PRIVACY POLICY

Last updated: July 10, 2026
 

Welcome to ZenPal (“we,” “our,” or “us”). We are committed to protecting your privacy and handling your personal information with care and transparency. This Privacy Policy explains how we collect, use, store, and share your information when you use the ZenPal mobile application and website at myzenpal.com, collectively referred to as the “Service.”

By using ZenPal, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Service.
 

1. INFORMATION WE COLLECT

1.1 Account and Profile Information

Registration data: When you create an account, we collect your email address and a password. If you sign in through Google or Apple, we receive your name and email address from the respective provider.

Profile data: You may optionally provide a full name, display name, and profile picture.

Referral data: When you join through a referral link, we record the referral code and referring user. We also generate a unique referral code for your account.
 

1.2 Wellness and Journaling Content

Journal entries: Titles, text content, and tags you create, including entries recorded through speech-to-text.

Mood logs: Daily mood selections, including emoji and label, dates, and your device timezone.

Meditation sessions: Logs of completed guided meditation sessions.

Onboarding questionnaire: Responses about your stress triggers, self-care preferences, notification frequency, and emotional processing style.
 

1.3 AI Chatbot Conversations (“Izzy”)

When you chat with Izzy, our AI wellness companion, we store your conversation history and the AI’s responses to provide continuity across sessions.

Conversations are sent to OpenAI for processing, as described in Section 4.

Izzy is designed to offer supportive and psychoeducational conversations based on CBT, ACT, and positive psychology principles.
 

1.4 Community and Social Features

Community posts: Content you share publicly, up to 2,000 characters, including whether you post under your real name or anonymously.

Comments and reactions: Comments you leave on community posts, up to 500 characters, and reactions such as hug, muscle, happy, love, and hooray.

Friends: Friend connections you make, friend requests sent or received, and one-on-one friend chat messages.
 

1.5 Gamification and Progress Data

We collect information about plant growth progress, growth points earned, unlocked and completed plants, fertilizer balance, daily attendance and streak logs, and task completion tracking.
 

1.6 Device and Usage Information

Device data: Device model, operating system version, and timezone.

Push tokens: Firebase Cloud Messaging tokens used to deliver push notifications.

App activity: Button interaction timestamps, feature usage patterns, and in-app preferences such as theme selection, notification settings, and background music settings.

Microphone access: Microphone access is used only for speech-to-text journaling. Audio is processed on your device and is not uploaded, stored, or shared.
 

1.7 Analytics

We use Firebase Analytics, PostHog for web analytics, and Microsoft Clarity for mobile app experience analytics.

These tools help us understand screens viewed, feature interactions, sign-in methods, taps, gestures, session flow, app performance, and usability issues so we can improve ZenPal.

Microsoft Clarity may collect session replay data and interaction analytics from the mobile app, including screen snapshots, visible app content, taps, scrolls, device information, operating system information, network state, and diagnostic events.
 

We use Clarity to diagnose usability and reliability issues, not to review individual private wellness content.

 

1. HOW WE USE YOUR INFORMATION

We use your information for the following purposes:

To provide and personalize the Service: To display your journal, mood history, meditation logs, plant progress, and tailored content.

To power gamification: To calculate growth points, manage plant progression, track streaks, and award fertilizer.

To enable the AI chatbot: To process and respond to your messages through OpenAI’s GPT-4o-mini model.

To facilitate community features: To display community posts, comments, and reactions to other users as intended.

To send push notifications: To deliver reminders, engagement prompts, and administrative announcements based on your notification preferences.

To improve the Service: To analyze aggregated and anonymized usage patterns, fix bugs, enhance features, and guide development.

To administer referrals: To track and reward successful referrals.

To communicate with you: To respond to support requests, send administrative messages, and notify you of policy changes.
 

1. IMPORTANT DISCLAIMER: AI CHATBOT (“IZZY”)

Izzy is not a licensed therapist, psychologist, psychiatrist, or medical professional.

Izzy is an AI-powered conversational agent that provides general wellness support and psychoeducational content based on established therapeutic frameworks.

Using Izzy does not create a doctor-patient, therapist-client, or any other professional relationship.

Izzy is not a substitute for professional medical advice, diagnosis, treatment, or emergency care.

Izzy is not HIPAA-compliant. Conversations are processed by OpenAI’s GPT-4o-mini model and are subject to OpenAI’s data usage policies.

If you are experiencing a crisis, having thoughts of self-harm, or need immediate help, please contact your local emergency services or a crisis helpline available in your country.
 

For example:

United States emergency services: 911

United Kingdom emergency services: 999

988 Suicide and Crisis Lifeline in the United States: Call or text 988

Crisis Text Line in the United States: Text HOME to 741741

We strongly encourage you to seek professional help for any mental health concerns. ZenPal is a wellness tool, not a clinical intervention.
 

1. THIRD-PARTY SERVICES

We rely on the following third-party services to operate ZenPal. Each service has its own privacy policy governing how it handles your data.
 

4.1 Google Firebase and Google Cloud

Purpose: Authentication through email and password or Google Sign-In, data storage through Cloud Firestore, server-side logic through Cloud Functions, push notifications through Firebase Cloud Messaging, and analytics through Firebase Analytics.

Data stored: User accounts, profile data, user-generated content, settings, and analytics events.

Location: Data is stored on Google Cloud infrastructure in the United States.

Google Privacy Policy:

https://policies.google.com/privacy
 

4.2 OpenAI

Purpose: OpenAI powers the Izzy AI chatbot using the GPT-4o-mini model.

Data sent: System instructions related to Izzy’s persona and the last 20 messages of your conversation history with each request.

Security: The OpenAI API key is stored on the server as a Firebase Secret and is never exposed to your device.

OpenAI Privacy Policy:

https://openai.com/policies/privacy-policy
 

4.3 PostHog

Purpose: Web product analytics used to understand feature usage and improve the Service.

Data collected: Web usage events, feature interactions, page views, and browser or device metadata.

PostHog Privacy Policy:

https://posthog.com/privacy
 

4.4 Meta Platforms, Inc. (“Facebook”)

Purpose: Ad attribution and campaign measurement. The Meta SDK helps us track which advertisements led to app installations and registrations so we can measure marketing performance.

Data collected: App installation events, activation events, registration events, and device identifiers used for attribution.

Meta Privacy Policy:

https://www.facebook.com/privacy/policy
 

4.5 Microsoft Clarity

Purpose: Mobile app session replay, heatmaps, interaction analytics, diagnostics, and usability analysis used to improve ZenPal’s reliability and user experience.

Data collected: Session replay data, screen snapshots, visible app content, taps, gestures, app navigation, device information, operating system information, network connectivity, diagnostic events, and other mobile app usage metadata.

Microsoft Privacy Statement:

https://privacy.microsoft.com/privacystatement

Microsoft Clarity Terms:

https://clarity.microsoft.com/terms
 

4.6 Sign in with Apple and Google Sign-In

If you choose to authenticate through Apple or Google, those providers will share your name and email address with us according to the permission you provide.

The respective provider’s privacy policy applies to the authentication process.
 

1. DATA STORAGE AND SECURITY

Primary storage: User data is stored in Cloud Firestore through Google Cloud with encryption at rest and in transit through TLS and HTTPS.

Local storage: Some preferences, including theme settings, music settings, and cached data, are stored locally on your device using secure key-value storage.

API keys: Third-party API keys, including OpenAI API keys, are stored exclusively in Firebase Secrets on the server and are never accessible from the client application.

Security measures: We implement Firestore security rules to restrict data access to authorized users.

However, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security.
 

1. DATA RETENTION AND DELETION

We retain your personal data for as long as your account remains active or for as long as necessary to provide the Service.

If you wish to delete your account and all associated data, please contact us using the email address provided in Section 11.

We will process your request within a reasonable timeframe, subject to any legal obligations that require us to retain certain information.

Some anonymized or aggregated information that cannot personally identify you may be retained for analytics purposes after your account is deleted.
 

1. YOUR PRIVACY RIGHTS

7.1 General Rights

Depending on your location, you may have the following rights:

Access: You may request a copy of the personal data we hold about you.

Correction: You may update or correct inaccurate information in your profile.

Deletion: You may request the deletion of your account and associated data.

Data portability: You may request your data in a structured and commonly used format.

Withdraw consent: You may revoke permissions, including notification and microphone permissions, through your device settings at any time.
 

7.2 GDPR Rights for the European Economic Area, United Kingdom, and Switzerland

If you reside in the European Economic Area, United Kingdom, or Switzerland, you may have additional rights under the General Data Protection Regulation.

These rights may include the right to object to processing and the right to restrict processing.

Our legal bases for processing your information include your consent and our legitimate interest in providing and improving the Service.

You also have the right to lodge a complaint with your local data protection authority.
 

7.3 CCPA and CPRA Rights for California Residents

If you are a California resident, you may have rights under the California Consumer Privacy Act and California Privacy Rights Act.

These rights may include the right to know what personal information we collect, request the deletion of your personal information, and opt out of the sale of your personal information.

We do not sell your personal information.
 

7.4 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us using the information in Section 11.

We may need to verify your identity before processing your request.

We will respond within the timeframe required by applicable law.
 

1. CHILDREN’S PRIVACY

ZenPal is not intended for children under 13 years of age.

We do not knowingly collect personal information from children under 13.

If we become aware that a child under 13 has provided us with personal data, we will delete it promptly.

If you believe a child under 13 has used our Service, please contact us immediately.

If you are between 13 and 18 years of age, you may only use ZenPal with the consent and supervision of a parent or legal guardian.
 

1. INTERNATIONAL DATA TRANSFERS

ZenPal is operated in the United States.

Your data is stored on Google Cloud infrastructure located in the United States.

If you access the Service from outside the United States, your data will be transferred to and processed in the United States.

By using ZenPal, you consent to this transfer.

We take appropriate safeguards to ensure that your data receives an adequate level of protection in accordance with applicable data protection laws.
 

1. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.

When changes are made, we will update the “Last updated” date at the top of this policy.

For material changes, we may notify you through the Service, including through an in-app notice or email.

Your continued use of ZenPal after the changes take effect means that you accept the revised Privacy Policy.
 

1. CONTACT US

If you have questions, concerns, or wish to exercise your privacy rights, please contact us:

Email: support@lindahillofficial.com

Website: https://www.lindahillofficial.com

We aim to respond to all privacy-related inquiries within 30 days.

© 2026 ZenPal. All rights reserved.