your request and maintain an appropriate service record. Technical and security logs are kept only while needed for troubleshooting, fraud prevention and security. Subscription, transaction, tax and accounting records are kept for the period required by law.

Crash and error reports held in Sentry are retained for up to 90 days. Security and anti-abuse identifiers are retained only while reasonably needed for those purposes. Server-side information linked to an unused guest identifier is retained only for a limited period before deletion.

You can initiate deletion through Settings > Privacy & Data > Delete Account or contact support@actulyze.com. Deleting the app from your device does not delete your account or server-side information. If you use a guest account, use the in-app deletion control before uninstalling if you want server-side guest information deleted.

Deleting your account does not automatically cancel an App Store or Google Play subscription. A subscription must be cancelled through the store through which it was purchased.

Following a valid deletion request, we delete or de-identify information in active systems without undue delay, subject to lawful exceptions. Residual copies in protected backups are removed through our normal backup cycle and within any legally required period, including within six months where Washington law applies. We may retain records that the law requires us to keep. We may retain de-identified information that can no longer reasonably identify you.

Withdrawing consent stops future processing based on that consent but does not affect processing that was lawful before withdrawal.

We use reasonable technical, organisational and administrative measures designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures include encrypted connections, encryption at rest, database access rules designed to restrict users to their own information, restricted administrative access, rate limiting and controls designed to remove directly identifying information from crash reports. Information may be stored locally on your device and synchronised with our cloud systems.

No electronic service can be guaranteed completely secure. If a privacy or security incident occurs, we will investigate it and notify affected people and regulators where required, including under Australia's Notifiable Data Breaches scheme, applicable United States breach laws and the FTC Health Breach Notification Rule where it applies.

Actulyze is based in Australia and its primary database is hosted in Sydney, Australia. Some service providers may store or process limited information outside Australia, including in the United States or European Union.

Before disclosing personal information to an overseas provider, we take reasonable steps appropriate to the circumstances to require lawful handling, security, restricted use, retention and deletion. Overseas privacy laws may differ from Australian law. You may contact support@actulyze.com for current information about the countries in which our providers process personal information.

Depending on where you live, you may have the right to access personal information, correct inaccurate information, delete information, withdraw consent, obtain a portable copy, know the categories and sources of information collected, know the purposes and recipient categories, opt out of sale, targeted advertising or certain profiling, limit certain uses of sensitive information, and appeal a denied request.

Actulyze does not sell personal information or share it for cross-context behavioural advertising.

You can update some information through your account. Where available, you can export information through Settings > Privacy & Data > Export My Data in JSON or CSV format and manage optional analytics or crash reporting through the app's privacy settings. Other requests may be sent to support@actulyze.com.

We may take reasonable steps to verify your identity before completing a request. An authorised agent may submit a request where permitted by law, subject to verification of their authority.

We will not discriminate against you for exercising a privacy right. If an exception prevents us from completing a request, we will explain it where required. We aim to respond to access, correction and complaint requests within 30 days, or within another period required by applicable law.

For California residents, the categories collected during the preceding 12 months are those described in section 2. The source categories, purposes and recipient categories are described in sections 3, 5 and 7. During that period, Actulyze has not sold personal information or shared it for cross-context behavioural advertising.

Actulyze is intended for people aged 16 or older. We do not knowingly collect personal information from children under 16.

The app asks users to declare their age or confirm eligibility during onboarding. If we learn that a person under 16 has provided personal information, we take reasonable steps to delete it. If you believe a person under 16 has provided information, contact support@actulyze.com.

The Service may contain links to websites or services that Actulyze does not control. Their privacy practices are governed by their own policies. Review those policies before providing information to them.

We may update this policy when our practices, technology or legal obligations change. We will publish the updated version and revise the date above.

If a change materially affects how we use sensitive or consumer health data, we will provide additional notice and obtain consent where required before the new use begins.

For privacy questions, requests or complaints, contact Actulyze Pty Ltd (ABN 79 690 780 799), Melbourne, Victoria, Australia, at support@actulyze.com. We will review a complaint and aim to respond within 30 days.

If an Australian privacy complaint remains unresolved, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. If New Zealand privacy law applies, you may contact the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909. United States residents may also contact the relevant state privacy regulator or Attorney General.