Our privacy promise
Your most private thoughts should stay private. What we do and never do, in plain language, before the legal stuff
What we do
- Store journals, mood logs, and recovery notes on your device by default (on-device processing)
- Encrypt connections with TLS (HTTPS)
- Let you export or permanently delete your data anytime
- Keep optional Apple Health / Health Connect access fully under your control
- Use plain-language privacy explanations, not dense legal templates
What we never do
- Sell your anxiety or mental-health data to advertisers or brokers
- Use your journal entries, mood logs, or health readings to train external AI or language models
- Embed hidden third-party ad trackers in the app
- Require your camera or microphone to use core panic tools
- Record your voice, or send your full journal entries anywhere without explicit consent
Full privacy policy
Last updated: November 2026. Applies worldwide.
Your data stays yours
Personal entries like journal notes, mood logs, courage logs, and recovery data are stored primarily on your device. We do not sell your anxiety or mental health data to advertisers or data brokers.
What we collect
If you create an account, we store authentication credentials via Firebase. Usage patterns may be processed locally on your device to personalize recommendations. The optional weekly reflection may send recovery metrics to our servers to write that recap. We never send your full journal contents without explicit consent.
Health data
Apple Health and Health Connect integrations are optional, read-only, and controlled by you. When you connect them, CalmShield can read sleep duration, heart rate variability, and resting heart rate that those platforms already store, including samples an Apple Watch has written into Apple Health. CalmShield compares those values with a baseline on your phone and can suggest a lighter plan. It does not detect a panic attack in real time, and it does not continuously monitor breathing rate. You can disconnect at any time in app settings. Health readings stay on your device unless you turn on account sync.
AI and model training
CalmShield does not record your voice. Journal entries, mood logs, and health readings are never used to train external AI or language models. An optional weekly recovery summary is written on your device from numbers you already logged. If you are signed in and leave the server recap on, it receives those recovery metrics, not your full journal. SOS, Wave Coach, and night mode work without that feature.
Offline and downloads
Downloaded audio sessions are stored on your device. You can delete downloads and local data from the app at any time.
Third parties
We use Firebase for authentication and may use cloud infrastructure for optional synced features. We do not share personal health information with third parties for marketing purposes.
This website
calmshield.app runs on Cloudflare. We count visits with Cloudflare Web Analytics, which uses no cookies or local storage and does not fingerprint you. It shows us totals, such as page views, referring sites, countries, and page speed, not a profile of any one visitor.
Your rights
You can export or delete your data from within the app settings. For data requests, contact us at {email:support}. EEA and UK users. See the GDPR section below.
Changes
We may update this policy as the app evolves. Material changes will be communicated through the app or this website.
GDPR & UK GDPR
Additional information for users in the EEA, UK, and Switzerland.
Who this section is for
If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, this section describes how CalmShield processes your personal data under the EU General Data Protection Regulation (GDPR), UK GDPR, and similar laws.
Data controller
For the purposes of GDPR, the data controller is the entity operating CalmShield. Contact: {email:support}. If we appoint an EU or UK representative, their details will be published on this page.
Special category data
Mood logs, journal entries, panic records, and anxiety-related information may qualify as special category personal data (data concerning health) under Article 9 GDPR. We process this data only where permitted by law, typically with your explicit consent when you use those features, or where necessary to provide the Service you request.
Legal bases for processing
We rely on the following legal bases depending on the activity:
- •Contract: to provide the app, account, and features you sign up for
- •Consent, for optional features (weekly reflection, health integrations, marketing emails if offered)
- •Legitimate interests: to secure the Service, prevent abuse, and improve reliability (balanced against your rights)
- •Legal obligation: where we must comply with applicable law
International transfers
Your data may be processed in countries outside the EEA/UK (for example, where our cloud or authentication providers operate). When we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms required by UK law.
Retention
We keep personal data only as long as needed for the purposes described in our Privacy Policy, while your account is active, to provide the Service, and as required by law. Data stored locally on your device is retained until you delete it or uninstall the app.
Your GDPR rights
Subject to applicable law, you may have the right to:
- •Access your personal data and receive a copy
- •Rectify inaccurate data
- •Erase your data (“right to be forgotten”) in certain circumstances
- •Restrict or object to certain processing
- •Data portability: receive your data in a structured, machine-readable format where applicable
- •Withdraw consent at any time (without affecting prior lawful processing)
- •Lodge a complaint with your local supervisory authority
How to exercise your rights
Email {email:support} with the subject line "GDPR Request." We will respond within one month, or inform you if an extension is required under GDPR. You can also export or delete much of your data in app settings.
Supervisory authorities
If you believe we have not handled your data properly, you may complain to your local data protection authority. A list of EU authorities is available from the European Data Protection Board (edpb.europa.eu). UK residents may contact the Information Commissioner's Office (ico.org.uk).
Related: Terms & conditions · Consumer health data (US) · Cookie policy · Trust Center