Privacy Policy

Designed CCPA-first because the product collects what California law classifies as sensitive personal information: self-reported mental and physical health data. That triggers stricter handling obligations and a "Right to Limit Use" notice.

Last updated: 2026-08-08

2026-08-04 change: clarified SMS coverage — U.S. and Canadian mobile numbers only (factual clarification of existing behavior).

1. Who we are

All You Can App, Inc. ("we," "us," "our") operates the website and application at www.allyoucan.app (the "Service").

For privacy questions: support@allyoucan.app For legal notices: admin@allyoucan.app

We refer to users of the Service as directors throughout the product; for this Policy we use "you" and "your."

2. Scope

This Policy explains what personal information we collect when you use the Service, how we use it, who we share it with, how long we keep it, and the rights you have to access, correct, delete, or limit how we use it.

By using the Service you agree to this Policy and our Terms of Service. If you do not agree, do not use the Service.

The Service is for adults 18 and older only. We do not knowingly collect information from anyone under 18. See Section 11.

3. Information we collect

We have organized the categories below to match California Consumer Privacy Act ("CCPA"/"CPRA") definitions, so the same list serves the "Right to Know" disclosure that follows in Section 12.

3.1 Identifiers

Name, email address, account password (hashed), unique user ID, device identifiers, IP address.

Also collected when you opt in to specific features:

• Mobile push token + platform (iOS or Android). Recorded on directors.push_token when you grant OS-level notification permission on the mobile app. Used to send native push through Expo (see §5.1) → Apple APNs / Google FCM. Cleared when you revoke permission or uninstall the app.
• Web push subscription (browser endpoint + P256DH + auth secrets). Stored per-browser in web_push_subscriptions when you opt in to browser push. Cleared when the browser revokes the subscription or when we detect a permanently invalidated endpoint (HTTP 404/410) at delivery time.
• Discord user ID + username. Collected when you voluntarily link Discord in Settings → Subscription (or, while our waitlist was open, via a waitlist link — see §3.8). Used solely to sync your Discord community role and, where enabled, to deliver Discord DM notifications.
• Support-contact Discord user ID + username (buddies / body doubles who opt in to Discord DM alerts). Collected when a buddy completes Discord OAuth via the token-authenticated /buddy-confirm/[token]/link-discord page or when you enter their Discord ID / handle manually in Settings → Support Network. Used solely to deliver Discord DM alerts on your behalf, when both you and the buddy have enabled that channel.
• Per-contact director alias (supportcontacts.director_alias). Optional name you set per support contact so a wellness buddy or body double sees you by the name they know you by, rather than your account name. Used only inside outgoing messages the Service sends to that contact.

Source: You, when you sign up; automatically from your device; you (per-contact alias and Discord fields), when you opt in.

3.2 Customer records

Billing name, billing address, payment-method metadata (card brand, last 4, expiration). We do not store full card numbers; full card data is held by Stripe.

Source: You, at purchase; Stripe.

3.3 Commercial information

Subscription tier, purchase history, refund history, trial status, add-on purchases (Calibration Bursts, Annual Tune-up).

Source: Your interactions with the Service; Stripe webhooks.

3.4 Internet / network activity

Pages and screens visited inside the Service; features used; referring URL; approximate timezone; browser/OS metadata; basic performance/error logs.

Engagement telemetry. We record two structured event types to help us understand where directors get stuck and which features are useful:

• page_view — the route path you landed on, the platform (web or mobile), and, for the small allowlist of paths where the view mode is meaningful (e.g. /chart?view=day), that mode. Query string parameters outside that allowlist are DROPPED before storage. Path strings and phase names are capped at 64 characters each.
• phase_event — a milestone marker (enter, complete, abandon) inside a bounded flow (a check-in save, a project edit, an experience-shift activation card). The phase name and step are structural strings.

Privacy invariants that apply to telemetry (see also §6):

• Director-typed text is NEVER recorded in either event type.
• URL query parameters outside the per-path allowlist are NEVER logged.
• Device identifiers, IP address, and User-Agent are NEVER recorded on engagement events.
• Telemetry rows are stored with provider='engagement' and cost=0 in the same table used for AI cost accounting.

Source: Automatically when you use the Service.

3.5 Geolocation

Approximate location only (city/region level), inferred from IP address. We do not collect precise (GPS) location.

Source: Automatically from your IP.

3.6 Inferences

Computed signals such as zone classification ("GO," "Caution," "Stop") and stage-of-change estimates. These are derived from the information you provided; they are not bought from third parties.

Additional inferences computed since the last revision (each is an educational reflection of what you already told the Service — not a clinical assessment, see ToS §9):

• Boom-bust streak detection — pattern spanning your recent check-ins that identifies high-energy days followed by crashes. When identified, may surface an inline dashboard warning card and, where you opted in, a pacing notification.
• Sensory episode tracking (sensory_episodes) — start, end, strategies picked, strategies-used feedback, per-strategy disposition ("keep" / "discard" / "save for later"), and a per- director blocklist derived from your "discard" choices.
• Chronic flare episodes (chronic_flare_episodes) — preceding activity, condition tag, self-care used and missing, duration. Optionally synced to your calendar (via Google or iCal) when you opt in per-episode.
• Anticipation captures (check_ins.anticipated_depletion + depletion_confirmed) — your yes/maybe/no answer at the start of a day about whether you expect to end depleted, and your later yes/no confirmation. Feeds pattern detection.
• Mood-word learning (directors.phrase_extras.mood_word + phrase_suggestions) — when your alexithymia toggle is on, if you spontaneously name a feeling word in a check-in, you may be asked once whether the Service should remember that word for future reflection.
• Phrase blocklist (directors.phrase_blocklist) — director- controlled list of phrases the Service will NOT flag for future reflection or clarification. Crisis-tier categories are UNBLOCKABLE by design.
• Priority style choices (directors.priority_style_choices) — which of three priority-surfacing styles you've picked per experience (chronic / boom-bust / SED).
• Anticipated / dismissed / snoozed states — timestamp columns that control how often certain dashboard cards resurface.
• Recovery-commitment log (recovery_commitment_log) — when a Caution or Stop check-in surfaces the "commit to a recovery action" prompt and you pick a recovery tool, we record which tool you chose, whether you committed to do it now or later, an optional linked unscheduled task, and later (if you record it) how the recovery went (helped / didn't help + a spoons delta). One row per commitment; rows are permanent because they feed longer-term pattern reflection.
• Window of Tolerance metadata (check_ins.regulation_axis) — an internal hyper / hypo / neutral tag computed from signals you have already told the Service (urgency-phrasing text signal, boom-bust pacing state, chronic-flare state, recharge streak, anticipation answer, capacity number, identity, and — where applicable — sensory-episode accumulation). It is not surfaced in the product and does not name a clinical condition. It is used only to reorder your own toolkit picker so recovery tools that fit today's regulation direction appear higher in the list.
• Body-double offer state (directors.body_double_offer_*) — a dismissal timestamp and a last-shown timestamp for the dashboard "reach out to a body double" suggestion card, plus a cached per-day AI verdict when your ALLY-tier eligibility triggers the supplemental second-pass check (see Section 5.5). The cached verdict is a small strength label — weak / moderate / strong — and a short natural-language reason; it lives in your browser or device local storage keyed to today's date, so it does not accumulate across days on our servers.
• Sensory display presets (sensory_display_presets) — up to four director-authored snapshots of the five display preferences (theme + light/dark + typography emphasis + border style + page border) that you can apply on demand during a sensory episode. Snapshots contain only your chosen preferences — no dimensional data, no episode content.
• Phrase-suggestion dismissals (directors.phrase_suggestions_dismissed) — a cross-device sparse map of which phrase suggestions in Settings → My Words, My Way you have tapped "not this one" on, so we do not re-surface them on another device.

Source: Computed by the Service from Your Content.

3.7 Sensitive personal information (see also Section 6)

The Service collects information about your mental and physical health as it relates to your own self-reported wellness baseline, including:

• Sleep, energy, eating, focus, social-connection self-reports
• Self-described emotional state during check-ins
• Self-declared chronic-condition names and impacts (when you voluntarily enter them)
• Toolkit / recovery-action lists you author
• Optional self-identification information (e.g. neurodiverse identity, identity terms, pronouns) where you choose to provide it
• Chronic flare episodes (start, end, preceding activity, self-care used and missing) that you voluntarily log
• Sensory episodes (start, end, strategy picks and per-strategy feedback) that you voluntarily log
• Boom-bust / seasonal shift / chronic shift self-report toggles and per-experience preferences
• Anticipation self-reports (start-of-day expectation of depletion and end-of-day confirmation) when captured
• Mood-word learning entries where you have explicitly chosen to have the Service remember specific feeling words
• Per-condition flare markers on check-ins

This category is treated as Sensitive Personal Information ("SPI") under California law (Cal. Civ. Code §1798.140(ae)). We process SPI only as needed to provide the Service to you, and you have the right to limit its use as described in Section 12.

We do not sell SPI, do not share it for cross-context behavioral advertising, do not use it to train any third-party AI model, and do not disclose it to data brokers.

3.8 Waitlist (closed)

The Service is now generally available; you create an account at /sign-up. We previously operated a waitlist at /early while the Service was in pre-launch. The waitlist is now closed. If you joined it while it was open, we collected — and may still retain until you request deletion:

• Your email address (required).
• Your first name (optional).
• A neurodivergent self-identification (optional; "Prefer not to say" was available).
• Your beta-testing interest and update-subscription preferences.
• The timestamp at which you confirmed you were 18 or older and accepted the then-current version of these Terms + this Privacy Policy.

Source: You, when you submitted the waitlist form.

We used this information to email you a confirmation and waitlist updates and to invite an early cohort. A waitlist entry that never converted to a director account is retained until you request deletion (see Section 12); if you did sign up, your entry is linked to your director account for audit and analytics (e.g., time-on-waitlist metrics).

Optional Discord linking. The waitlist confirmation email included a link to voluntarily connect Discord. If you did, we recorded your Discord user ID and username on your waitlist row and the timestamp and version of the Discord consent text you agreed to, and used them to grant a community role and — once you converted to a director account — to carry the Discord link forward to your director profile. See ToS §6.10 for the community server terms.

For abuse prevention during the submission window, we logged a salted SHA-256 hash of the client IP on each submission attempt. Raw IPs were never persisted, and the hashes are not linked to any other identifier we hold.

3.10 Immediate-deletion consent receipts

When you use the phrase-triggered immediate-deletion path described in ToS §7.5, we record a consent receipt on your director row (timestamp, consent text version, and — where applicable — confirmation that you downloaded a frozen offline copy of your data). The receipt exists solely to demonstrate that you consented to the irreversible deletion and refund waiver at the moment of execution.

3.9 What we do not collect

• Government identification numbers (SSN, driver's license, passport).
• Precise GPS location.
• Biometric identifiers (fingerprints, face scans, voice prints).
• Genetic information.
• Religious or philosophical beliefs (except where you mention them voluntarily in free-text notes you author).
• Sexual orientation (except where you mention it voluntarily).
• Information from your contacts list, calendar, microphone, or camera, unless you explicitly enable a feature that requires it.

4. How we use information

We use the information described above only for the following purposes, each of which corresponds to a permitted business purpose under CCPA §1798.140(e):

• Operate the Service. Authenticate you, save your check-ins, display your toolkit, surface your decision tools, render the dashboard.
• Personalize the Service. Apply your zone profile, your toolkit, your decision tools, your language-mirroring preferences. On the Always-on AI and Calibration Burst tiers, an AI composer uses Your Content to tune the Service's responses to you; it does not train any model that affects other directors.
• Communicate with you. Send transactional email (welcome, reset, receipt, calibration-burst ended). With your consent, send product updates.
• Process payments. Through Stripe.
• Secure the Service. Detect abuse, prevent fraud, investigate incidents, maintain audit logs.
• Improve the Service. Aggregate, de-identified analytics on how features perform. We do not use Your Content as training data for shared models.
• Comply with law and enforce our Terms. Respond to legal process; defend or assert claims.

We will not use your information for any new purpose materially different from these without telling you and, where required, getting your consent.

4.1 SMS and text message communications

If you opt in to SMS text notifications (available for U.S. and Canadian mobile numbers only), the following applies to our mobile messaging program:

• What you receive. Recurring transactional messages for the notifications you enable — for example check-in reminders, toolkit nudges, deadline reminders, wellness-buddy and body-double introduction letters, and account messages such as phone verification. We do not send marketing text messages.
• Message frequency varies based on the notifications you enable and your activity.
• Message and data rates may apply, depending on your mobile carrier and plan.
• Opting out and help. Reply STOP to any message to opt out at any time, or HELP for help. You can also manage or withdraw SMS consent at any time in Settings → Notifications. Consent to receive text messages is not a condition of creating an account, making a purchase, or using the Service.
• We do not share your mobile information for others' marketing. No mobile information — including your phone number and your SMS consent/opt-in data — will be shared with, or sold to, any third parties or affiliates for their own marketing or promotional purposes. Your mobile number is used solely to deliver the messages you requested, through our messaging provider (Twilio), which acts as our processor and is contractually restricted to that purpose.

5. Who we share information with

We share your information only as described in this section. We do not sell your personal information for money or other valuable consideration. We do not share your personal information for cross-context behavioral advertising.

5.1 Service providers (processors)

Each is bound by contract to handle data only as we direct, to maintain appropriate security, and not to use the data for their own purposes:

If we add or change a major sub-processor, we will update this list and (for material changes) notify active directors in advance.

5.2 Other directors

By design, no other director can see Your Content. Row-Level Security (RLS) policies in our database scope every read and write to the account owner. The only exception is the Wellness Buddy / Body Double feature: when you invite a buddy and they accept, only the explicit information you choose to share with them is visible to them. You can revoke access at any time.

5.3 Legal and safety

We may disclose information when required by law, valid legal process, or to protect the rights, property, or safety of All You Can App, Inc., our directors, or the public. We narrowly scope any such disclosure and challenge over-broad requests where appropriate.

5.4 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction, subject to the receiving party honoring this Policy or notifying you of any change with the opportunity to object.

5.5 ALLY beta period (current)

"ALLY" is the name we give our AI helper — the "try a reframe" button on check-ins, the "what I heard" reflection, and future project-from-calendar proposals. Under the hood ALLY is Claude (made by Anthropic) running through our behavior contract.

ALLY is available as an opt-in feature. Access is managed by enrollment so we can keep quality and capacity in hand:

• ALLY is available to directors who have been enrolled AND have explicitly opted in at Settings → ALLY beta. Opt-in is recorded with a timestamp and the version of the consent text you agreed to.
• You can opt out at any time at the same page. Opt-out blocks all future AI calls on your account immediately. Past calls cannot be recalled.
• Bumping the consent text invalidates prior opt-ins and re-prompts. You will always know which version you agreed to.
• ALLY operates under Anthropic's standard published commercial terms: no training on our data, no sale, no sharing, with API inputs retained for up to 30 days for abuse monitoring. We asked Anthropic about their enterprise Zero Data Retention program (which would reduce that 30-day window to near-zero) in May 2026; Anthropic responded that our current usage volume does not yet qualify for that program. We are choosing to ship ALLY on the standard terms rather than hold the feature indefinitely. If Anthropic's posture changes — or if we re-qualify at a later date — this section will be updated and any change of substance will trigger a re-consent prompt.
• ALLY is explicitly not clinical. The model is instructed to step back and surface crisis routing (your buddy / 988 / Crisis Text Line) at any sign of acute distress, and to never play therapist.

Voice mode — additional consent. Voice input and voice read-aloud on /ally take their OWN consent on top of the ALLY beta gate, because they route audio through a different sub-processor (Deepgram for speech-to-text; OpenAI for text-to-speech). The voice consent text has its own version constant. The current version is v1.1, which names Deepgram explicitly and calls out the mip_opt_out=true invariant we send on every request. If you consented at v1.0 (which named a prior speech-to-text provider), you will be re-prompted to consent at v1.1 before the microphone will work again. Voice mode also requires an active AI subscription tier (Always-on AI or a calibration window). Text chat remains available whenever ALLY itself is available; voice is a strict superset gate.

Managed enrollment lets us learn responsibly before opening ALLY to every Always-on AI subscriber. If you would prefer not to participate, your account remains fully functional; ALLY simply doesn't activate.

5.6 Wellness buddies, body doubles, and safety alerts

Your wellness-buddy and body-double contact lists may receive messages from the Service on your behalf:

• Intro letters you initiate at onboarding orientation or by tapping "Resend invite" in Settings. Sent via Resend (email) or Twilio (SMS), based on what channels the buddy has enabled and what you provided.
• Safety alerts when your check-in indicates a Stop-zone state and you have not opted out of buddy alerts. Delivered via SMS, email, or Discord DM per the buddy's per-channel preferences (see next paragraph).
• Plan-together requests when a Stage-2 crisis follow-up card asks you to reach out to a buddy and you tap "Plan together with [name]" or "Reach out to [name]".

What data reaches non-directors — automatic messages. In automatic messages (intro letters, safety alerts, plan-together requests), only fields you explicitly ticked on the buddy or body-double form are surfaced — themes + support style + alert method (buddies); topics

• presence effects + session conditions + alert method (doubles). Those automatic messages NEVER include your chronic conditions, zone signals, neurodivergent identity, diagnosis, or any free-write check-in text.

Reports you choose to send. Separately, you can send a summary report to a support contact from Settings → Support Network. You pick the detail tier and channels, and — unlike automatic messages — a report may include information you select, such as your recovery tools or the warning signs you defined for yourself (wellness buddies), or a role, expectations, and task list you wrote (body doubles). This is shared at your direction, only to a contact who has accepted, only on channels they consented to, and never includes clinical labels (diagnosis or condition names) or raw check-in / project text. Because your buddy or double is a person you chose and not our agent, we do not control what they do with a report you send. You may preset a default report and turn on automatic sending rules (for example, on the contact's acceptance, or when a check-in reaches Caution or Stop); an automatic report contains only the content and tier you preset and is subject to the same acceptance + channel-consent limits as a manual send. See Terms of Service §7.6. (Added 2026-08-08; automatic-send rules added 2026-08-12.)

Recipient-side opt-out. After a support contact accepts your invite, the buddy-confirm page lets THEM opt out of specific channels (SMS, email, Discord DM) that you enabled on their row. Their preferences (supportcontacts.recipient_alert_prefs) win over yours — if they opt out of a channel, we skip it even if you enabled it.

Per-contact alias. The name that appears in outgoing messages is the alias you set for that contact (see §3.1). If no alias is set, we fall back to your account name.

Alert path is restricted to wellness buddies. The Service NEVER contacts a director's licensed clinical care team. Care-team contacts are stored so you can call or email them, not so we can message them on your behalf.

5.7 Feedback surface

The Service includes an in-product feedback textarea on /announcements. When you submit feedback, we transmit your typed comment to us by email (via Resend) with your account identity attached — email address, director ID, timestamp. Feedback is treated as non-confidential (see ToS §6.11) and we may act on it (fix bugs, ship features, change copy) without further obligation to you. We do NOT store the feedback body in our database beyond the outgoing email delivery record; email is the audit trail. You may withdraw feedback by contacting support@allyoucan.app and asking us to delete the relevant message.

6. What this Service is, and is not, from a health-law perspective

6.0 We are not a HIPAA-covered entity

The Service is a productivity tool. We are not a healthcare provider, health plan, or healthcare clearinghouse, and we do not operate as a business associate to any covered entity, under the U.S. Health Insurance Portability and Accountability Act ("HIPAA"). The self-reports you enter in the Service — the categories listed in Section 3.7 — are therefore not "Protected Health Information" ("PHI") as HIPAA defines that term. HIPAA does not govern our handling of that information.

That does not mean the data is unprotected. California's Consumer Privacy Act (CCPA/CPRA) classifies the same data as Sensitive Personal Information ("SPI"), and we treat it accordingly — see the additional operational limits in §6.1 below, and your right to limit our use of SPI in §12.5.

6.0.1 We do not provide medical, psychological, or clinical services

Nothing inside the Service constitutes a diagnosis, treatment plan, prescription, therapy session, or any other clinical activity. The Service is not:

• a medical device (as defined by the U.S. Food, Drug, and Cosmetic Act or by state medical-device statutes),
• a therapy platform, telemedicine service, or clinical decision support tool,
• a substitute for professional mental health, medical, or psychological care, and
• appropriate for the treatment of any diagnosed clinical condition (see Terms of Service §9 for the full non-clinical carve-out).

The GO / Caution / Stop zone labels the Service surfaces, and every pattern-detection surface (chronic-flare, sensory-episode, boom-bust, seasonal-experience-difference, Window-of-Tolerance regulation axis, recharge-danger streak, etc.), are educational reflections of what you already told the Service about yourself. They are not clinical assessments, they never name a neurodivergence or clinical condition you have not shared with the Service, and they never render a medical opinion.

6.0.2 We never contact your clinical care team

If you list a licensed clinician in Settings → Support Network → Care Team, we store the contact information solely so that you can reach that person. We never send email, SMS, Discord DM, or any other communication to your care team on your behalf. Automated alerts on Stop-zone check-ins are restricted at the code level to contacts you have designated as wellness_buddy or body_double, which by design require the recipient's own opt-in first (see Terms of Service §7.4 and Privacy Policy §5.6). This restriction is a load-bearing product invariant and any future change would require an explicit notice to you before it took effect.

6.1 Additional protections for Sensitive Personal Information

Because the Service handles health-adjacent self-reports (see Section 3.7), we apply these extra protections beyond what CCPA otherwise requires:

• Use is limited to providing the Service to you and the closely related operational purposes (authentication, fraud prevention, security audit logs, troubleshooting at your request, processing payment for the Service).
• We do not use SPI to infer characteristics about you for any advertising, profiling, or third-party purposes.
• We do not disclose SPI to advertising networks, data brokers, or analytics partners.
• We do not use SPI to train any AI model that benefits other directors. On AI tiers, SPI is used to personalize your rule set and knowledge bundle, scoped to your account.
• ALLY sub-processor opt-in is separate. SPI flows to our AI sub-processor (Anthropic) only when you have separately opted into the ALLY beta at Settings → ALLY beta (see §5.5) AND you are using an ALLY surface. Otherwise, SPI never leaves our infrastructure.
• You have the right to limit our use of SPI as described in Section 12.

7. Cookies and similar technologies

We use only essential cookies and session storage needed to keep you signed in and to remember UI preferences (theme, border weight, chevron-expanded state). We do not use:

• Advertising cookies
• Cross-site tracking pixels
• Third-party social-media trackers
• "Do Not Track" — we honor Global Privacy Control (GPC) signals instead, which is the current standard

For analytics we use first-party, privacy-preserving event counts (no Google Analytics, no cross-device fingerprinting). Aggregate cost and usage metrics are stored in our own database and never tied to your identity beyond what is needed for billing and abuse detection.

8. Data retention

Our retention is described in detail in PRICING.md and summarized here:

If you submit a deletion request under Section 12 or use Settings → Privacy & My Data → "Delete my account":

1. Your account is marked for deletion immediately.
2. There is a 30-day grace period during which you can cancel the request and restore the account.
3. After 30 days, your data is hard-deleted from production systems on a defined schedule; routine backups age out within 35 days of that deletion.
4. We may retain a minimal record (account email, deletion date) to demonstrate compliance with your request and to prevent re-creation of the account by abuse.

If your account becomes churned (cancelled or payment failed beyond grace), after 365 days you may also request a hard deletion of any retained personalization data. We will comply within 45 days, subject to legal-hold exceptions.

9. Data security

We use commercially reasonable administrative, technical, and physical safeguards, including:

• Encryption in transit (TLS) for all traffic to and from the Service.
• Encryption at rest for the database (via Supabase).
• Row-Level Security (RLS) policies on every table, scoping reads and writes to the account owner.
• SECURITY INVOKER views and search_path-pinned functions so Row-Level Security continues to apply through derived queries.
• Audit logs for sensitive actions.
• Least-privilege access for our team; production access is gated and logged.
• Regular review of dependency and infrastructure security advisories.

No system is perfectly secure. If we become aware of a security incident materially affecting your information, we will notify affected directors within the timeframes required by applicable law (in California, generally without unreasonable delay; in some jurisdictions, within 72 hours).

10. International data transfers

The Service is operated from the United States. If you access the Service from outside the US, your information will be transferred to, processed in, and stored in the US. Where required by law (including for residents of the European Economic Area, United Kingdom, or Switzerland), we rely on Standard Contractual Clauses or other approved transfer mechanisms with our sub-processors.

11. Children's privacy

The Service is strictly for adults 18 and over. We do not knowingly collect personal information from anyone under 18, and the Service is not directed to children under 13 within the meaning of the U.S. Children's Online Privacy Protection Act (COPPA).

How we enforce the age gate (dual gate). At sign-up we require BOTH of the following, and both must pass to create an account:

1. Verifiable birth year. You enter your year of birth (not full date of birth — only the year, which is the minimum we need). We compute your age; if the computed age would be under 18, we do not create an account. The sign-up page shows a warm hard- bounce screen with crisis-line resources and a "we're not a mental health app" disclaimer, and the device is held out of the sign-up flow for 24 hours via a per-device localStorage marker (a speed bump, not a security control).
2. Explicit "I am 18 or older" attestation. A separate checkbox you actively tick, whose label links to ToS §3 (Eligibility) and Privacy Policy §11 (Children's Privacy). This is a binding representation.

The two gates are belt-and-suspenders by design. A determined minor who enters a false year on gate (1) still has to affirmatively assert a false attestation on gate (2), which becomes evidence in the event we later learn the account is under-18.

We record the consent receipt (birth year, attestation timestamp, consent text version) as a legal-compliance audit record. We do not store full date of birth, school information, location data sufficient to identify a child, or any of the other categories of personal information COPPA enumerates as requiring verifiable parental consent.

If a child reaches us anyway. Our age gate is a good-faith effort, not a perfect technical barrier — we know a determined minor can enter a different year. If you are a parent, teacher, or other adult who believes someone under 18 has created an account or provided personal information to us:

• email us at support@allyoucan.app, or
• submit a report via our intake endpoint at https://www.allyoucan.app/api/underage-report (a small form on this site will surface this for parents in a future update), or
• contact us via any of the channels in Section 16.

We commit to reviewing every report within 24 hours, and if review confirms the account belongs to someone under 18 we will permanently delete the account and all associated personal information, including any related records in our database. We will notify the reporter when the deletion is complete (where we have a return contact).

No targeted advertising or profile-building of minors. We do not sell personal information, do not engage in cross-context behavioral advertising, and do not build interest-based profiles of any director — minor or adult. See Sections 5 and 12.4 for the full posture.

12. Your privacy rights — California (CCPA / CPRA)

If you are a California resident, you have the rights listed in this section. We apply most of these protections to all directors regardless of residency, but the formal statutory rights listed here are guaranteed under California law.

12.1 Right to know

You may request:

• The categories of personal information we collected about you in the prior 12 months (see Section 3);
• The categories of sources from which we collected it;
• The business purposes for collection or disclosure;
• The categories of third parties we shared it with (see Section 5);
• Specific pieces of personal information we hold about you — delivered as a portable JSON export through Settings → Privacy & My Data → Export my data.

12.2 Right to delete

You may request deletion of personal information we hold about you, subject to limited exceptions (transaction completion, security, debugging, legal obligation, internal uses reasonably aligned with your expectations). The product surfaces this as Settings → Privacy & My Data → Delete my account.

12.3 Right to correct

You may request that we correct inaccurate personal information. Most fields you can correct directly in the Service. For other fields, contact support@allyoucan.app.

12.4 Right to opt out of sale or sharing

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising. There is therefore nothing to opt out of. If our practices ever change, we will provide a clear "Do Not Sell or Share My Personal Information" mechanism and notify active directors in advance.

We also honor Global Privacy Control (GPC) signals automatically; sending a GPC signal counts as an opt-out request for any future practices that may qualify.

12.5 Right to limit use of sensitive personal information

You have the right to direct us to limit our use of the Sensitive Personal Information described in Section 3.7 to the purposes necessary to provide the Service and the operational purposes permitted under CCPA §1798.121(b).

Since that is already our practice (Section 6), no separate opt-out is needed for the Service's core use of SPI. If you unsubscribe from the AI tiers or do not subscribe to them, SPI is processed only by the rules-based engine on your device and our servers and is never sent to Anthropic.

12.6 Right to non-discrimination

We will not discriminate against you for exercising any of these rights. We will not deny you service, charge different prices, or provide a different level of quality because you submitted a privacy request.

12.7 How to submit a request

• Self-serve (fastest): use the buttons in Settings → Privacy & My Data.
• Email: support@allyoucan.app with the subject line "Privacy Request" and a description of what you want.
• We will verify your identity using the email address on file and, where reasonable, additional information sufficient to confirm you are the account holder.

12.8 Authorized agents

You may designate an authorized agent to make a request on your behalf. The agent must provide written authorization signed by you, and we may still verify your identity directly. For more complex requests, we may require notarized authorization.

12.9 Response timeline

• Acknowledgement: within 10 business days.
• Response: within 45 days of receipt, extendable once by an additional 45 days if reasonably necessary, with notice to you.
• Up to two free requests per twelve-month period. Manifestly unfounded or excessive requests may incur a reasonable fee or be refused, with explanation.

12.10 Right to appeal

If we decline a request, you may appeal by replying to our response or by emailing support@allyoucan.app with "Appeal" in the subject. We will respond within 45 days. If your appeal is denied, you may contact the California Attorney General at https://oag.ca.gov/contact/consumer-complaint-against-business-or-company.

12.11 Notice of financial incentives

We do not offer financial incentives in exchange for the collection, retention, sale, or sharing of personal information.

13. Your privacy rights — other US states

Residents of Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana, and other US states with comprehensive privacy laws have rights substantially similar to those described in Section 12, including the right to access, correct, delete, opt out of sale or targeted advertising, and appeal. The self-serve tools in Settings → Privacy & My Data and the support@allyoucan.app address apply to all such requests.

Nevada residents specifically: we do not sell your "covered information" as defined in Nevada Revised Statutes Chapter 603A. If this changes, you will have the right to opt out.

14. Your privacy rights — EEA, UK, Switzerland (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have these rights regarding your personal data:

• Access — receive a copy of your data
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten")
• Restriction — pause processing in certain cases
• Portability — receive your data in a structured, machine- readable format
• Objection — to processing based on legitimate interests, or for direct marketing
• Withdraw consent — where processing is based on consent
• Lodge a complaint with your supervisory authority (in the UK: the Information Commissioner's Office at ico.org.uk)

Lawful bases we rely on under GDPR Art. 6:

For special-category data (Art. 9) — i.e. health information you self-report — our lawful basis is explicit consent (Art. 9(2)(a)) that you give by entering that information after seeing the relevant in-product disclosure.

15. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or in-product at least 30 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision. Past versions are available on request.

16. Contact

• Privacy questions or rights requests: support@allyoucan.app
• Legal notices: admin@allyoucan.app