Privacy Policy — Thrivid

1. Information We Collect

We collect information you provide directly, including your name, email address, profile information, habit data, and any finance data you manually enter, such as account names, balances, transactions, budgets, savings goals, and debts. We also collect usage data to improve our services, such as app interactions, device information, and feature preferences. When you sign in using Google, Google shares your basic profile information (name, email, and profile photo) with us. When you connect your Google Calendar, we receive calendar metadata and event data needed to sync your schedule with your tasks and habits. The mobile app requests read-only Calendar access; web two-way sync features may request permission to create, update, or delete Google Calendar events that you choose to sync.

2. How We Use Your Information

A guided habit coach for imperfect weeks. Choose one Future Self, start a manageable Practice, record what you did and review what to try next with Ori, our AI coaching support. AI requests can include your Practices, plans, reviews and selected account context. Enabled Growth Sections or an explicit request in your message can add calendar, finance or wellbeing context. Inspect the context and controls before sharing.

3. AI & Coaching Data

AI requests can include your Practices, plans, reviews and selected account context. Enabled Growth Sections or an explicit request in your message can add calendar, finance or wellbeing context. Inspect the context and controls before sharing. Conversations are stored in history. Ori can persist coaching memories across conversations; review, correct or remove memories in the memory controls. A conversation ending does not erase its data. Requests pass through OpenRouter to selected model providers. Provider retention and training settings depend on the route and applicable processing terms; we do not promise universal zero retention or no training by every provider. Ori is AI and can make mistakes. Review its suggestions. It is not therapy, medical or financial advice, or crisis support. For urgent danger, contact local emergency services.

4. Finance Data

Finance features are manual tracking tools. Thrivid does not currently connect to bank accounts, receive third-party transaction or balance feeds, store online banking credentials, move money, or execute trades. Financial data is limited to information you enter or import yourself, and it is encrypted at rest and in transit.

5. Google Services

Thrivid integrates with Google for Google Sign-In, Google Calendar sync, Google Play billing, and Android app distribution. Google Sign-In lets you authenticate with your Google account, and Google shares your name, email, and profile photo with us. Google Calendar sync lets you import calendar events into Thrivid; features that explicitly sync Thrivid events back to Google Calendar may request write access for those events. You can revoke Google Sign-In and Calendar permissions at any time through your Google Account settings at myaccount.google.com/permissions. Google processes your data in accordance with Google's Privacy Policy.

6. Social & Squads

Squad names, descriptions, and member lists are visible to other squad members. Messages and posts within a squad are shared with all members of that squad. Direct messages are private between participants. We retain messages for the lifetime of the squad or conversation unless a deletion is requested. Public content (e.g., shared achievements) may be visible to other users depending on your privacy settings.

7. Third-Party Subprocessors

8. Data Retention Periods

Conversations are stored in history. Ori can persist coaching memories across conversations; review, correct or remove memories in the memory controls. A conversation ending does not erase its data. Use Settings to request an export or account deletion and inspect memory controls. Deletion has a grace period and durable cleanup; provider retries and historical backups can outlast the initial request. See the Privacy Policy for scope and exceptions. Browser storage duration is not server retention. Actual GA/PostHog server retention and replay availability depend on the deployed project settings; no fixed server-retention period is asserted here. Clearing browser storage does not erase previously collected provider records.

9. Cookies & Tracking

Optional analytics providers are Google Analytics 4 (Google) and PostHog. After analytics consent, they receive permitted usage events and sanitized route information. PostHog can provide masked replay on allowed public routes; sensitive surfaces are blocked. Google Sign-In, Paddle, OpenRouter/model providers and Sentry serve separate authentication, billing, AI and diagnostics roles; availability depends on configured features. GA can set _ga and _ga_* cookies; Google defaults can last up to two years unless configured otherwise. PostHog is configured for localStorage persistence (ph_*); localStorage has no automatic browser expiry. thrivid_cookie_consent stores the browser consent choice separately. Authentication and payment storage are not analytics consent. Optional analytics load only after acceptance. Use Cookie preferences in the footer to change your choice; declining stops future capture. You may also clear provider cookies/localStorage in your browser. This does not cancel billing, delete your account or request erasure of existing analytics records.

10. Children's Privacy

Thrivid is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

11. Data Sharing

We do not sell your personal information. We may share data with service providers who help us operate our platform, but only as necessary to provide our services. We may disclose data if required by law or to protect our rights and safety.

12. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS 1.3) and at rest (AES-256). However, no method of transmission over the internet is 100% secure.

13. International Data Transfers

Thrivid is operated from the United States. Your data may be transferred to and processed in the United States or other countries where our subprocessors operate. By using Thrivid, you acknowledge that your information may be transferred to jurisdictions that may not provide the same level of data protection as your country of residence. We take appropriate safeguards to protect your data during international transfers.

14. Your Rights

Use Settings to request an export or account deletion and inspect memory controls. Deletion has a grace period and durable cleanup; provider retries and historical backups can outlast the initial request. See the Privacy Policy for scope and exceptions.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a new "Last updated" date and, for significant changes, by providing notice through the app or via email. Your continued use of Thrivid after any changes constitutes acceptance of the updated policy. We encourage you to review this page periodically.

Contact

If you have questions, please contact us at [email protected].

This Privacy Policy is part of our Terms of Service. Please also review our Cookie Policy for details on how we use cookies and similar technologies.