Privacy Policy

1Who We Are

GiantCanopy Ltd is the data controller responsible for your personal data.

2Personal Data We Collect

We collect the following categories of personal data:

2.1 Account and Profile Data

• Name, email address, and password (or authentication credentials)
• Profile preferences and settings
• Profile photo and any images you choose to attach to a journal, forecast, or reflection entry

2.2 Support Circle Data

• Identifiers of users you invite (or who invite you) to a support circle — by email address or username

2.3 Technical and Usage Data

• Device type, operating system, unique device identifiers, and app version
• IP address, approximate location (country/region level), and log data
• Usage analytics (features used, session duration, crash reports)

2.4 Payment and Subscription Data

We do not directly collect or store full payment card details. On iOS, purchases are processed by Apple's In-App Purchase system; on Android, purchases are processed by Paystack. We receive limited information such as subscription status, purchase history, and transaction identifiers necessary to manage your access.

3How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide, operate, and maintain the Service, including generating personalised insights and enabling support circles
• To manage your account, subscriptions, and free trial
• To communicate with you about the Service, updates, security alerts, and support
• To improve the Service through aggregated and anonymised analytics
• To detect, prevent, and address technical issues, fraud, or abuse
• To comply with legal obligations and enforce our Terms

4Legal Bases for Processing

Under the Kenya Data Protection Act, 2019, we rely on the following lawful bases to process your personal data:

• Contract: Processing necessary to provide the Service you have requested (including account management and core features).
• Consent: For the processing of special category (wellness/emotional) data and for certain optional features. You may withdraw consent at any time (this will not affect the lawfulness of processing before withdrawal).
• Legitimate interests: For analytics, security, service improvement, and communications, balanced against your rights and interests.
• Legal obligation: Where we must process data to comply with applicable law.

5How We Share Your Data

• Support Circle members: Only the specific information you choose to share with the limited contacts you invite.
• Service providers: Trusted third parties who help us operate the Service — including Vercel (application hosting), MongoDB Atlas (database hosting), Firebase (analytics, crash reporting, cloud messaging, and file storage for uploaded images), Resend (transactional email for verification codes and password resets), Google Sign-In, Sign in with Apple, and Google Mobile Ads — under strict contractual obligations to protect your data.
• Payment processors: Apple's In-App Purchase system (iOS) and Paystack (Android) process payment and subscription data according to their own privacy policies.
• Legal and safety reasons: When required by law, court order, or to protect the rights, safety, or property of GiantCanopy Ltd, our users, or others.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to appropriate safeguards.

6International Data Transfers

Your data may be transferred to and processed in countries outside Kenya. Where we transfer data internationally, we ensure appropriate safeguards are in place to protect your information.

7Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, including:

• While your account remains active
• For a reasonable period after account deletion to comply with legal, accounting, or reporting requirements, or to resolve disputes

When you delete your account, your personal data — including journal entries, emotion logs, forecasts, and community content — is deleted from our live systems immediately as part of that request. Copies of this data may persist for a limited additional period in encrypted backups until they are rotated out as part of our routine backup schedule, or where we are required to retain specific records by law (for example, transaction records for accounting purposes).

8Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include encryption in transit and at rest, access controls, secure cloud infrastructure, and regular security reviews.

No method of transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

9Your Rights Under Data Protection Law

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data in certain circumstances ("right to be forgotten").
• Restriction: Request that we restrict processing of your data in certain cases.
• Data portability: Request a copy of your data in a structured, commonly used, machine-readable format.
• Object: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us using the details in Section 1.

10Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will take steps to delete it promptly.

11Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the Service or by other reasonable means. The "Last Updated" date at the top indicates when the policy was last revised. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12Contact Us

If you have questions about this Privacy Policy or our data practices, or if you wish to exercise your rights, please contact us at: