This is the privacy notice for Mr. Anxiety. It tells you what we collect, why, where it lives, how long we keep it, and your rights. It also describes optional features — cloud AI, subscriptions, advertising — we may offer in future and how we'd handle your data if we did. See also the Terms of Use and EULA.
Who we are
the Mr. Anxiety app (breathing and reflection) is operated by chaimagal, Modiin, Israel. We are the data controller.
What we collect
Mr. Anxiety is a wellness tool, not a medical device, and its data footprint is tiny.
| Category | Includes | Why |
|---|---|---|
| Breathing sessions | Technique, target duration, completed-at | History and streaks |
| Mood checks | Better, same, or worse | To let you notice the effect of practice |
| Reflections | The note (≤ 280 chars), the reply, your language, a path tag (llm, crisis, empty, unsupported) | To show reflect history if you save it |
| Telemetry | Light in-app events (started, completed, aborted; technique changed; reflect generated) | Improving the app, scoped to your user id |
| Purchase status | Store receipt ID, product ID, subscription state (if you buy anything) | Unlock paid features |
| Settings | Dark mode, sounds, haptics, language, reflect toggle, session length | Stored on device |
We do not collect audio, camera, location, contacts, or health-app data unless a future feature explicitly needs them and you consent.
AI and data processing
When Reflect is enabled, a small language model (Gemma 3 1B-IT) runs on your phone. Your note and the reply never leave the device during generation. Saving the reflection writes it to your account.
We may add cloud-based AI features in future — for example, a larger model for deeper summaries, or a voice-transcribed mood journal. Before enabling any cloud AI feature, this section will name the cloud AI provider, the region, what we send it, what it retains (we will contractually require zero model-training on your content), and how to turn the feature off. Cloud AI will always be opt-in in Settings.
Where your data lives
Supabase (EU), Postgres with RLS keyed to your user id. TLS transport. Short-lived JWTs. No server-side business logic touches your rows beyond standard Postgres.
Sharing and third parties
No social features. We do not sell your data, and we do not use it to train AI models without your explicit, granular opt-in.
Processors used today:
- Supabase (Ireland / EU) — hosting, authentication, database.
- Apple and Google — distribution and store purchases.
Processor categories we may engage in future, each of which will be named here before it is enabled: cloud AI inference; crash reporting and product analytics; advertising networks and consent management platforms; customer support tooling. All processors are bound by written data-processing agreements.
Subscriptions and payments
Mr. Anxiety is free to install. If we introduce paid features or a subscription, purchases are processed exclusively through Apple's App Store or Google Play. We never see, receive or store your card or bank details; we only receive a receipt (product ID, purchase time, subscription status) used to unlock paid features. Subscriptions auto-renew under the store's terms and are cancelled in your Apple ID or Google account. Statutory withdrawal and cancellation rights (EU 14-day, UK, Israeli Consumer Protection Law, California ARL, Australian ACL) are not affected by these terms.
Advertising
Mr. Anxiety does not show advertising today. If we introduce advertising, this section will be updated to identify the ad partners, describe whether targeting is contextual or behavioural, and document the data they receive.
Regardless of any future advertising change: we will not knowingly serve advertising to users we believe to be under 16; we will not permit ad partners to target based on sensitive categories (mental-health, anxiety, crisis indicators, religion, political views, sexual orientation); non-essential ad tracking will be opt-in in the EU/EEA/UK/Brazil; a "Do Not Sell or Share" control will be available to California and similar-state users.
International transfers
Account data is stored in the European Union. Transfers outside the EU (for example, to a US-based cloud AI provider) are covered by an adequacy decision where one applies, or by the European Commission's Standard Contractual Clauses with a transfer impact assessment and appropriate supplementary measures.
Retention and deletion
Sessions, mood checks, reflections, telemetry and purchase receipts can each be deleted from inside the app. Deleting your account removes all of the above within 30 days. Backups that contain your data roll off on their own lifecycle (up to 35 days) and are never restored to active systems without re-applying deletions.
Your rights
GDPR, UK GDPR, CCPA/CPRA, Israeli Protection of Privacy Law, Brazil's LGPD, Canada's PIPEDA and similar laws grant access, correction, export, deletion, restriction, objection, and consent-withdrawal rights. Email support@chaimagal.com; we respond within 30 days (extendable to 60 with notice).
Not a medical device
Mr. Anxiety is not diagnostic or therapeutic. It does not detect panic attacks or anxiety disorders. If you are in crisis, contact your local emergency services. AI output, including any future cloud-generated content, is not medical advice.
Children
Not directed at children under 13. We do not serve advertising to minors.
Security and changes
TLS, short-lived tokens, RLS, encryption at rest. 72-hour breach notification to the supervisory authority where required.
Material changes — including enabling cloud AI, introducing subscriptions, or introducing advertising — update the date at the top and are notified in-app and by email (where we hold a verified address) at least 30 days before taking effect.