Privacy Policy — Ataraxia

Last updated: September 8, 2026

This privacy policy describes how the Ataraxia mobile application (“Ataraxia”, “the app”, “we”) handles your information.

Summary

• Ataraxia is a Stoic-philosophy reflection app.
• We do not require an account, email, or sign-in, and we collect no directly identifying information about you.
• We do not track your location, contacts, or photos, and we do not use advertising identifiers — there is no IDFA and no App Tracking Transparency prompt.
• Your reflections, journal entries, saved passages, and emotion data stay on your device.
• Anonymous product analytics are on by default, and you can turn them off in one tap in Settings → Data. Even when on, it is enums and counts only — never the text you write.
• If you subscribe, your subscription status is managed by RevenueCat under an anonymous id; payment is handled by Apple or Google.
• If an advert or a link we published brought you to Ataraxia, we record which campaign it was against that same anonymous id, so we can tell which channels are worth running. It names the advert, not you.
• Voice and text you choose to process are sent to AI services for transcription, emotion analysis, and audio readings only — they are not stored by us.

Anonymous usage analytics — PostHog (on by default, one tap to stop)

Ataraxia collects anonymous product analytics so we can tell which passages actually help people and which do not. This is on by default and can be switched off at any time under Settings → Data → “Anonymous usage”, which stops collection immediately.

This changed in version 1.2.2 (September 2026). Analytics used to be off unless you switched it on. Almost nobody found the setting, which left us unable to tell which passages were worth keeping. So the default was reversed, and it was turned on for existing installs — except where someone had already switched it off, which we left alone. Anyone whose setting we changed is told so in the app, with the setting one tap away.

While it is on:

• Analytics are processed by PostHog, hosted in the EU.
• We capture only counts, durations, bucketed measures, and enum values (for example: “a passage was saved”, “the paywall was viewed”, “an emotion = anxiety”). A strict on-device filter blocks any other field.
• We never send the text of your reflections, journal entries, search queries, or passages, and we do not collect your name, email, location, contacts, or advertising identifiers.
• An app-generated anonymous id lets us count returning vs. new use. It is not linked to your identity and is not used to track you across other apps or websites (no IDFA / no App Tracking Transparency prompt).
• PostHog’s data handling: https://posthog.com/privacy

Subscriptions — RevenueCat + the app stores

If you purchase Inner Citadel, the subscription:

• Is purchased through Apple’s App Store or Google Play; the payment itself is handled by Apple or Google, not by us.
• Is managed on our side by RevenueCat, which records your subscription status under an anonymous app-user id. This is used to unlock the features you paid for, to restore purchases, and — as described in the next section — to record which campaign brought you to the app. It is not linked to your identity, and it is never used to target adverts at you.
• RevenueCat’s data handling: https://www.revenuecat.com/privacy

How you found us — install attribution

We run adverts (Apple Search Ads, Google Ads) and publish tagged links on social platforms. To know which of those are worth paying for, the app records which campaign led to your install, stored against the same anonymous app-user id described above.

• On iOS, we use Apple’s own AdServices framework. If you arrived from an Apple Search Ads advert, Apple tells us the campaign, ad group and keyword. If you arrived any other way, Apple returns no campaign and nothing is recorded. This uses no advertising identifier and needs no App Tracking Transparency prompt.
• On Android, we read the Google Play install referrer — the tag our own link carried into the Play Store. If your install carried no tag, nothing is recorded.
• What is stored is the name of a campaign (for example apple_search_ads or organic_tiktok), not a profile of you. It is written once, at install, and never changed afterwards.
• It is not shared with advertising networks, not used to target adverts at you, and not combined with data about you from other apps or websites.
• No new company receives your data. This is held by RevenueCat, which already manages subscriptions — there is no additional processor.

Data stored locally on your device

The following is saved only on your device using standard secure storage provided by your operating system (iOS keychain / Android encrypted preferences). We never see or transmit it:

• Reflections and journal entries you write
• Passages you have bookmarked (your Marginalia)
• Emotion data derived from “What troubles you” sessions
• Your app preferences (e.g., theme, audio settings)

If you uninstall the app, this data is deleted. If your operating system creates a device backup (e.g., iCloud Backup, Google Drive backup), that backup belongs to Apple or Google — not to us — and is governed by their respective privacy policies.

Voice and text sent to third-party AI services

Ataraxia includes optional features that send specific data to third-party AI services only when you actively trigger them. We do not send anything in the background.

How these requests are routed. These requests pass through our own proxy server (hosted on Expo’s EAS Hosting) before reaching the AI provider. The proxy exists so our API credentials are never shipped inside the app; it is a stateless relay that forwards your request to the provider and returns the response. It does not store your audio, your text, or any profile of you.

Voice transcription — OpenAI (Whisper)

When you record audio using the in-app microphone, your recorded audio is sent — via our proxy — to OpenAI’s transcription API (“Whisper”) and the transcribed text is returned. The audio is not stored by us or by the proxy. Per OpenAI’s published policy, audio submitted via API is not used to train their models and is retained only briefly for abuse monitoring. https://openai.com/policies/privacy-policy

Audio readings (text-to-speech) — OpenAI

When you tap play to hear a passage read aloud, the text of that passage is sent — via our proxy — to OpenAI’s text-to-speech API, which returns audio that the app plays. The passage text is transient and is not stored by us or by the proxy. The same OpenAI policy applies. https://openai.com/policies/privacy-policy

Emotion classification — Anthropic (Claude)

When you complete a “What troubles you” reflection, the transcribed text of your reflection is sent — via our proxy — to Anthropic’s Claude API for emotion classification, which returns an emotion label. Per Anthropic’s published policy, API inputs are not used to train their models and are retained only as required for compliance and abuse monitoring. https://www.anthropic.com/legal/privacy

Letters from a Stoic — Anthropic (Claude)

When you write or speak what troubles you and ask the Stoics for a reply, the words you wrote are sent — once, via our proxy — to Anthropic’s Claude API, together with a small set of passages from Ataraxia’s own catalogue for the reply to draw on. What comes back is the letter you read.

Three things are worth stating plainly:

• Your words are sent once, for that one reply. They are not stored by us or by the proxy, and no request body is logged. Nothing is sent in the background and nothing is sent again afterwards.
• What you wrote stays on your phone. The letter is kept only if you choose to keep it; your own words are saved alongside it on the device and are never uploaded again. If you export the letter as a page to print or send, your words are not printed on it — only the reply.
• Per Anthropic’s published policy, API inputs are not used to train their models and are retained only as required for compliance and abuse monitoring. https://www.anthropic.com/legal/privacy

You can use the whole app without ever writing a letter.

Crash reporting — Sentry (EU)

To keep the app stable, Ataraxia reports crashes and technical errors to Sentry, hosted in the EU. These reports contain only diagnostic technical data — the type of error, a stack trace, the app version, and the device model / OS version. They never include the text you write (reflections, journal entries) or any personal identifier. Crash reports are used solely to find and fix bugs. https://sentry.io/privacy/

Third-party services we use

Service	Purpose	Privacy policy
Apple App Store / TestFlight	iOS distribution + payments	https://www.apple.com/legal/privacy/
Google Play	Android distribution + payments	https://policies.google.com/privacy
RevenueCat	Subscription management + install attribution (anonymous app-user id)	https://www.revenuecat.com/privacy
PostHog (EU)	Anonymous product analytics — on by default, switchable off in Settings	https://posthog.com/privacy
Sentry (EU)	Crash + error reporting (diagnostic data only, no text you write)	https://sentry.io/privacy/
OpenAI	Voice transcription + audio readings (only when you trigger them)	https://openai.com/policies/privacy-policy
Anthropic	Emotion classification, and letters from a Stoic (only when you ask for one)	https://www.anthropic.com/legal/privacy
Expo / EAS Update	Over-the-air JavaScript updates (no user data sent)	https://expo.dev/privacy
Expo / EAS Hosting	Hosts our stateless AI proxy that relays your triggered AI requests (stores no user data)	https://expo.dev/privacy

Your choices and data control

• Anonymous usage — on by default; toggle it in Settings → Data. Turning it off stops collection immediately.
• Clear history — removes your session history and passage-exposure data from the device.
• Delete all my data — clears local data and resets the anonymous analytics id.
• Uninstalling the app removes all data stored on your device.
• We operate no account system, so there is no login to delete. Our only server is the stateless AI proxy described above, which holds no profile of you and stores none of your content — so there is nothing server-side to request or erase.

Children

Ataraxia is not directed at children under 13. We do not knowingly collect any data from children under 13.

Permissions the app requests

• Microphone (iOS and Android) — used only when you actively use the voice-input feature. We never record in the background. The recording is sent to OpenAI for transcription, then discarded; we do not retain the audio.

Updates to this policy

If this policy changes, we will update the “Last updated” date at the top. Material changes (such as introducing a new third-party service) will be highlighted in the app’s release notes.

Contact

Questions about this privacy policy, or to request deletion of any data:

marius.cimpoesu@gmail.com