Privacy Policy

A plain-English summary

This Privacy Policy is written in English. Translations into other languages are provided as a courtesy to help you understand our practices. In the event of any conflict or inconsistency, the English version is the binding and authoritative version and supersedes all translations.

We tried to build Soul Spring privacy-first. Here's the short version:

• Your conversations and journal stay on your device by default. Chat messages, journal entries, daily prompts, streaks, and tradition preferences are stored locally on your phone in an SQLite database. If you don't sign in, none of that ever leaves your phone.
• Sign-in is optional and only premium subscribers can turn on cloud sync. When you sign in (Google, Apple, or email + password) and turn sync on, we mirror your chats, journal, and Soul Profile to your account in Firebase so the same content is available on your other devices. Free signed-in users get the sign-in but no cloud sync.
• The guide's replies come from AI models run by Google, OpenAI, and Anthropic.When you send a message, that message and the rest of the current session are sent to the relevant AI provider for processing. Each provider's API/enterprise terms prohibit using your prompts to train their models. See §5 for which model handles which task.
• Voice mode (premium) sends audio off your device. If you use voice, your recorded speech is sent to our server and on to Deepgram (speech-to-text), and the reply text is sent to ElevenLabs (text-to-speech). See §3.4b. (Typed text input still uses on-device keyboard, not these vendors.)
• For premium subscribers we also build long-term memory. After each premium chat session ends, Google Vertex AI Memory Bank extracts short factual notes (e.g., "User practices Tibetan Buddhism for over a decade") so future sessions feel continuous. These notes are scoped to your account, never used for ads, and are erased when you delete your account or turn off sync.
• You can delete everything we have, within 24 hours. Sign in, open Account → Delete account, and we erase your Firebase Auth record, Firestore data, server-side chat sessions, Memory Bank facts, and safety logs. Local on-device data is wiped if you ask us to.
• There are safety features that override these defaults. If a message indicates a mental-health crisis, our system routes you to crisis-line referrals (988, Crisis Text Line). If you tell us you are under 13, we hard-block further conversation. Minor protections (CA SB 243, NY GBL Article 47) apply to users aged 13–17. These routes do not write to Memory Bank and use a separate audit log.
• Nothing is ever shared or posted automatically. Soul Spring can build a shareable image card from your own material (a daily reflection, a saved reflection, a sticky note, or a journal excerpt), but only when you choose to, and only after you review the card. Tapping Share opens your phone's own share sheet — we have no connection to any social network and never publish on your behalf. Once you hand a card to another app, that app and whoever receives it are outside our control. See §3.8.
• New on-device features: practice rhythm and goals. Soul Spring can record which calendar dates you practiced on (dates only — never what you did) and can hold personal goals you write, with their steps and check-ins. Both live only on your phone today; neither is synced to us. See §3.1.
• Free users see one rewarded ad per session. Subscribers see none.

The rest of this document is the formal version.

1. Who we are

Saar Inc. is the data controller for Soul Spring. We are a Florida corporation. You can reach us at support@soulspring.live.

2. Scope

This Privacy Policy applies to your use of the Soul Spring mobile application on iOS and Android. It does not apply to third-party websites, services, or apps that may be linked from within Soul Spring; those are governed by their own privacy policies.

3. Information we collect, where it lives, and why

We organize this section by where the data physically resides, because that determines who can access it.

3.1 On-device only (never uploaded by Saar Inc. unless you turn on cloud sync)

The following data is stored exclusively in a local SQLite database on your phone. It never leaves your device unless (a) you send a message to the AI, which transmits that turn to Google for processing, or (b) you are a premium subscriber and have turned on cloud sync, in which case the items marked synced below are mirrored to Firebase under your account.

When you uninstall the app or use your operating system's "Clear App Data" function, all on-device data is removed.

3.2 Cloud — your Firebase account (signed-in users only)

When you sign in to Soul Spring (Google, Apple, or email + password), Firebase Authentication creates a stable user record tied to your account identifier. We use this user identifier ("UID") to store the following in Google Cloud Firestore, under users/{uid}/:

If you have not signed in (the default for new installs), none of the data in §3.2 exists for you. The app uses an anonymous Firebase identifier for low-level features like daily-prompt notifications, but no account-scoped Firestore records are written.

Feedback you submit. If you use the in-app feedback / report form, the name, email, subject, and message you enter are stored in a separate Cloud Firestore feedback collection so we can read and respond. Any user (including anonymous) may submit; submissions are not readable by other users. This replaced a former email-relay path for feedback.

3.3 Cloud — server-side chat session state (Google Vertex AI Sessions)

When you send a chat message, Google Vertex AI maintains a session on its servers that tracks the conversational context. This is how the Guru remembers what you said two turns ago.

• Where it lives: Google Cloud Vertex AI, scoped to your Firebase UID.
• What's in it: The messages you've sent in the active session and the Guru's replies. Your tradition preferences and any context the app sent (e.g., recent session summaries) are included as part of the per-turn context.
• How long it persists: Vertex AI Sessions have no automatic time-to-live, so we apply explicit deletion at three triggers: 1. When you tap "New Chat," the prior session is deleted server-side immediately. 2. When you delete your account, every session associated with your UID is enumerated and deleted as part of the fan-out. 3. 30-day idle cleanup: A scheduled job sweeps server-side state at least once per day; sessions inactive for more than 30 days are eligible for deletion. (As of v3.0 this sweep is a no-op for individual idle sessions pending Vertex SDK exposure of per-session last-update timestamps — account-delete and New-Chat triggers still apply.)

Per Google's enterprise AI terms, session content is not used to train Google's foundation models and is not retained by Google for model improvement.

3.4 Cloud — long-term memory (Google Vertex AI Memory Bank) — premium subscribers only

When you complete a premium chat session, our server hands the session to Google Vertex AI Memory Bank, which extracts short factual statements about you (e.g., "User finds meaning in Stoic discipline," "User journals each morning"). These extracted statements are kept scoped to your Firebase UID so future chat sessions can recall them.

• Who has Memory Bank: Premium subscribers only, including the 7-day free trial. Free signed-in users do not have their sessions extracted. Anonymous (not-signed-in) users do not have their sessions extracted.
• What is extracted: Factual statements about you that help the Guru personalise future sessions. Memory Bank does NOT store full chat transcripts (those live in Vertex AI Sessions per §3.3).
• What is NOT extracted: Sessions that were routed to our safety responder (mental-health crisis routing) or minor responder (age-related routing) are excluded server-side from Memory Bank ingest. This is enforced in two places — client-side filtering and server-side gating — so misconfiguration in one cannot defeat both.
• How to see what's stored: The Soul Profile screen has a "What I remember" section that surfaces your current Memory Bank facts.
• How it ends:
• When you toggle sync off (either with the 30-day grace or immediate options), Memory Bank ingest halts immediately and your existing facts become eligible for cleanup per your chosen sync-off mode (§3.5).
• When you cancel your premium subscription and the 30-day grace expires, Memory Bank facts are deleted.
• When you delete your account, Memory Bank facts are deleted as part of the fan-out.
• Training prohibition: Per Google's enterprise AI terms, Memory Bank facts are not used to train Google's foundation models and are not retained by Google for model improvement.

3.4a Journal entries (Iter 2.9)

You can write personal journal entries inside Soul Spring. Entries live on your device by default. If you are a premium subscriber, the AI-Integrated Journal also:

• Generates a short reflection back to you ("AI insight") via Google Vertex AI / Gemini. The reflection is shown on the saved entry; it is not advice and not a clinical assessment.
• Tags the entry with closed-taxonomy theme keys (the same 30-theme list used for Soul Profile) so journal-derived themes contribute to your longitudinal view.
• Feeds the entry into Memory Bank (§3.4) so the Guru can recall what you reflected on in future sessions.

The same protections that apply to chat apply to journal entries:

• What is sent to Google: The entry text, optional mood label, and optional daily-prompt context, sent to our Cloud Run proxy and then to Gemini for the reflection + theme extraction call. For Memory Bank ingest (premium only), the entry is wrapped in a transient Vertex AI Session that is handed to Memory Bank's extractor.
• Crisis routing: Entries that the safety classifier flags as crisis content are NOT sent to the reflection generator and are NOT ingested into Memory Bank. The crisis-support resources from §3.6 / §10 are surfaced instead.
• Tier-gated cleanup: When your premium subscription lapses, journal entries remain on your device — but the cloud-synced copies (if sync is on) are erased per §3.5, and journal-derived Memory Bank facts are deleted per §3.4.
• Sign-out / account-delete: Same fan-out as chat. Local journal entries are wiped if you ask us to.

You can always read, edit, or delete a journal entry from the Journal screen. Delete is immediate and propagated to other devices on your account if cloud sync is on.

3.4b Voice mode (premium)

Premium subscribers can talk to the guide instead of typing. Voice uses a two-vendor cloud pipeline (the chat "brain" in the middle is the same one described in §3.3–§3.4):

• Speech-to-text (Deepgram). Your recorded microphone audio is sent over TLS to our server and forwarded to Deepgram (Nova-3 model), which returns a text transcript. The transcript then flows through the normal chat path (safety classifier, then the guide), so all the protections in §3.3, §3.4, and §6 apply to it.
• Text-to-speech (ElevenLabs). The guide's reply text is sent to ElevenLabs, which returns spoken audio that the app plays back.

What we ask Deepgram and ElevenLabs to do with your data:

• We exclude your audio from Deepgram's model-improvement/training program (via the mip_opt_out flag, sent on every transcription); Deepgram retains that audio only for as long as it needs to process the request.
• We opt out of ElevenLabs using your input text to train or improve its models (via ElevenLabs' account-level "Data use" control). Training opt-out was toggled in the ElevenLabs dashboard on 2026-06-01 and is forward-only. IMPORTANT — this is the training opt-out ONLY. ElevenLabs offers no per-request retention control on our Pay-as-you-go / API tier (Zero-Retention Mode is enterprise-only), so ElevenLabs retains your input text/audio under its standard terms (logging/history on by default; voice-derived data kept up to ~3 years).
• Neither vendor uses your content to train its models (we have opted out with both, as above), and audio/text is used only to perform the transcription or synthesis you requested.

NY GBL Article 47 in voice.

If you never use voice, none of this applies — typed input never touches Deepgram or ElevenLabs.

3.5 Three-option sync-off

When you turn cloud sync off in Account → Cloud sync, we ask you to choose what should happen to the cloud copy:

1. Keep cloud copy for 30 days, then erase it. Gives you a window to re-subscribe, change your mind, or download a copy. After 30 days, a daily cleanup job erases your sync mirror under users/{uid}/sync/. This is the default.
2. Erase cloud copy now. The cloud mirror is erased immediately when you confirm. Your local on-device data is untouched.
3. Pause sync, keep cloud copy. The mirror is preserved indefinitely, but no new updates flow up or down until you turn sync back on.

Your choice is stored under users/{uid}/sync_state/data so the cleanup job can honour it.

3.6 Cloud — safety audit (compliance recordkeeping)

When a message is routed through our safety classifier (the system that decides whether a turn should go to the spiritual companion, the safety responder, or the minor responder), we write a per-event record to safety_audit/{uid}/events/{event_id}. The record contains:

• A timestamp.
• The routing decision (which agent received the message).
• The classifier's category set (e.g., ["crisis"], ["minor_self_disclosure"]).
• A SHA-256 hash of the message identifier — not the message text itself.

We also write aggregated, deidentified counters at safety_aggregates_daily/{date} and safety_aggregates_monthly/{month} to satisfy reporting obligations under California SB 243 (the annual report to OSHPD is due starting July 2027).

Retention: Per-event audit records are retained for 90 days. Aggregate counters are retained indefinitely because they are deidentified and have demonstrable reporting value. When you delete your account, the per-event records under safety_audit/{uid}/ are erased immediately, overriding the 90-day retention — your explicit deletion request takes precedence over the default policy.

3.7 Information sent to processors but not stored by Saar Inc.

When you use certain features, your information passes through third-party services that we engage as processors. We do not separately retain this data; it is sent only to make the feature work.

A coarse region hint travels with chat and safety requests. So that a crisis referral names help that actually exists where you are, the App derives a country-level region code from your device's language/region setting (for example, "IN" or "GB") and sends it with your chat request. Our server maps it to a resource region and gives the safety responder the right hotlines — an Indian user is pointed to Tele-MANAS, not a US number. Please note:

• This is derived from your device locale setting only. It is not GPS, not precise location, not your IP-based location, and the App requests no location permission.
• It is a resource hint, never a compliance signal: your age band (§6.1) and your state-level obligations are determined separately and are not inferred from it.
• If it is absent or unrecognized, we fall back to US resources plus an international directory rather than guessing.

3.8 Sharing a card to another app

Soul Spring can turn your own material into a branded image card that you may share outside the App. This is the only feature that moves your content to a destination you choose, so it is deliberately narrow:

• You start it, every time. There is no automatic, scheduled, or background sharing, and no integration with any social network, messaging service, or content platform. We never post anything on your behalf and hold no credentials for any such service.
• You see the exact card before it leaves. The card is purpose-built from the specific material you selected — it is not a screenshot, so it cannot capture surrounding screen content, other entries, or anything hidden on the page. You choose the format and the privacy options, then confirm.
• What can be shared, and by whom. Eligible material is a Daily Reflection, a Saved Reflection, a sticky note, a journal excerpt or a saved journal AI-insight, and (numeric only) your practice progress. Each card carries a label showing whether the text is user-authored or AI-generated. Sharing is available to adults; users aged 13–17 may share only the non-personalized Daily Reflection; users under 13 cannot share at all. Material that our safety systems flagged is never shareable. These checks are re-run at the moment of export, not merely by hiding a button.
• How the file is handled. The card is rendered on your device into a PNG in your app's private temporary storage, handed to your operating system's share sheet, and deleted afterwards; leftover temporary cards are pruned automatically. The image is not uploaded to Saar Inc., and we do not keep a copy of it or of what you shared.
• Once it leaves, it is out of our hands. When you pass a card to another app, that app — and anyone who receives it — is governed by their own terms and privacy practices, not ours. We cannot retract, delete, or track a card after you share it. Please treat a shared card as public.
• The only address printed on a card is soulspring.live, a plain website address. It is not a tracking link and carries no identifier for you.
• What we record about sharing. Our analytics receive only fixed product categories — which surface was shared, the chosen format, and whether the flow completed. They never receive the shared text, the record's identifier, the file, the destination app, or any safety reason. See §3.2.

4. Permissions we request and why

All permissions are optional in the sense that you can revoke them in your device settings; revoking the microphone disables voice input but leaves the rest of the app working.

The exact strings shown in iOS prompts are:

• "Soul Spring uses the microphone to capture your voice input for conversations with the guide."
• "Soul Spring uses speech recognition so you can speak your questions to the guide instead of typing them."

On Android, microphone hardware is declared as not required so that mic-less devices (TVs, some Chromebooks) can still install the app and use text input.

5. AI processing — detailed disclosure

Soul Spring routes each AI task to a model chosen for that task. All calls are made server-side (from our Cloud Run backend); provider API keys never ship in the app.

For all of these calls:

• The data is transmitted to the provider over TLS.
• Under each provider's API/enterprise terms, your prompts, responses, classifier inputs, journal text, and Memory Bank facts are not used to train the provider's foundation models and are not retained for model improvement. Google: https://cloud.google.com/terms/ai-services. OpenAI: https://openai.com/policies/ (API data-usage). Anthropic: https://www.anthropic.com/legal/commercial-terms.
• We do not store full AI conversations on Saar's own servers. They live in your device's SQLite database (always) and in Vertex AI Sessions on Google's servers (per §3.3).

5.1 AI-disclosure clock (NY GBL Article 47)

Soul Spring tells you clearly and conspicuously that you are interacting with an AI and not a human being. The notice appears at the start of a chat session and again after every three (3) hours of continuing interaction. We persist a system_disclosure record in your local chat history so you can scroll back and see when each notice was shown.

The notice is now written in plain language and shown in the language you use the App in, rather than as a single fixed English script. It remains visually distinct from the conversation so it cannot be mistaken for something the companion said.

If you have told us you are 13–17, the notice is accompanied by a periodic reminder to take a break, in line with California's companion-chatbot requirements for minors.

Voice. Because a voice-only user might never look at the screen, entering voice mode shows a one-time acknowledgement screen carrying the same notice; you must acknowledge it before the voice session starts, and we log a system_disclosure record for it.

5.2 Web research (premium)

Web research is an optional feature for adult users. Luma may send a minimized, non-identifying public topic query to a search provider (Perplexity) and show links used in its response. Search results can be incomplete or inaccurate. Soul Spring does not use your saved memories or past conversations to construct the provider query.

Web research is available only to adult users (18 and older). It is not available to minors or to users under 13. Luma will not search the web during a safety or crisis response, when you are sharing a personal memory, or during an emotional-support conversation. Web research activates only when you explicitly ask Luma to search or verify current information, and only when your account settings and applicable feature gates permit it.

What is sent to the search provider:

• A minimized public-topic query built from your current message. It excludes private identifiers, non-public names, UID/session/conversation IDs, profile/memory/history text, exact location, device/IP locale, and crisis region. A public person or place you explicitly mention may remain only when necessary to the public question. Country is sent only when you explicitly supplied it for the request and it is necessary.
• Search parameters (language, result limits).

What is not sent: raw queries, snippets, rankings, response payloads, and provider request IDs do not enter memory, history summaries, analytics, or logs.

What persists with the chat: only sources actually used in the delivered response — a random source ID, title, validated HTTPS URL, domain, and optional publication/update date. You may separately save a source on-device; those saved sources are device-only and excluded from server continuity export.

Third-party pages may be inaccurate, malicious, or change over time. Search snippets are treated as untrusted data, not instructions. The App does not imply a source is authoritative merely because it was returned, and states when current verification failed.

6. Safety, minors, and crisis handling

6.1 Age gate at first launch

When you first launch Soul Spring, before any chat is possible, you are asked to select an age band:

• Under 13: Soul Spring will not engage in conversation. You are shown a parent-contact screen.
• 13–17: You may use Soul Spring with minor-appropriate content protections in place.
• 18 and older: Standard adult experience.

Your selection is stored under users/{uid}/account_flags/data as is_minor and is_under_13 flags. Re-attestation that contradicts a prior disclosure does NOT clear the flag — once we know your age band, that knowledge persists. Reversal requires emailing support@soulspring.live.

6.2 Mid-chat self-disclosure

If, during a chat, the safety classifier detects that you have disclosed being under 13 or aged 13–17, the corresponding flag is set and persisted account-permanently. From that point on, your conversations are routed through the appropriate responder.

6.3 Crisis routing

If the safety classifier detects content suggesting a mental-health crisis (self-harm, suicidal ideation, severe emotional distress), the turn is structurally routed to a separate AI agent — the safety responder — that has been trained never to engage spiritually on crisis content. Its only job is to surface crisis-line referrals (988, Crisis Text Line, and locale-appropriate equivalents).

This is enforced at the routing layer, not as a post-hoc filter on the companion's output. Even if the spiritual companion would have produced unsafe content, the classifier intercepts the turn before the companion sees it.

6.4 Why this matters for your privacy

Crisis-flagged and minor-flagged sessions are excluded from Memory Bank ingest (§3.4). The safety audit record (§3.6) contains the routing decision and the classifier's categories — but not the message text. Aggregate counters used for the CA SB 243 annual report are deidentified.

7. Advertising

Free-tier users see one rewarded video advertisement after roughly three messages in a chat session. Ads are served by Google Mobile Ads (AdMob), which may use your device's advertising ID, IP address, and approximate locale to serve and frequency-cap ads.

In the European Economic Area, the United Kingdom, and Switzerland, Google's User Messaging Platform (UMP) shows a consent banner the first time an ad is loaded; your selection there controls whether you receive personalized or non-personalized ads.

You can reset or limit your advertising ID in your device settings at any time:

• iOS: Settings → Privacy & Security → Tracking, and Settings → Privacy & Security → Apple Advertising
• Android: Settings → Google → Ads

Subscribers to Soul Spring Premium see no ads.

8. Sub-processors and third-party services

We rely on the following processors. Each has its own privacy policy:

• Google LLC — Firebase Authentication, Cloud Firestore, Firebase Analytics, Firebase Cloud Messaging, Vertex AI / Gemini, Vertex AI Agent Engine, Vertex AI Memory Bank, Google Mobile Ads, Sign in with Google. Privacy: https://policies.google.com/privacy. Firebase-specific: https://firebase.google.com/support/privacy. Vertex AI: https://cloud.google.com/terms/ai-services.
• OpenAI, L.L.C. — AI generation for the default ("brief") chat reply (gpt-5.4-mini ), via API. Privacy: https://openai.com/policies/privacy-policy. API data usage: https://openai.com/policies/.
• Anthropic, PBC — AI generation for in-depth ("elaborate") chat replies (claude-sonnet-4-6), journal insight, and sticky-note enrichment (claude-haiku-4-5), via API. Privacy: https://www.anthropic.com/legal/privacy. Commercial terms: https://www.anthropic.com/legal/commercial-terms.
• Deepgram, Inc. — speech-to-text for the premium voice feature. Privacy: https://deepgram.com/privacy.
• ElevenLabs, Inc. — text-to-speech for the premium voice feature. Privacy: https://elevenlabs.io/privacy-policy.
• Perplexity, Inc. — web search for the optional web research feature (§5.2). BAA signed covering the Search API endpoint. Privacy: https://perplexity.ai/privacy-policy.
• Apple Inc. — Sign in with Apple and App Store billing on iOS. Privacy: https://www.apple.com/legal/privacy/.
• Google Play — billing on Android. Privacy: https://policies.google.com/privacy.
• RevenueCat, Inc. — subscription verification and entitlement management. Privacy: https://www.revenuecat.com/privacy.
• Mailgun Technologies, Inc. — transactional email delivery for email/password sign-in: account-verification and password-reset links (PER-016), sent from mg.soulspring.live. (Supersedes the 2026-06-01 note — Mailgun is no longer the magic-link relay (magic-link was removed) but is now actively used for verify/reset email.) Privacy: https://www.mailgun.com/privacy-policy/.

No social-network or content-platform processor is on this list, and that is deliberate. When you share a card (§3.8), the App hands the image to your operating system's own share sheet; the app you then pick is your choice and is not engaged by us as a processor. We have no API integration, account, or credential for any social network.

9. Data retention

10. Your rights

10.1 Account deletion (everyone)

Within the app: Account → Delete account. We complete the deletion within 24 hours. The fan-out covers:

• Your Firebase Authentication user record (revokes all sign-in tokens).
• Firestore data under users/{uid}/: subscription mirror, sync mirror, sync state, age attestation, notification prefs, FCM tokens, daily-prompt mirror, account flags.
• Safety audit records under safety_audit/{uid}/ (overriding the 90-day retention).
• Vertex AI Sessions belonging to your UID.
• Memory Bank facts scoped to your UID.

A separate prompt in the same flow asks whether you also want to erase local data on this device.

Your active App Store or Play Store subscription is NOT canceled by this action. Cancel it separately in your store account to stop billing. The delete-account modal in the app surfaces a Manage Subscription deep-link for this.

10.2 If you are in the European Economic Area, the United Kingdom, or Switzerland (GDPR / UK GDPR)

You have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict or object to processing;
• portability — receive your data in a structured, machine-readable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your supervisory authority.

To exercise any of these rights, email support@soulspring.live.

10.3 If you are a California resident (CCPA / CPRA)

You have the right to:

• know what personal information we collect, use, and share;
• delete personal information we hold about you;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information. We do not sell your personal information; the only "sharing" within the meaning of the CPRA relates to advertising identifiers used by AdMob, and you can opt out via your device's "Limit Ad Tracking" setting and via Google's UMP consent banner;
• non-discrimination — we will not deny service or change pricing because you exercised a right.

To exercise these rights, email support@soulspring.live.

In addition, California SB 243 (effective January 1, 2026) imposes specific requirements on AI companion services. Soul Spring qualifies as a "companion chatbot" under the statute. Compliance is implemented as described in §6 (safety routing, age gate, minor protections, audit logging) and the annual transparency report will be filed with OSHPD beginning July 2027.

10.4 If you are a New York resident

New York General Business Law Article 47 (effective November 5, 2025) requires specific disclosures and safety routing for AI companion products. Soul Spring qualifies as a "companion chatbot" under the statute. Compliance is implemented as described in §5.1 (AI-disclosure clock) and §6.

10.5 If you are a Florida resident (Florida Digital Bill of Rights)

To the extent the FDBR applies, Florida residents have substantially similar rights to access, correct, delete, and opt out of certain processing. Use the same contact email above.

10.6 All users

Regardless of where you live, you can:

• Delete on-device data by uninstalling the app, clearing app data in your operating system settings, or via in-app Account → Erase data on this device.
• Delete cloud-side records via in-app Account → Delete account (recommended) or by emailing support@soulspring.live.
• Cancel your subscription at any time through your App Store or Play Store account settings; the in-app Account → Manage subscription link routes you there.
• Turn cloud sync off via in-app Account → Cloud sync toggle, choosing one of the three sync-off options described in §3.5.

11. International data transfers

Soul Spring is operated from the United States. When you use the app, your data may be transferred to and processed in the United States and other countries where Google Cloud, OpenAI, Anthropic, Deepgram, ElevenLabs, Perplexity, RevenueCat, Apple, and Google Play operate. Where required, we rely on standard contractual clauses or other lawful transfer mechanisms.

12. Children's privacy

Soul Spring is not directed to children under 13. Our age gate (§6.1) hard-blocks under-13 users from any chat interaction. If you are between 13 and 17, you may use Soul Spring only with the involvement of a parent or guardian, and our minor protections (§6) apply automatically. Age also governs outward sharing: under-13 users cannot share at all, and 13–17 users may share only the non-personalized Daily Reflection (§3.8).

If we learn that we have collected personal information from a child under 13, we will delete it. Parents or guardians who believe a child under 13 has used Soul Spring can contact support@soulspring.live and we will remove the account and associated data.

13. Security

We protect your data with:

• TLS encryption for all data in transit (between the app and Firebase, the AI providers, the voice providers, RevenueCat, AdMob, etc.).
• Encryption at rest provided by Google Cloud / Firebase for cloud-side records.
• On-device data isolation — Soul Spring's SQLite database is sandboxed by the operating system and is not accessible to other apps.
• Server-side receipt validation through RevenueCat for subscription state.
• App Check (Apple App Attest on iOS, Google Play Integrity on Android) so our backend can verify that requests are coming from a genuine Soul Spring app on a genuine device.
• OIDC service-account-signed authentication for internal cron endpoints (daily-prompt dispatch, daily cleanup) so only Cloud Scheduler can call them.

No method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. If we learn of a breach affecting your data, we will notify you and the appropriate regulators in line with applicable law.

14. Changes to this Privacy Policy

We may update this policy from time to time. We will change the "Last Updated" date at the top, and for material changes we will display an in-app notice the next time you open Soul Spring. Continued use of the app after the change becomes effective means you accept the updated policy.

15. Contact

Saar Inc. State of Florida, United States Email: support@soulspring.live