Get Primal

Legal

Primal Consumer Health Data Privacy Policy

Last updated: 27 October 2026
Effective date: 4 October 2026

This Consumer Health Data Privacy Policy describes how Syed Khizer, an individual (“Primal,” “we,” “us,” or “our”), collects, uses, shares, and protects consumer health data through the Primal app and related services.

This notice is separate from and supplements the general Primal Privacy Policy. It is intended to provide the specific disclosures required by consumer-health privacy laws, including the Washington My Health My Data Act where applicable. It is published at https://primalapp.cloud/consumer-health-privacy, is linked from the Privacy Policy and the website footer, and is available in the app from Settings → Legal → Consumer health data policy.

Primal is a self-help app for breaking an unwanted habit. Because of that, almost anything about how you use it can reveal private health information, including the simple fact that you installed it or subscribed. This notice treats it that way.

1. Consumer health data we collect

Most of what you record in Primal never reaches us. This section separates what stays on your device from what reaches our servers or our providers.

Stays on your device (not uploaded to Primal's servers). The app keeps and processes these only on your iPhone or iPad:

  • your onboarding answers (how often the habit wins, how long it has been a struggle, what pulls you in most, and what happens when you try to stop), the symptoms and reasons you choose, and the severity score the app calculates;
  • your quit date, streak, arena progress, goals, pledges, daily tasks, focus sessions and achievements;
  • check-ins (including mood, urge level and notes), urge logs (intensity, triggers, the tool you used, the outcome, and the place and activity tags you pick, such as "Bed" or "Home alone"), and relapse records (including their notes and triggers);
  • your journal, your blocker settings, and your saved Leo chat history.

We cannot see these. They are not in our database, and they are not sent to our analytics, crash-reporting, payment or attribution providers. They stay on the device until you delete them, delete your account, or delete the app (an iCloud or computer backup of your device can also contain them). Because they are not uploaded, a new phone or a reinstall starts with a fresh history.

Copies that versions of Primal before 1.0.1 (before 26 October 2026) uploaded to our servers have been deleted. We checked on 6 November 2026 that none remain.

Reaches our servers or providers. We collect the following consumer health data, and only when you use the feature concerned:

  • Messages you send to Leo, our AI coach, and up to eight earlier messages of the same conversation, which can reveal health or recovery information (Section 4).
  • Community content you publish: posts, replies, photos and poll answers, and the room you post in. Each post also shows your arena level and current streak day count, and each reply shows your arena level. These are stored on our servers with the post and are visible to other signed-in members.
  • Reports and blocks you make or that concern you, which can include the content concerned (Section 4).
  • The fact that you installed Primal or subscribed, which can itself reveal health information. Our providers receive it as described in Section 4, and the ad networks receive it only if you choose Allow on Apple's tracking prompt (Section 3).

Primal does not collect information from Apple HealthKit, Health Connect, medical records, fitness trackers, GPS, or precise-location services, and does not ask for location permission. Place tags on urges and relapses are labels you pick, stored only on your device.

2. Sources of consumer health data

We collect consumer health data:

  • directly from you, when you send Leo a message, publish in the community, report or block someone, or contact support;
  • automatically, when the app sends the events described in Section 4 (for example that you opened the app or completed a purchase); and
  • from another member only when they reply to, react to, or report content you chose to publish.

We do not purchase consumer health data from data brokers or obtain it from advertising networks.

3. Why we collect and use consumer health data

We collect and use consumer health data only as reasonably necessary to:

  • generate a Leo reply when you choose to send Leo a message;
  • run the community you choose to take part in, including showing your posts with your handle, arena level and streak day count;
  • keep your account, subscription and community content available when you sign in on another device (your recovery records stay on the device they were logged on);
  • maintain safety, review reports, prevent fraud and abuse, and secure Primal;
  • measure, in aggregate, how people move through onboarding and the paywall;
  • measure which of our ads brought you to Primal, only if you allow tracking (below);
  • respond to your requests and provide support; and
  • comply with law and establish, exercise, or defend legal claims.

We do not use your onboarding answers, recovery records, journal, Leo chats or community content for advertising, profiling, data-broker activity, employment, credit, housing, insurance, or other eligibility decisions. We do not sell consumer health data: no one pays us for it. The only advertising-related use of any consumer health data is the ad measurement described next, and it happens only after you allow it.

Ad attribution (only if you allow tracking). On the first screen, Apple shows its tracking prompt with our explanation: "Primal uses this to see which ads brought you to the app, so we can stop paying for ads that don't help people find it. Your answers, urge logs and journal are never shared." What happens next:

  • If you choose Allow: our attribution provider, AppsFlyer, receives your device's advertising identifier (IDFA) and vendor identifier, your IP address (from which AppsFlyer and the ad networks may work out an approximate location, such as your country), your device model, iOS and app version, and when you install and open the app. Through RevenueCat, it also receives your subscription start, trial, renewal, cancellation and refund events with their price, which may carry your random Primal account identifier. AppsFlyer reports the installs and subscriptions it attributes to the ad network that showed our ad (currently Meta (Facebook and Instagram), TikTok and X).
  • What the networks do with it: each network receives the fact that its ad led to your install or subscription of a recovery app. It handles that under its own terms and privacy policy, and may use it to measure and improve the delivery of our ads. We are not paid for this; we pay them.
  • If you choose Ask App Not to Track: the app sends AppsFlyer nothing, and no ad network receives anything about you from us. Apple's own aggregated, anonymous install reports (SKAdNetwork and AdAttributionKit) still count installs without identifying you.

AppsFlyer and the ad networks never receive your answers, recovery records, notes, journal, chats or community content.

You can withdraw at any time in iOS Settings → Privacy & Security → Tracking, or by emailing admin@functionalapps.org. The next time you open Primal, it stops AppsFlyer and takes back the link that lets RevenueCat send your subscription events to it. Under some U.S. state laws this kind of sharing for ad measurement may count as "sharing" or "targeted advertising"; withdrawing as described here is how you opt out.

4. Consumer health data we share

“Share” may have a specific meaning under applicable consumer-health privacy laws. Apart from the ad networks described in Section 3, we share consumer health data only with service providers whose terms require them to protect it at least as well as this policy does, and to use it only to provide their service to us. Depending on the feature:

  • Firebase and Google Cloud (United States) run sign-in, our database, file storage, server functions, push notifications and security checks. They hold your account, your community posts, replies and photos (with your arena level and streak day count), your reports and blocks, and your push tokens. Leo messages pass through our Google Cloud function on their way to OpenRouter and are not stored. Your recovery records are not sent to them.
  • OpenRouter (Leo): only when you choose to send Leo a message. The message you type and up to eight earlier messages of that conversation pass through Primal's Firebase Function to OpenRouter, which routes them to OpenAI's gpt-oss-120b model on a host that keeps no data (our requests require zero data retention and refuse data collection). Nothing else about you is forwarded to OpenRouter: not your name, email, account ID, recovery records or journal. OpenAI is the model developer and does not receive your messages under this route.
    • Messages that contain crisis language are answered on your phone with crisis resources and are never sent.
    • Because the call to our server is signed in, our function logs record your account ID, the time, the model and the size of the request and reply, never the text, for up to 30 days.
  • Other members: other signed-in members see what you publish in the community, with your generated handle, arena level and (on posts) streak day count. Their app can also read one thing the app does not display: the internal account ID attached to each post and reply. Who reported a post or reply is never stored on it; it is kept only in our private moderation records, which no app can read.
  • Automated moderation:
    • Our server checks every post and reply automatically. Links, explicit terms and self-harm wording hide it, and self-harm wording also shows crisis support. Profanity is masked.
    • Photos are checked by Google Cloud Vision SafeSearch before the app shows them to anyone else, and a photo that fails is deleted.
    • On your device, faces in photos are blurred by default and photo metadata (including location) is removed before upload.
  • Moderation inbox: when someone reports a post, a reply or a person, or blocks someone, an email goes to our moderation inbox, hosted by Namecheap (Private Email), so a person can review it. It contains the content concerned, the handles and account IDs of its author and of the person reporting or blocking, and a link to it. If a photo cannot be checked, an email with the post and its author's handle and account ID goes to the same inbox. A report never hides content by itself; a person decides.
  • Analytics (PostHog, EU):
    • The app sends PostHog eight anonymous events: app opened, onboarding step reached (by number only), onboarding completed, paywall seen, purchase started, purchase completed, restore completed, and signed in.
    • Each event carries a random install identifier that is reset when you sign out, and is never linked to your account.
    • Like any internet service, PostHog receives the IP address your device connects from and may work out an approximate location from it.
    • Because Primal is a recovery app, even these events show that someone uses it. PostHog never receives your answers, symptoms, urges, relapses, notes, Leo messages, community content or any text you type.
    • Product analytics are always on; you may object by emailing admin@functionalapps.org.
  • Crash reports (Firebase Crashlytics): crash stack traces and device and app version information, with no account identifier, never journal text, chats, your name or your email. Always on; you may object by emailing admin@functionalapps.org.
  • Payments (Apple and RevenueCat):
    • Apple processes your purchase.
    • RevenueCat receives your random Primal account ID, App Store transaction identifiers, the plan and your subscription status, and the device information its software sends (device model, iOS and app version, IP address and App Store country).
    • Only if you allow tracking does RevenueCat also receive your device identifiers and AppsFlyer ID, so it can pass your subscription events to AppsFlyer (Section 3).
  • AppsFlyer and ad networks: only if you choose Allow, as described in Section 3. Without that consent the app sends AppsFlyer nothing.
  • Safety and legal information: professional advisers, child-safety organisations, law enforcement, courts, regulators, or other authorities may receive information reasonably necessary for a valid legal, safety, or claims purpose.
  • Business transactions: a successor involved in a merger, financing, reorganisation, acquisition, bankruptcy, or asset transfer may receive information subject to applicable safeguards and consumer-health privacy obligations.

We have no affiliates. The full list of recipients is also in the Privacy Policy, and you can ask us for it at any time.

Primal is for people aged 18 or older. We do not verify identity or ask an in-app age question; by using Primal or creating an account you confirm that you are 18 or older.

How you accept the policies.

  • The first screen says: "By continuing, you accept our Privacy Policy and Terms of Use (EULA)", with both linked. The Privacy Policy links to this notice.
  • The sign-in screen says that by continuing you agree to the Terms of Use (EULA) and the Privacy Policy.
  • The paywall links both again.
  • When a purchase completes on the paywall, the app records your acceptance on your device, with the policy version and the time, and sends a copy to our servers once you are signed in. Some records from before 6 November 2026 were kept only on the device.
  • This notice is in the app in Settings → Legal (Settings is part of paid access) and always at https://primalapp.cloud/consumer-health-privacy.

Your consent to each use of consumer health data is given by the choice that starts it:

  • Leo: the first time you use Leo on a device, before anything is sent, Leo's "Before we talk" notice explains that an AI service, OpenRouter, using OpenAI's gpt-oss model, writes Leo's replies and receives your messages for that. Choosing I understand sends your message; Not now keeps it on your phone. The choice is remembered on that device. After that, each message you choose to send is your consent for that message.
  • Community: before you first open the community, the app shows the Community Rules and asks you to tap I agree. Each post, reply, photo or report you submit is your choice to share it as described in Section 4.
  • Ad attribution: only Apple's tracking prompt (Section 3).

Apart from Apple's system prompts (tracking, notifications, Screen Time, the camera for the panic-button mirror, and saving an image to Photos), Leo's notice and the Community Rules agreement, Primal does not interrupt you with consent or acceptance screens. There are no in-app switches for Leo or product analytics; earlier switch choices no longer have any effect.

You may withdraw consent for future collection or sharing:

  • Leo: stop sending Leo messages. Your saved conversations are only on your device; delete them with Settings → Privacy & data → Clear Leo chat history.
  • Community: delete your posts and replies, or stop publishing.
  • Ad attribution: turn tracking off in iOS Settings (Section 3).
  • Everything: delete your account (Section 7), or email admin@functionalapps.org.

Withdrawal does not affect processing already performed.

6. Your consumer health data rights

Depending on where you live, you may have the right to:

  • confirm whether we collect, share, or sell your consumer health data;
  • access the consumer health data we maintain about you;
  • obtain a list of the third parties and affiliates with whom your consumer health data has been shared (Section 4 lists them; we have no affiliates);
  • withdraw consent from future collection or sharing;
  • request deletion from our systems and from the processors and third parties we shared it with;
  • receive a portable copy of information you provided;
  • appeal our refusal of a request; and
  • exercise these rights without unlawful discrimination.

Access and portability. While you have paid access, Settings → Privacy & data → Export my data produces a JSON file with your local records and the account and community records we hold on our servers.

  • Not yet included: some details of local records (notes and tags on check-ins and urges, and the trigger and place tags on relapses), the photo files themselves (their file paths are included), reports other members filed about you, and data held by our providers.
  • Email us for any of these, or for an export if you no longer have paid access.

Deletion.

  • In the app, while you have paid access: Settings → Privacy & data → Delete account & data (also reachable from Settings → ACCOUNT → Delete my account), then Delete now or Delete after 24 hours. Settings is inside the paid part of the app.
  • By email, at any time, with or without a subscription: write to admin@functionalapps.org with the subject "Delete account" and the email you signed in with (or your Primal handle if Sign in with Apple hid your email). After we confirm the request from the account's email address, the deletion is scheduled to complete within 24 hours.

For any other request, email admin@functionalapps.org.

We may verify your identity proportionately before acting. If we deny a request, you may appeal by replying to our decision with the subject “Consumer Health Data Appeal.” You may also contact the appropriate regulator or attorney general.

7. Deletion

An in-app deletion runs immediately, or after a 24-hour grace period that you can cancel with Cancel deletion if you choose it. A confirmed email request is scheduled to complete within 24 hours and shows in the app as "Deletion scheduled" until then.

What we delete:

  • We ask Apple to revoke Primal's Sign in with Apple access, and ask RevenueCat to delete its record of you. If either cannot be reached, your Primal data is still deleted; we record the failure and finish that step with the provider by hand.
  • We then delete your community posts, replies and photos, your votes, poll answers, views and blocks, your handle and public profile, your purchase links, your push tokens and consent records, everything else stored under your account, and your Firebase Authentication account.
  • If one of our own deletion steps fails, it is retried automatically (after 1, 2 and 4 hours, then every 6 hours, up to 24 attempts) and then passed to us to finish by hand.

On your device, the app deletes the account's local records, preferences, consent records, analytics state, Leo history and Screen Time shields.

What is not deleted automatically:

  • Moderation records that involve you are anonymised rather than deleted: account-ID fields are replaced with "deleted" and content is removed. The reason, status, outcome and timestamps are kept, and internal record identifiers (and, for reports you filed, the location of the item you reported) may still contain an account identifier. They are kept for up to 24 months for safety, enforcement and dispute resolution.
  • Report and block emails already in our moderation inbox are kept for up to 24 months.
  • Service logs that contain your account ID are kept for up to 30 days.
  • AppsFlyer: if you allowed tracking, AppsFlyer's records about your device are not deleted automatically, because AppsFlyer knows your device rather than your account. Email us, ideally before or when you delete your account, and we will send AppsFlyer an erasure request for your device.
  • Backups: our providers' backups are deleted on their normal cycle and are isolated from ordinary use until then.
  • Leo notice: your agreement to Leo's notice is remembered on the device, not the account, and is not cleared.

Deleting Primal or your Primal account does not cancel an Apple subscription; cancel it in your Apple account settings.

8. Retention

We retain consumer health data only for as long as reasonably necessary for the feature you use and the security, safety, legal and accounting purposes above:

  • Recovery records on your device: until you delete them, your account or the app (or remove a device backup that contains them).
  • Community content: until you delete it or your account.
  • Account and consent records: for as long as your account exists.
  • Moderation records, anonymised moderation records and moderation emails: up to 24 months.
  • Service logs: up to 30 days.
  • Leo usage and rate-limit counters (counts and times only, no content): kept with your account and deleted when it is deleted.
  • Crash reports: up to 90 days.
  • Anonymous product analytics: up to 12 months.
  • Deletion-failure records: until the provider step is finished.

The full schedule is in the general Privacy Policy.

9. Security

We use administrative, technical, and organisational safeguards appropriate to the sensitivity and volume of consumer health data, including access controls, TLS, platform authentication, server-side authorisation rules, Firebase App Check, iOS Data Protection for the Leo chat history on your device, and restricted provider access. No system can guarantee absolute security. If a security incident affects your consumer health data, we will investigate, mitigate, and notify you and the relevant authorities where the law requires.

10. Changes to this notice

We will update the date above and provide additional notice or obtain consent before collecting, using, or sharing new categories of consumer health data or using existing consumer health data for materially different purposes where required.

11. Contact

Syed Khizer
Email: admin@functionalapps.org