Security
Last updated: May 2026. How we protect the Service and your data.
What we do
- Store journals, mood logs, and recovery notes on your device by default (on-device processing)
- Encrypt connections with TLS (HTTPS)
- Let you export or permanently delete your data anytime
- Keep optional Apple Health / Health Connect access fully under your control
- Use plain-language privacy explanations, not dense legal templates
What we never do
- Sell your anxiety or mental-health data to advertisers or brokers
- Use your journal entries, mood logs, or health readings to train external AI or language models
- Embed hidden third-party ad trackers in the app
- Require your camera or microphone to use core panic tools
- Record your voice, or send your full journal entries anywhere without explicit consent
Security overview
Protecting sensitive wellness data is central to CalmShield. We use industry-standard practices to safeguard accounts and infrastructure.
Data in transit
Connections between the app, website, and our servers use TLS encryption (HTTPS). Do not use the Service on untrusted public Wi‑Fi without standard device protections.
Authentication
Account sign-in is handled through Firebase Authentication. We do not store your raw password on CalmShield servers.
Local-first sensitive data
Journal entries, mood logs, and many recovery records are stored on your device by default. This limits exposure if cloud systems are compromised, though you should still protect your device with a passcode or biometrics.
What we do not do
We do not sell user data. We do not embed hidden advertising trackers in the app. We do not use journal entries, mood logs, or health readings to train external AI or language models. We minimize third-party SDKs that collect sensitive information.
Reporting security issues
If you believe you have found a security vulnerability, please email {email:support} with details. We appreciate responsible disclosure and will respond as quickly as we can.