Privacy Policy

This Privacy Policy explains what information Attune (“Attune,” “we,” “us”) collects when you use our app and website, how we use it, and the choices you have. Attune is a daily devotional practice of prayer, breath, and rest. We have tried to keep this plain and honest.

Who we are and how to reach us

If you have any question about this policy or your data, contact us at support@attuneapp.site. We are the controller of the personal information described here.

Information we collect

We only collect what the app needs to work for you:

• Account credentials. Your email address and a password. Your password is never stored in readable form — authentication is handled by Supabase Auth, which stores only a securely hashed version.
• Your onboarding answers. When you first set up the app, you may tell us a preferred name, your faith background, what you are going through and seeking, how much time you want to practice, what you feel has been missing, and your preferred morning and evening reminder times. These shape the content we show you. You can skip questions.
• Profile details. An optional first and last name, avatar image, and your chosen language.
• Usage and progress. Which content you open, your streak and practice progress, and basic first-party analytics (page views and in-app events). These include your device’s user-agent string and IP address. We honor your browser’s “Do Not Track” signal and skip this collection when it is set.
• Push notification tokens. If you enable notifications, we store the notification token your browser or device provides, along with basic device type, so we can send the reminders you asked for.
• Conversations with Orin. See the Orin section below.

Orin, our AI companion

Orin is a conversational companion inside Attune. When you write to Orin, we use a third-party artificial-intelligence provider to generate Orin’s reply.

Who receives your messages. The text you type to Orin — together with the earlier messages in that same conversation, which are sent along for context — is transmitted to OpenAI (OpenAI, L.L.C.), which runs the model that produces Orin’s response (currently OpenAI’s GPT-4o). The request is made from our servers; our OpenAI key is never exposed to your device. We do not send OpenAI your name, email, or account identifiers with the message — only the conversation text and the instructions that give Orin its voice.

What OpenAI does with it. OpenAI does not use text sent through their API to train their models. That is how their API works by default, and we have not opted in to anything that would change it. They keep a copy of what is sent and what comes back for up to 30 days so they can check for abuse of their service, and then delete it, unless the law obliges them to keep it longer. This processing takes place in the United States.

Filtering in the mobile app. In the iOS and Android app, Orin’s generated reply passes through a server-side content filter before it is shown to you. If the filter detects commercial content, the reply you see is replaced with a short neutral message instead. In the mobile app, the version of Orin’s reply that we store in your history is the filtered version, not the original text from the AI provider.

What we store, and for how long. Our own copy of your Orin conversations (your messages and Orin’s replies) lives in your account so you can return to them. We keep this history until you delete your account; we do not delete it on a fixed schedule. When you delete your account, your Orin conversations and messages are permanently deleted along with the rest of your data.

Your choices. You can choose not to use Orin. If you have used Orin and want your conversations removed, deleting your account removes them.

Where your data is stored

Your account and app data are stored with Supabase, our database and authentication provider, on managed cloud infrastructure. Conversation text you send to Orin is additionally processed by OpenAI as described above. Data may be processed in the United States. We use industry-standard safeguards, and access is restricted to what is needed to operate the service.

No third-party analytics, advertising, or tracking

We do not use third-party analytics, advertising, or tracking software. There is no Google Analytics, no advertising network, no Meta or TikTok pixel, no session-replay tool, and no data broker. Our analytics are first-party only — kept in our own database and used solely to run and improve Attune. We do not sell your personal information.

Push notifications

If you allow notifications, we send reminders such as your morning prayer and evening rest prompts, and occasional streak reminders. You can turn these off at any time from your device or browser notification settings, and from the notification preferences in your Attune profile. Turning them off stops the reminders.

Deleting your account

You can delete your account yourself, at any time, from within the app: open Profile, scroll to the Danger Zone at the bottom, choose Delete account, and confirm. This is immediate and permanent. It removes your profile, your onboarding answers, your progress and achievements, your push subscriptions, and your Orin conversation history. Deletion cannot be undone.

Children

Attune is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us at support@attuneapp.site and we will delete it.

Your rights

You have the right to access the personal information we hold about you, to correct it, and to delete it. You can correct most details in your profile and delete everything by deleting your account. For any other request, contact us at support@attuneapp.site.

If you are in the EU or UK (GDPR)

We process your information to provide the service you have asked for (performance of a contract) and, for optional things like analytics and notifications, on the basis of your consent or our legitimate interest in operating and improving Attune. You have the right to access, correct, delete, restrict, or object to processing, and the right to data portability. Where processing is based on consent, you may withdraw it at any time. You also have the right to lodge a complaint with your local data protection authority.

If you are in California (CCPA/CPRA)

You have the right to know what personal information we collect and how we use it, the right to request access to and deletion of that information, and the right not to be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under California law. To exercise your rights, contact us at support@attuneapp.site.

Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above, and for significant changes we will provide a clearer notice within the app. Continuing to use Attune after an update means you accept the revised policy.