Privacy Policy

Welcome to Reframer. We believe your mind is your most private space, and your data should be treated with the same respect. This Privacy Policy explains how we collect, use, protect, and handle your personal information when you use the Reframer iOS app, Apple Watch companion app, Mac app, and related services (collectively, the "App").

Reframer is designed as a self-reflection and cognitive reframing tool. It is not a clinical, medical, or crisis intervention service. We prioritize strict data minimization, vetted API partners, and absolute transparency regarding how your data is processed.

Transparency Note: To provide advanced AI reframing, Reframer is not a fully offline, on-device app. We utilize secure cloud infrastructure to process your entries, which is detailed extensively below.

1. Information We Collect

We only collect information that is strictly necessary to provide and improve the Reframer experience.

A. Information You Provide to Us

• Account Information: If you choose to create an account (via email or Sign in with Apple), we collect your email address, name, and profile photo (if provided). If you use "Guest Mode," this information is not collected and your data remains strictly on your device.
• User-Generated Content: When you use the app, you may input text or use voice dictation to record your thoughts. We also collect your pre- and post-session mood ratings, arousal check-ins, and generated reframes.
• Profile Settings: Information you set in your profile, such as your country, to localize crisis resources.

B. Information Collected Automatically

• Ephemeral Location Data: To provide localized crisis safety resources, we may briefly use your IP address to determine your general region/country. This data is processed instantly, is never stored, and is never linked to your identity.
• Device & Usage Data: We collect basic, anonymized crash reports and app usage analytics to help us fix bugs. This data cannot be used to identify you.

2. How We Use Your Information & Legal Basis

Under global data protection laws (including GDPR and UK GDPR), we must have a valid "legal basis" to process your data. We use your data solely to deliver the Reframer experience:

3. How We Process AI, Journal Data, and Safety Screening

Because Reframer utilizes Artificial Intelligence to help reframe thoughts and ensure your safety, we have implemented a strict, privacy-first architecture.

When a user submits a thought to reframe, the text is sent to an Edge Function, which sends it to Anthropic's Claude API to generate the response.

A. The Two-Layer Safety Screen

Before generating a reframe, your input goes through a two-step safety check:

1. Layer 1 (On-Device): Your thought is first scanned locally on your device for immediate crisis keywords or spam. No data leaves your device during this step.
2. Layer 2 (AI Safety Pre-Screen): If Layer 1 is cleared, the text is securely transmitted via our backend (Supabase Edge Functions) to our AI sub-processor, Anthropic (utilizing Claude), strictly to classify if the text requires crisis intervention.

B. Generating the Reframe

If the thought clears the safety checks, it is sent to Anthropic (utilizing Claude's Sonnet model) to generate the CBT reframe. Your name, email and other personal information is always hashed out before being sent to Anthropic.

• Crisis Protection: If your text is flagged as a crisis at any point, it is never sent to the generation step. Instead, you are immediately routed to offline-capable crisis resources.
• Offline Fallback: If you lose internet connection, Reframer uses a localized, on-device pattern-matching generator so you can still receive support without transmitting any data.

C. Anthropic API Privacy Guarantee (Zero AI Training)

Reframer calls Claude through Anthropic's commercial API, not the consumer Claude.ai service. We partner exclusively with enterprise-grade AI providers. Under our API agreement with Anthropic:

• Zero AI Training: Anthropic's commercial/API terms explicitly exclude that data from being used to train their models by default. Your entries are never used to train foundational AI models.
• No Advertising: Your data is never sold, analyzed, or shared for advertising purposes.
• Data Retention: API requests are processed ephemerally or retained for the absolute minimum time required by our sub-processors for trust and safety compliance, after which they are permanently deleted.

4. Data Security, Storage, and Transfers

• Encryption: All network traffic between your device, Supabase, and Anthropic travels over secure TLS/HTTPS connections. Furthermore, data at rest in Supabase's Postgres database is encrypted at the infrastructure level.
• International Data Transfers: If you are located in the UK, EU, Canada, or the Middle East, please note that your data may be transferred to and processed in the United States or other jurisdictions where our sub-processors (Supabase and Anthropic) operate. We ensure that appropriate safeguards, such as Standard Contractual Clauses (SCCs) or explicit user consent, are in place to protect your data under applicable laws like the GDPR and regional Personal Data Protection Laws (PDPL).

5. Biometrics, Voice, and Apple APIs

To provide a seamless Apple ecosystem experience, Reframer uses several native Apple APIs:

• Face ID / Touch ID: Reframer offers an App Lock feature. We do not collect, store, or have access to your biometric data. Authentication happens entirely on your device's Secure Enclave.
• Voice Dictation: If you use voice-to-text, the audio is processed by Apple's native speech recognition. Reframer only receives the transcribed text; we do not record or store your voice audio files.

6. Your Global Data Rights

Regardless of where you live, you are in control of your data. We grant all Reframer users the following rights, compliant with CCPA/CPRA, GDPR, PIPEDA, and Middle East PDPL regulations:

• Right to Access & Portability: You can view all your saved journal entries and insights, and export your data at any time using the PDF report feature.
• Right to Rectification: You can edit or correct your profile information and journal entries at any time.
• Right to Delete (Right to be Forgotten): You can delete individual journal entries, or delete your entire account and all associated data permanently directly from the App's settings menu (Menu > Manage Profile > Delete Account). Upon account deletion, your data is instantly removed from our active database servers — and cannot be restored if you change your mind later.
• Withdrawal of Consent: If you are utilizing our cloud services, you may withdraw your consent at any time by switching to Guest Mode or deleting your account.
• US Residents (CCPA/CPRA) — "Do Not Sell or Share My Personal Information": Reframer does not sell, rent, or trade your personal data or journal entries to data brokers, advertisers, or any third parties. We only share data with the services that run the app (Supabase + Anthropic).

7. Children's Privacy

Reframer is not intended for use by children under the age of 13 (or under 16 in certain EU/EEA jurisdictions, or the minimum legal age in your region). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete it immediately.

8. Medical & Crisis Disclaimer

Reframer is a self-help tool utilizing cognitive behavioral principles. It is not a replacement for professional therapy, psychological treatment, or emergency crisis intervention.

• If you are experiencing a crisis, the app provides hardcoded, offline-accessible emergency numbers for over 20 countries.
• While we utilize AI to help route users to safety resources, the app cannot actively monitor your well-being, and our support team cannot dispatch emergency services.

9. Changes to This Policy

We may update this Privacy Policy periodically. If we make material changes (especially regarding how we handle your journal data or our sub-processors), we will notify you within the App before the changes take effect.

10. Contact Us & Privacy Officer

If you have any questions or concerns about this Privacy Policy, how your data is handled, or wish to exercise your data privacy rights, please contact our Data Protection/Privacy Officer at: