The Privacy Covenant

This covenant is a plain-language summary of how the app handles your data. The full policy is the Superidea privacy policy at superidea.no/privacy. For how this website handles the email you share with us, see our Privacy Policy.

Three things, kept separate

Honesty means not blurring different promises into one. There are three parts to this account, and they are not the same.

The first is about interpretation. The sentiment in your journal, the themes it circles, the shape of a month of practice — all of it is computed on your own device, by Apple's NaturalLanguage framework, which is built into iOS. Your writing is never sent to OpenAI, Anthropic, Google's AI, or any outside model to be interpreted.

The second is about continuity. So your practice can follow you from iPhone to iPad, you sign in with Apple or Google, and your practice is kept in a private account built on Google Firebase — including the text of your journal. The connection is encrypted in transit, data is encrypted at rest, and Firestore's security rules restrict access to your signed-in account.

The third is about measurement. Firebase Analytics and Firebase Crashlytics run inside the app and are linked to your account ID. They tell us which features are used and what broke. They are not anonymous, and we will not pretend they are.

What we refuse is the part that would betray a practice. We run no advertising, we keep no data brokers, we sell nothing, and we never give your words to an outside AI to read.

What syncs to your account

• Your account: your name, your email address, and the account ID from your Apple or Google sign-in.
• Your ritual days: the mood you chose and its intensity, your sankalpa (intention), your micro-commitment, your journal entry, and the points you earned.
• Your daily Prana: Shanti, Dharma, Karma, and Dhyana.
• The Wisdom Cards you have earned.

All of it rests in your own area of our Firebase, so the practice you build on one device is waiting on the next. None of it is assembled into an advertising profile, and none of it is sold.

What the app measures

Firebase Analytics records the screens and features you use, the mood and intention labels you pick and the mood's intensity, the title and length of the meditations you finish, how many words a journal entry has, and your purchases. It never receives the text of your journal. Firebase Crashlytics sends crash reports with your device model and iOS version, so we can fix what broke. Both are linked to your account ID.

What stays on your device

The sentiment scores and themes drawn from your journal, and the monthly digest assembled from them, are kept on your device and are not uploaded. So is a profile photo you choose.

Apple Health is opt-in. If you allow it, Hymalayas reads sleep, heart rate, heart-rate variability, resting heart rate, blood oxygen, and respiratory rate to shape practice suggestions and your monthly wellbeing report, and it writes your sessions back to Apple Health as Mindful Minutes. Those readings are used on your device and are never uploaded to us or to our Firebase.

If you switch on “Sky follows local weather”, your approximate location is used on your device to ask Apple Weather for local conditions. It is not stored, and it is never sent to us.

What else touches a server

A few moments leave the device, and you should know which. If you speak a reflection instead of typing it, Apple's speech recognition turns your voice into text and may process the audio on Apple's servers; we never receive the audio. Meditation audio streams from Cloudflare R2, which sees your IP address as it delivers each track. Sign-in goes through Apple or Google, and purchases go through the App Store.

What we refuse

We embed no advertising SDKs, because the economic logic of mobile advertising is incompatible with a Sadhana. An ad network pays for the right to observe what you do, how often, and in what mood, and to use that observation to decide what to show you next. There is no version of that arrangement that respects the inwardness of a meditation practice, so we have signed none.

We keep no relationships with data brokers, and we do not sell, rent, or share your data with anyone for advertising or marketing. The providers that run the app — Google Firebase, Apple, and Cloudflare — process data on our behalf and for nothing else.

We send your writing to no outside AI. The interpretation of a reflection happens on your own device, not in someone else's data centre, so the text of your journal is never sent to another company's model to be read.

Deleting your data

In the app, tap the greeting card on Home, then Settings → Account → Delete Account. That removes your account and your synced practice from our systems and from your device. Backups are overwritten within 90 days. If you cannot open the app, write to hello@superidea.no.

The full policy

This page is a summary, written so a practitioner can read it in a few minutes. The full policy — who we are, the legal basis for each use, how long we keep data, and your rights — lives at superidea.no/privacy. If this page and that policy ever disagree, the policy is correct and we will fix this page. For a step-by-step account of what happens on your device, see the On-Device Manifest.

Privacy is a practice, not a posture. Like any Tapas, it is sustained by daily attention rather than a single declaration.

Questions

Does Hymalayas store my written reflections in the cloud?

Yes, in your own private account. Your journal entries sync to a private account built on Google Firebase, together with your mood, your sankalpa, and your points, so your practice continues if you move to a new device. The connection is encrypted in transit, data is encrypted at rest, and security rules restrict access to your signed-in account. What never happens is interpretation by anyone else: the sentiment of your words is scored on your device, and your writing is never sent to an outside AI, and never sold.

Does Hymalayas use analytics?

Yes. Firebase Analytics and Firebase Crashlytics run inside the app, and both are linked to your account ID, so they are not anonymous. Analytics records which screens and features you use, the mood and intention labels you pick and the mood's intensity, the title and length of the meditations you finish, how many words a journal entry has (never its text), and your purchases. Crashlytics sends crash reports with your device model and iOS version. There is no advertising SDK and no data-broker relationship.

How does Hymalayas analyse my moods?

On your device. When you save a journal entry, Apple's NaturalLanguage framework, which is built into iOS, scores its sentiment and picks out its themes on your iPhone or iPad. Those scores, and the monthly digest built from them, stay on your device and are not uploaded. No outside AI reads your writing. The mood you choose in a check-in is different: that label and its intensity sync to your account and are also recorded in Firebase Analytics.

Can Hymalayas employees read my reflections?

The honest answer is measured. Your journal entries sync to your own area of our Firebase, where security rules restrict access to your signed-in account. Because it is our Firebase project, an administrator has technical access to the database, as with any hosted service — so we do not claim it is impossible for us to read. What we promise is what we do: we never sell your words, we never hand them to an outside AI, and we access your account only when you ask us to for support or when the law requires it.

Does Hymalayas sell data to advertisers?

No. We do not sell, rent, or share your data with any advertiser, data broker, or marketing platform. The service providers that run the app — Google Firebase, Apple, and Cloudflare — process data on our behalf and for nothing else. The business model is the subscription. There is no second revenue stream built on your attention or your patterns, and there never will be — selling Sadhana data would dishonour the practice the app is meant to support.

What data does Hymalayas collect?

Signing in with Apple or Google creates an account with your name, your email address, and an account ID. Your ritual days (the mood you chose and its intensity, your intention, your micro-commitment, your journal entry, and the points you earned), your daily Prana, and your Wisdom Cards sync to that account. Firebase Analytics records how you use the app, linked to your account ID, and Crashlytics records crashes. Apple Health data, if you allow it, is used on your device and never uploaded to us.

Is my breathing session data stored in the cloud?

Partly. Your account records that you completed the breath part of the day's ritual and the Shanti points it earned, and Firebase Analytics records which breathing practice you finished. Your heart rate, heart-rate variability, and other Apple Health readings are used on your device and are never uploaded to us or to our Firebase.

What happens to my data if I delete the app?

Deleting the app removes everything stored on your device, including the sentiment scores and digests that only ever lived there. Your synced practice stays in your account so you can restore it on a new device. To remove that too, delete your account in the app: tap the greeting card on Home, then Settings → Account → Delete Account. Your account and your synced practice are removed from our systems at once, and backups are overwritten within 90 days. Your Apple Health data is unaffected either way.

Does Hymalayas comply with GDPR?

Yes. The full policy at superidea.no/privacy sets out the legal basis for each use: providing the app you asked for (your account and sync), your consent (Apple Health, location for weather, voice input, and notifications), and our legitimate interest in keeping the app stable (crash and usage data). You can see and correct your practice in the app, delete your account there, and ask for a copy of your data by writing to hello@superidea.no.

Where is the full privacy policy?

At superidea.no/privacy. Hymalayas is made by Superidea, and one policy covers all of its apps; the sections marked Hymalayas apply to this one. This covenant is the plain-language summary. If the two ever disagree, the full policy is correct and we will fix this page.