InnerSmith Privacy Policy

Version 1.0 · Effective date: October 28, 2026 · InnerSmith, Inc.

InnerSmith, Inc. ("InnerSmith", "we", "us") runs the InnerSmith app and the website innersmith.com (together, the "Services"). This policy explains what information we collect, why, who receives it, how long we keep it, and the choices you have.

InnerSmith is a wellness app. We are not a healthcare provider, not a medical device, and not a covered entity or business associate under HIPAA, so HIPAA does not apply to the Services. We protect your information under this policy and under the state laws that cover consumer health data. Our separate Consumer Health Data Privacy Policy (innersmith.com/health-data-privacy) describes additional rights, particularly for people in Washington, Nevada and Connecticut.

The short version

• Your journal entries stay on your phone. We never receive them.
• We ask before we collect your mood check-ins, your wellbeing answers or your listening history, and you can change your mind at any time.
• We don't ask about your religious beliefs.
• We don't sell your personal information, and we don't share it for targeted advertising. No advertising or analytics company receives your moods, answers, listening history or journal entries.
• You can delete your account, and what we hold about you, from inside the app.

1. Who this policy applies to

The Services are for adults aged 18 and over and, at launch, are offered in the United States only. This policy applies to everyone who uses the app or visits our website.

2. Information we collect

2.1 Information you give us

• Account information. Your name and email address, or the identifier your sign-in provider gives us when you sign in with Apple or Google (see section 6.2). We keep only a record that you confirmed you're 18 or over, and when; we don't keep your date or year of birth.
• Wellbeing answers. The goals you choose when you set up the app, such as sleeping better, easing stress or feeling less alone. These are framed as goals and feelings, not conditions, and we never use them to label you with any condition.
• Mood check-ins. The moods you select, such as Calm, Stressed, Anxious or Tired, and when.
• Support messages and feedback. What you send us when you contact us.

2.2 Information created when you use the Services

• Listening history. Which sessions you start and finish, when, and for how long. Because listening to mental-wellness content can say something about your health, we protect this history in the same way as the information in section 2.4.
• Subscription information. Your plan, trial status and renewal dates, which Apple (and Google, once the Android app is available) tells us. We never receive your payment card details.
• Device and technical information. Device model, operating system, app version, language, time zone, IP address, crash reports and your push notification token. These can be linked to the other information we hold about you, so we protect them accordingly.
• Advertising measurement. We use Apple's privacy-preserving attribution (AdAttributionKit and SKAdNetwork) to learn, in aggregate, whether an advertising campaign led to installs. Apple designs this so that no individual is identified to us or to the advertising network. We do not use advertising SDKs that identify you, and we do not collect your device's advertising identifier. See section 6.3.

2.3 Information that stays on your device

• Journal entries are stored on your device and, if you use iCloud, in your own private iCloud account. They are never sent to us. They are protected by your iPhone's standard data protection and are included in your device and iCloud backups.

Because we don't hold this content, we can't recover it for you. If you delete the app or lose your phone, it may be lost.

2.4 Sensitive information

Wellbeing information. Your wellbeing answers, mood check-ins and listening history can reveal something about your mental health. We ask for your consent in the app before we collect answers, moods or listening history, and the app still works if you say no.

Religious beliefs. We don't ask about faith or religion. If we add faith content in the future, we'll update this policy first and make any question about it optional.

We use sensitive information only to provide and personalize the Services you ask for. We never send it to advertising, attribution or analytics companies.

3. How we use information

• To provide the Services, including your account, sessions and subscriptions.
• To personalize your experience, such as suggesting sessions based on your wellbeing answers, mood check-ins and listening history.
• To send notifications you've agreed to receive.
• To respond to support requests and feedback.
• To keep the Services secure and prevent fraud and misuse.
• To measure our advertising in aggregate, as described in section 6.3.
• To comply with the law and enforce our Terms of Service.

We don't use sensitive information to decide which ads you see anywhere, and we don't make decisions with legal or similarly significant effects about you based solely on automated processing.

3.1 De-identified and aggregated information

We may turn information into de-identified or aggregated statistics, such as how many people used a type of session, to run and improve the Services. We won't try to re-identify anyone from this information, and anyone we share it with must agree not to either.

4. Consent for wellbeing information

Before we store any wellbeing answer, mood check-in or listening history on our servers, we ask for your consent on a separate screen in the app. This consent is separate from accepting our Terms of Service, is not pre-ticked, and can be withdrawn at any time in Settings › Privacy. If you decline or withdraw, the app still works; we stop collecting this information and delete what we hold within 30 days. We record which version of the consent you saw and when.

5. AI features

The app doesn't include an AI chat feature, and we don't send your information to any AI provider. If we add one, we'll update this policy before it launches and ask for your agreement in the app before any of your messages are sent to an AI provider. The voices that narrate our sessions are generated by AI; that involves our content, not your information.

6. Who receives information

6.1 Service providers

These companies provide services to us under contracts that require them to use information only on our instructions and to protect it. This list was last updated on October 28, 2026, and we keep it current.

6.2 Sign-in providers

You can sign in with Apple, Google or an email address. If you use Apple or Google, that company learns that you signed in to InnerSmith and gives us the account identifier, name and email address (or Apple's private relay address) that the sign-in needs. Sign-in providers act under their own privacy policies for the sign-in itself. Nothing about your use of InnerSmith is sent to any sign-in provider.

6.3 Advertising measurement

We advertise InnerSmith on other platforms. To learn whether those ads work, we use only Apple's privacy-preserving attribution (AdAttributionKit and SKAdNetwork), which reports campaign results in aggregate without identifying any person to us or to the ad network. We don't use Meta, TikTok, Google or other advertising SDKs that identify you, we don't build retargeting or lookalike audiences, and we don't send anyone your email address, hashed or otherwise. No advertising partner ever receives your wellbeing answers, mood check-ins, listening history or journal entries. If this changes, we'll update this policy and ask for your consent first where the law requires it.

6.4 Legal requests

We disclose information to the government or other parties only when the law requires it, for example under a valid subpoena or court order, or when we believe in good faith it's needed to prevent imminent harm to someone. We review every request, ask for valid legal process, and where the law allows we narrow or object to requests we consider overbroad, and tell you before we disclose. We don't hold your journal entries, so we can't provide them.

6.5 Other disclosures

• Business transfers. If InnerSmith is involved in a merger, acquisition, financing or sale of assets, subject to this policy.
• With your permission. In any other case, only if you ask us to or agree.

7. How long we keep information

We keep information only as long as we need it, and automated deletion enforces the periods below.

8. Your choices and rights

8.1 Choices in the app

• Delete your account in Settings › Account › Delete Account. Deleting your account does not cancel a subscription; cancel it in your Apple ID settings (or Google Play, on Android) first.
• Withdraw consent to wellbeing information in Settings › Privacy. We stop collecting answers, moods and listening history and delete what we hold.
• Turn off notifications in the app or your device settings.

8.2 Do Not Sell or Share

We don't sell personal information, and we don't share it for cross-context behavioral advertising, so there is currently nothing to opt out of. If that ever changes, we'll add a "Do Not Sell or Share My Personal Information" control before we start and honor it. On our website we treat a Global Privacy Control signal from your browser as a request to opt out of any sale or sharing.

8.3 Your privacy rights

Wherever you live in the United States, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct inaccurate information;
• delete your information;
• stop any sale or sharing of your information for targeted advertising (we do neither); and
• limit our use of sensitive information. We already use it only to provide the Services you ask for.

Signed-in users can make requests in the app, and signing in is how we confirm it's you; we won't ask for identity documents. Anyone can also email [email protected]. We respond within 45 days. If we need more time, we'll tell you and may take one further 45-day extension. An authorized agent can act for you with your signed permission. We won't treat you differently for using your rights.

We can't give you copies of your journal entries, because they're stored only on your device.

Appeals. If we decline your request, you can appeal by emailing [email protected] with "Appeal" in the subject line. We respond to appeals in writing within 45 days, explaining what we decided and why. If you're not satisfied, you can contact your state attorney general.

8.4 Additional information for California residents

Since launch, we have collected these categories of personal information, from the sources and for the purposes in sections 2 and 3, and disclosed them to the service providers in section 6: identifiers; customer records; commercial information (subscriptions); internet or other electronic network activity; approximate location inferred from IP address; sensitive personal information (information about mental wellbeing); and inferences about content preferences. We have not sold or shared personal information, including sensitive personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We use sensitive personal information only for the purposes California law allows without a "limit" right, but you may still ask us to limit it as described above.

9. Security

We protect information with safeguards including encryption in transit (HTTPS) for all connections, encryption at rest provided by our hosting providers, and production access limited to a small number of named engineers connecting from approved network addresses. Journal entries never reach our servers. No system is completely secure, and if a breach affects your information we'll notify you as the law requires. To report a security issue, contact [email protected].

10. Children

The Services are only for adults aged 18 and over. We don't knowingly collect information from anyone under 18. If we learn that we have, we delete the account and its information. A parent or guardian who believes a child has used InnerSmith can contact [email protected]. We never sell or share information about anyone under 18.

11. Where information is processed

At launch the Services are offered in the United States. We store information on Amazon Web Services in the United States. The app and its content are built and supported for us by a software development and support provider in India under a written contract with us; its staff may access user information from India for support and engineering, under access controls and confidentiality terms, which means your information may be transferred to and accessed from India. We'll expand this section before offering the Services in the United Kingdom or the European Union.

12. Changes to this policy

If we make a material change, we'll tell you in the app or by email at least 30 days before it takes effect. We won't use or share your wellbeing information in a new way without asking for your consent first. The effective date at the top shows when this policy last changed.

13. Contact us

InnerSmith, Inc. has a Privacy Lead, an officer of the company, who is responsible for this policy. You can reach the Privacy Lead at [email protected].

InnerSmith, Inc.
2810 N Church St, Wilmington, DE 19802
Email: [email protected]