Primal Privacy Policy

Primal is a self-help app for people aged 18 or older who want support changing a compulsive habit. Information about your habits, urges, symptoms, and recovery can be highly sensitive. This Privacy Policy explains what we collect, how we use it, when it is shared, and the choices available to you.

1. Who we are and when this policy applies

Primal is operated by Syed Khizer, an individual (“Primal,” “we,” “us,” or “our”). Syed Khizer is the controller of the personal information described in this policy, except where another company acts as an independent controller under its own terms.

Operator: Syed Khizer, an individual
Privacy and support email: admin@functionalapps.org

This policy applies to the Primal iOS app, our related backend services, our website (primalapp.cloud), and support communications. It does not apply to third-party services you visit independently.

Our website. primalapp.cloud sets no cookies and runs no analytics, trackers, or third-party scripts. Like any website, its host (Hostinger) keeps standard server access logs: the IP address, browser type, pages requested, and the time of each request. We use these logs only to run and secure the site.

Where required by applicable consumer-health privacy law, our separate Consumer Health Data Privacy Policy provides additional disclosures and rights concerning recovery information, intimate or private health information, and other consumer health data. That notice supplements this policy, is presented as a separate document, and is available in the app from Settings → Legal and through the link above.

2. The short version

• We collect account, subscription, technical, and—if you choose to use them—community, AI-coach, and support information.
• Your onboarding answers, recovery records (check-ins, urges, relapses, pledges, tasks, focus sessions, and your streak), journal entries, and saved AI-chat history stay on your device and are not synced to Primal's servers. The one exception: each community post you publish shows your arena level and current streak day count, and each reply shows your arena level; those values are stored with the post or reply on our servers. Your device or Apple backup settings may still back up local app data. Primal does not ask for your name, age, or gender.
• The current app uses Sign in with Apple. Apple gives us an Apple-specific identifier and, if you choose to share it, an email address (which may be a private relay address). Primal does not ask Apple for your name.
• Primal's first screen says: "By continuing, you accept our Privacy Policy and Terms of Use (EULA)", with both linked. The sign-in screen says that by continuing you agree to the Terms of Use (EULA) and Privacy Policy, and the paywall links both again. When a purchase completes, the app records that acceptance on your device with the policy version and the time, and sends a copy to our servers once you are signed in. All of our policies are in Settings → Legal (part of paid access) and always at https://primalapp.cloud.
• Community posts and replies are visible to other signed-in users together with your generated handle, arena level and, on posts, your streak day count. Other members' apps can also technically read the internal account ID attached to what you post (Section 3.3). Who reported a post is never stored on it.
• We do not sell personal information for money, and we never use your recovery records, answers, notes, chats, or community content for advertising. If you choose Allow on Apple's tracking prompt, AppsFlyer measures which of our ads brought you to Primal and tells the ad network that showed the ad (Section 3.7). If you don't, the app sends AppsFlyer nothing.
• Apple processes payments. We do not receive your payment-card number.
• Leo AI is available to subscribers. The first time you use Leo on a device, Leo shows who writes its replies and asks you to agree; nothing is sent to an AI provider until you do, and then only the messages you choose to send. If you do not want AI processing, do not message Leo.
• Apart from Apple's own permission prompts, Leo's one-time notice, and the one-time Community Rules agreement before you first open Community, Primal never asks you to consent to or accept anything.
• Anonymous product analytics are always on. They never contain your account ID, recovery data, or free text. You can object by emailing admin@functionalapps.org.
• Crash reports are always on so we can fix crashes. They never contain journal text, chats, your name, or your email. You can object by emailing admin@functionalapps.org.
• You can export your data as a JSON file, and delete your account from inside the app while you have paid access, or by email at any time (Section 11). Deleting your Primal account does not cancel an Apple subscription.
• Primal is for people aged 18 or older. We do not verify identity or ask an in-app age question; by using Primal or creating an account you confirm that you are 18 or older.

3. Information we collect

3.1 Account and profile information

We collect or create:

• a Firebase user identifier and authentication-provider information;
• your Sign in with Apple identifier and, if Apple provides it, your email address (including a private relay address). Primal does not ask Apple for your name; accounts created with an earlier version may still hold the name Apple shared then;
• a generated community handle;
• onboarding status and notification preference;
• your subscription status, product and expiry date, and a purchase-mapping token that links App Store purchases to your account;
• if you choose the 24-hour deletion option or email a deletion request, the scheduled deletion time;
• a Sign in with Apple refresh token, kept only so we can revoke Apple's link to Primal when you delete your account; and
• a push-notification token for your device while you are signed in. It is removed when you sign out or delete your account. Turning notifications off in the app keeps the token but stops reply notifications being sent to it.

When a purchase completes, the app also records your acceptance of the policies, with the policy version and the time, on your device (Section 6).

Primal does not ask for your name, age, or gender. The only name it keeps is the community name (alias) it generates for you.

3.2 Assessment and recovery information

Onboarding asks four questions (how often the habit wins, how long it has been a struggle, what pulls you in the most, and what happens when you try to stop), then asks you to pick symptoms and your reasons for quitting, and calculates a severity score. These answers are used on your device to build your plan and stay there. They are not uploaded to Primal's servers (Section 3.9).

Depending on how you use Primal, the app keeps the following records on your device only. They are not uploaded to Primal's servers (Section 3.9):

• quit date, original quit date, target, streak, and progress information;
• daily check-ins, including whether you stayed on track, mood, urge intensity, and an optional note;
• urge logs, including intensity, outcome, trigger, mood, tools used, blocker source, whether you were alone or stressed, and optional place and activity tags that you pick from preset options (for example "Bed" or "Scrolling");
• relapse records, including date, streak, trigger tags, optional notes, and an optional place tag that you pick from preset options (for example "Home alone");
• pledges, their outcomes, and optional notes;
• focus-session information, such as timing, intention, minutes, cycles, and completion; and
• achievements, tasks, and related progress state.

The place tags above are labels you choose, not device location readings; Primal does not request location permission. The only progress information that reaches our servers is what a community post or reply you choose to publish shows: a post shows your arena level and current streak day count, and a reply shows your arena level (Section 3.3).

3.3 Community information

If you use community features, we collect the posts, replies, photos, polls, votes, groups, reactions, blocks, and reports you submit, and a record of which posts you have viewed so each post's view count is counted once. A bug-report post may also include your app and operating-system versions. Each post also stores your arena level and current streak day count, and each reply your arena level, as shown next to it. We associate community activity with your account so we can display it, prevent abuse, and moderate the service.

Automatic checks. When you add a photo, the app blurs faces it detects (you can turn this off for that photo) and re-encodes the image, which removes its metadata (such as location, device, and time). After you post, the photo is checked automatically with Google Cloud Vision SafeSearch; the app shows it to other members only after it passes. A photo that fails the check is deleted and its post is never shown. If the check cannot run, the post stays hidden and the post, its author's handle, and the author's account ID are emailed to our moderation inbox so a person can check it. Posts and replies are also checked automatically on our server: text containing links, explicit terms, or self-harm wording is hidden (self-harm wording shows crisis-support information instead), and profanity is masked with asterisks.

Reports and blocks. A report never hides content by itself; a person reviews it. When you report or block someone, our moderation inbox is emailed the details (Section 7). When you block someone, the email says who you blocked and, if you blocked them from a post or reply, which one. If a member breaks the Community Rules, we may hide their content and disable their sign-in.

When content is reported for possible child exploitation, self-harm, threats, or other serious safety violations, we may preserve the report, relevant content, account identifiers, timestamps, and moderation actions for investigation, safety, legal compliance, and cooperation with valid legal process.

Other signed-in users may see your generated handle, arena level, streak day count (on posts), posts, replies, photos, polls, and other information you deliberately publish. In addition, the app of any signed-in member can technically read one thing that Primal does not display: the internal account ID (a random identifier, not your name or email) attached to every post and reply you publish and to the file path of your photos.

Who reported a post or reply is never stored on that post or reply. It is kept only in our private moderation records, which no app can read. (Before 6 November 2026, reporters' account IDs were stored on the reported post or reply, where other members' apps could technically read them; they have been moved to the private records.)

An account ID can be matched to the member's generated handle. Primal does not currently offer direct messages or friend relationships.

3.4 Purchases and subscriptions

The current iOS version offers paid access, Primal Pro, as a weekly, monthly, or yearly auto-renewing subscription through Apple's in-app purchase system. Primal has no free tier: the app's features, including Settings, are available only with paid access. Before you confirm a purchase, Apple's purchase sheet displays the product, billing period, local price and currency, applicable trial or introductory offer, and renewal terms. Apple processes the payment and controls billing, renewal, cancellation, price-change notices, and refund requests. We do not receive your full payment-card number, security code, or Apple Account payment credentials.

Apple and our subscription-management provider, RevenueCat, provide us with subscription and entitlement information such as a Primal app-user identifier, product identifier, purchase, renewal, cancellation and expiration status, transaction identifiers, price and currency metadata, and refund or revocation status. RevenueCat helps us validate purchases, restore paid access, keep entitlement state consistent across supported devices, prevent purchase abuse, and troubleshoot billing-access problems. RevenueCat uses your Primal account ID (a random Firebase identifier) as its user ID, and its software in the app also sends it device information such as device model, operating-system and app version, IP address, and App Store country. One Apple purchase is tied to one Primal account and is not shared with other people's accounts.

We do not use purchase or subscription information to infer recovery status or to personalise recovery content. If you cancel an auto-renewing subscription, paid access normally continues until the end of the paid billing period, unless Apple applies a refund, revocation, billing failure, or another App Store entitlement change. When paid access ends, the app shows the paywall until you resubscribe or restore a purchase; nothing is deleted because paid access ended. Your Primal account remains until you delete it under the controls described below (by email if you no longer have paid access), and your recovery records stay on your device.

Deleting Primal or your Primal account does not cancel an Apple subscription. You must manage or cancel the subscription separately through your Apple Account. The commercial subscription terms, including trials, renewals, cancellations, refunds, and price changes, are described in the Primal Terms and Conditions.

3.5 AI-coach information

Leo, Primal's AI coach, is available with paid access. The first time you use Leo on a device, Leo's "Before we talk" screen says that its replies are written by an AI service (OpenRouter, using OpenAI's gpt-oss model) and asks you to agree. Nothing is sent to an AI provider until you choose "I understand"; "Not now" keeps your message on the phone unsent. After that, only the messages you choose to send are sent. Your agreement is remembered on that device (not on your account), so the screen shows again on a new device or after reinstalling, and another account signed in on the same device is not shown it again. If you do not want your words processed by an AI provider, choose "Not now" or do not message Leo. Not using Leo does not affect other Primal features.

When you send Leo a message, the message you type and up to the last eight turns of that conversation are sent to our Firebase Function and then to OpenRouter. No recovery records (such as your streak, check-ins, or urges) are attached. OpenRouter routes the request to an eligible third-party inference host running OpenAI GPT-OSS-120B, an open-weight model developed by OpenAI, to generate the response. OpenAI is the model developer and licensor. Under this OpenRouter deployment, we do not represent that OpenAI receives message content unless the configured inference host changes to an OpenAI-operated service. Your name, email address, account identifier, and journal entries are never forwarded to OpenRouter. A message that contains crisis language (for example about suicide or self-harm) is answered on your phone with crisis-support information and is never sent to an AI provider.

Leo has usage limits: currently 25 messages in any rolling 5-hour window and 8 messages per minute.

Your saved Leo conversation history is stored locally on your device, in a file protected by iOS Data Protection, and is not synced to Primal's database. You can delete all of it at any time with Settings → Privacy & data → Clear Leo chat history. Because the request to our Firebase Function is made from your signed-in account, our backend records operational metadata for each request—a request identifier, timestamp, model, token counts, and your account identifier—in Google Cloud Logging for up to 30 days, but does not log message text or reasoning traces. To enforce the usage limits, it also keeps usage counters for your account (counts and times only, never message content), which are deleted when you delete your account. Primal requests OpenRouter routes that require parameter support, Zero Data Retention, and no provider data collection. OpenRouter and the eligible inference host nevertheless process message text under their applicable contractual terms. Do not include information in an AI prompt that you do not want those processors to receive.

Leo can be inaccurate and is not a therapist, clinician, or emergency service.

3.6 Blocking information

Primal's blocker works only through Apple's Screen Time (the Family Controls and Managed Settings frameworks). Apple provides the app with opaque selection tokens. Primal cannot read the names of the apps or websites represented by those tokens, and the tokens stay on your device.

When protection is enabled, Primal automatically applies Apple's web content filter, which limits harmful websites, and any custom websites you add. You can also choose apps and app categories to shield. The web content filter is part of protection by default and is not a separate setting. Apple applies these limits on your device; Primal does not route, inspect, or log your web traffic or browsing history. No blocker can identify or prevent all unwanted content.

3.7 Device, usage, and diagnostic information

We and our service providers collect technical information needed to operate and secure Primal, such as:

• app version, operating-system version, device model, locale, and time zone;
• Firebase and app-installation identifiers, authentication and App Check tokens, IP address, request time, and security signals;
• anonymous product-funnel events;
• crash reports, stack traces, performance information, and diagnostic state; and
• push-token and notification-delivery information.

Crash reports. Primal uses Firebase Crashlytics for crash diagnostics. Crash reports are always on so we can find and fix crashes; there is no in-app switch for them. A crash report contains the crash stack trace, device model, operating-system and app version, and a Crashlytics installation identifier. It never contains journal text, chats, your name, or your email address, and it is not linked to your name or email. We rely on our legitimate interest in keeping the app working (see Section 6). If you object to crash reporting, email admin@functionalapps.org.

Product analytics. We use PostHog (EU-hosted) for a small allow-listed set of product-funnel events: app launch, neutral numbered onboarding-step views, onboarding completion, paywall view, purchase start and completion, restore completion, and account sign-in. Onboarding-step events include only the flow version, neutral step code, step number, and total number of steps—not the screen topic or your response. Primal does not send PostHog your Firebase user ID, name, email, recovery activity, notes, AI conversations, community content, or any free text. PostHog screen capture, session replay, screen/element autocapture, surveys, push capture, person profiles, and error capture are disabled. The PostHog identifier is random, is not linked to a Primal account identifier, and is rotated when you sign out. Like any internet service, PostHog receives the IP address your device connects from and may derive an approximate location from it; we never link it to your account. Every accepted event includes the mandatory qp_environment value development, beta, or production, so the shared EU project can keep test and production insights separated. Even these anonymous events show that someone is using Primal, a recovery app. We do not use this analytics data for third-party advertising or cross-company tracking. Product analytics are always on; there is no in-app switch for them. We rely on our legitimate interest in understanding and improving onboarding and purchase (see Section 6). If you object to product analytics, email admin@functionalapps.org.

Ad attribution (AppsFlyer and ad networks). Primal uses AppsFlyer to measure which of our ads lead to installs and subscriptions, so we can stop paying for ads that don't work. On the first screen, Apple's App Tracking Transparency prompt asks whether Primal may track you. Its text reads: "Primal uses this to see which ads brought you to the app, so we can stop paying for ads that don't help people find it. Your answers, urge logs and journal are never shared." Only if you choose Allow does the app start AppsFlyer.

If you choose Allow, AppsFlyer receives:

• your device's advertising identifier (IDFA) and vendor identifier (IDFV);
• your IP address, from which AppsFlyer and the ad networks may derive your approximate location (such as your country);
• your device model and iOS and app version;
• when you install and open the app; and
• through RevenueCat, your subscription start, trial, renewal, cancellation, and refund events with their price, which may carry your random Primal account ID.

When an install or subscription is attributed to one of our ads, AppsFlyer reports that result, with your device's advertising identifier, to the advertising network that showed the ad (currently Meta (Facebook and Instagram), TikTok, and X; we update this list before we use a new network). Each network handles what it receives under its own terms and privacy policy and may use it to measure and improve the delivery of our ads. Because Primal is a recovery app, the fact that you installed it or subscribed can itself reveal something about your health; that fact is what this sharing passes on. We are not paid for this information; we pay these companies for their services. Neither AppsFlyer nor any network receives your assessment answers, recovery records, urge logs, journal, AI chats, or community content, and the events carry generic names (install, trial, subscription) that say nothing else about your recovery.

Under some US state privacy laws, this kind of sharing for ad measurement may count as "sharing" of personal information or "targeted advertising". You can opt out at any time: choose Ask App Not to Track, turn off Tracking for Primal in iOS Settings > Privacy & Security > Tracking, or email admin@functionalapps.org.

If you choose Ask App Not to Track, the app sends AppsFlyer nothing. Apple may still send us, AppsFlyer and the ad networks anonymised, aggregated install reports (SKAdNetwork and AdAttributionKit) that cannot identify you. If you change your answer to "don't track" later, the next time you open Primal it stops AppsFlyer and removes your AppsFlyer ID from RevenueCat, so your subscription events stop reaching AppsFlyer. Information AppsFlyer and the networks already received is not recalled automatically; see Section 11 for how to ask for its deletion. We rely on your consent (see Section 6).

3.8 Support, feedback, and legal communications

When you contact admin@functionalapps.org or submit a bug report, we collect your email address, message, attachments, and any app or device details you include. We use that information to respond, troubleshoot, protect the service, and keep appropriate business records.

3.9 Information designed to remain on your device

Your onboarding assessment (answers, symptoms, severity score, and reasons), recovery records (check-ins and their notes, urges and their tags, relapses, pledges, tasks, focus sessions, achievements, blocker settings, quit date, and your streak), journal entries, saved AI-chat history, Screen Time selection tokens, and local app preferences stay on your device and are not uploaded to Primal's servers, except the arena level and streak day count shown on community posts and replies you publish (Section 3.3). Copies that versions of Primal before 1.0.1 uploaded have been deleted from our servers (we checked on 6 November 2026 that none remain). Because these records exist only on your device, a new iPhone or a reinstall starts with a fresh history unless you restore the device from an iCloud or computer backup. The live camera mirror used by a grounding feature is not recorded, stored, or uploaded by Primal. There is no Home Screen widget in the current build.

Local information can still be included in an encrypted or unencrypted device backup depending on your iOS and Apple backup settings. Deleting the app normally removes its local data from that device, but it does not necessarily remove an existing device backup.

The current storage design is:

3.10 Sensitive recovery information

Much of the information in Sections 3.2, 3.3, and 3.5 reveals intimate or private health information about your habits and recovery and is treated as sensitive. We use it only to provide the recovery service you ask for. Sensitive recovery information is never sold, never used for advertising or profiling, and never shared with data brokers. The only health-related fact that can reach advertising companies is that you installed or subscribed to Primal, and only if you choose Allow on Apple's tracking prompt (Section 3.7).

4. How we obtain information

We obtain information:

• directly from you when you register, post in the community, use Leo, or contact support (what you record while tracking your progress stays on your device);
• automatically from the app and device when you use Primal;
• from Apple for authentication, purchases, subscription status, and push delivery;
• from RevenueCat for subscription management; and
• from other users when they interact with or report community content.

5. How we use information

We use personal information to:

• create and secure your account;
• provide check-ins, insights, streaks, goals, blocking tools, AI replies, community features, and notifications;
• process purchases, restore access, and manage entitlements;
• personalize the experience based on the information you provide;
• operate, test, troubleshoot, and improve Primal;
• detect abuse, moderate content, enforce our Terms, and protect users;
• respond to support, privacy, and legal requests;
• comply with law and establish, exercise, or defend legal claims; and
• send important service or policy notices.

We do not use your recovery information to determine eligibility for employment, housing, credit, insurance, or similar decisions.

5.1 Automated insights

Streak counts, insights, arena levels, achievements, and reminder timing are calculated automatically, on your device, from the information you enter. This logic is simple rule-based processing that runs to show you your own progress. It is not a medical evaluation, does not diagnose anything, and does not produce decisions that have legal or similarly significant effects on you. Separately, our server checks community posts, replies, and photos automatically (Section 3.3); a person reviews reports and decides on any action against an account.

6. Legal bases for UK and EEA users

Where UK or EEA data-protection law applies, we rely on the following legal bases:

How consent works in Primal. Primal asks you to accept or agree to something in only these places:

• The first screen says: "By continuing, you accept our Privacy Policy and Terms of Use (EULA)", with both linked. The sign-in screen says that by continuing you agree to the Terms of Use (EULA) and Privacy Policy, and the paywall links both again (it does not repeat the sentence). When a purchase completes, the app records that acceptance on your device with the policy version and the time, and sends a copy to our servers once you are signed in. Some records from before 6 November 2026 were kept only on the device.
• Apple's permission prompts: the tracking prompt for ad attribution (on the first screen, Section 3.7), notifications, Screen Time, the camera when you open the panic mirror, and saving an image to Photos.
• Leo's "Before we talk" notice, the first time you use Leo on a device (Section 3.5).
• The Community Rules, once, before Community first opens: "By tapping I agree, you accept these rules and our Terms of Use (EULA)."

All of our policies, including the Consumer Health Data Privacy Policy, are in the app in Settings → Legal (Settings is part of paid access) and always at https://primalapp.cloud. Your recovery records stay on your device, so we do not store them. If you publish health-related information in a community post or reply, your explicit consent is given by choosing to publish it. You can withdraw it at any time by deleting the post or reply, or by deleting your account.

There are no in-app switches for Leo AI or product analytics. Leo AI is available with paid access, and a message goes to an AI provider only when you choose to send it. If you do not want AI processing, do not message Leo. You can delete saved Leo conversations at any time with Settings → Privacy & data → Clear Leo chat history. Product analytics and crash reports are always on and are not a toggle; you may object to either by emailing admin@functionalapps.org. Earlier versions of Primal had Leo AI and Product analytics switches. They were removed on 4 October 2026, and a choice made with them no longer has any effect. Optional consents, such as using Leo or allowing tracking, are not a condition of buying Primal Pro. You may withdraw an optional consent for future processing at any time without affecting processing already performed or your paid access.

7. How we disclose information

We do not sell personal information for money, and we never disclose your recovery records, answers, notes, chats, or community content for advertising. The only advertising-related disclosure is the ad measurement described in Section 3.7, and only after you choose Allow on Apple's tracking prompt; under some US state laws it may count as "sharing" or "targeted advertising", and you can opt out as described there. We disclose information only to the recipients below, and only for the stated purposes. We share information only with providers whose terms require them to protect it at least as well as this policy does, with the same or equal protection, and to use it only to provide their service to us.

• Google Firebase / Google Cloud (Authentication, Firestore, Cloud Functions, Cloud Storage, Cloud Messaging, App Check, Cloud Logging). Receives your account identifiers, the account and community records described in Section 3, community photos, push tokens, Leo messages passing through our Cloud Function, service logs, and device attestation signals. Never receives your recovery records, which stay on your device, apart from the arena level and streak day count shown on posts and replies you publish. Hosted in the United States. Google acts as our processor.
• Firebase Crashlytics. Receives crash stack traces, device model, operating-system and app version, and an installation identifier. Never receives journal text, chats, your name, or your email. Always on; you may object by emailing admin@functionalapps.org.
• PostHog (EU). Receives only allow-listed funnel events with a random identifier and the IP address the device connects from, never recovery content or free text. Always on; you may object by emailing admin@functionalapps.org.
• OpenRouter → OpenAI GPT-OSS-120B on a zero-data-retention-eligible inference host. Receives the Leo message you type plus up to the last eight turns of that conversation. Never receives your name, email, account ID, recovery records, or journal entries. Only when you choose to send Leo a message. OpenAI is the model developer and licensor and is not represented as receiving prompts under the current third-party hosted route.
• RevenueCat. Receives your Primal account ID (as its user ID), App Store transaction identifiers, products, and entitlement status, and the device information its software sends (device model, operating-system and app version, IP address, App Store country). If you allow tracking, it also receives your device's advertising and vendor identifiers and your AppsFlyer ID, and passes your subscription events to AppsFlyer. Never receives recovery content. RevenueCat acts as our service provider.
• AppsFlyer (only if you choose Allow on Apple's tracking prompt). Receives the information described in Section 3.7 to measure which ads led to installs and subscriptions, and reports attributed results to the ad network that showed the ad. AppsFlyer acts as our service provider.
• Advertising networks (currently Meta (Facebook and Instagram), TikTok and X), only if you choose Allow on Apple's tracking prompt and only when one of their ads brought you to Primal. They receive the attributed install or subscription with your device's advertising identifier, and may derive your approximate location from the IP address AppsFlyer passes on. Each network handles what it receives under its own terms and privacy policy and may use it to measure and improve the delivery of our ads, as an independent controller. We are not paid for this information.
• Google Cloud Vision. Receives each community photo once, before it is shown, to check it against the Community Rules. Receives the image only, not your account details. Google acts as our processor.
• Namecheap (Private Email). Hosts our moderation inbox. When someone reports a post, a reply, or a person, or blocks someone, we email it there so a person can review it: the content concerned, the handles and account IDs of its author and of the person reporting or blocking, and a link to the content. When a photo cannot be checked automatically, the post, its author's handle, and the author's account ID are emailed there for a person to check. Namecheap acts as our processor.
• Hostinger. Hosts our website, primalapp.cloud, and keeps its standard server access logs (Section 1). Hostinger acts as our processor.
• Apple. App Store purchases and refunds, Sign in with Apple, push-notification delivery, and Screen Time / Family Controls, which stays on your device. Apple acts as an independent controller under its own privacy terms.
• Other community members. Your handle, arena level, streak day count (on posts), and what you post are visible to other signed-in users. Their apps can also technically read the internal account ID attached to your posts, replies, and photo paths (Section 3.3). Who reported a post or reply is not stored on it.
• Professional advisers and authorities. Information reasonably necessary for legal, audit, compliance, safety, or claims purposes.
• Transaction participants. Information necessary for a business transfer as described in Section 17.

We require service providers acting on our behalf to process information only for authorised purposes and to provide the same or an equivalent level of protection as described in this policy and required by Apple's App Review Guidelines. Some recipients, such as Apple, may also act as independent controllers under their own privacy notices.

8. International transfers

Primal's Firebase backend currently runs in the United States, including the us-central1 region. Other providers may process information in the United States or other countries. Where required, we use recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision. You may contact us for information about the safeguards relevant to your data.

9. Retention

We keep personal information only for as long as reasonably necessary for the purposes described above, including security, legal, tax, accounting, and dispute requirements.

Deleting the app normally removes its ordinary sandbox data, including SwiftData, local JSON files, saved Leo history, journals, Screen Time tokens, and preferences. Because your recovery records are kept only on the device, deleting the app also deletes them, except for any copy in a device backup. Uninstalling does not submit an account-deletion request and does not delete Firebase, community, subscription-provider, or other cloud records. iOS Keychain credentials may survive uninstall. Use the in-app deletion path or the email route in Section 11 to delete cloud and provider records as well.

When deletion cannot happen immediately because information remains in encrypted backups, we isolate it from ordinary use and delete or overwrite it on the backup cycle, unless law requires preservation.

10. Your choices and rights

Depending on where you live, you may have rights to:

• know whether we process your personal information and access a copy;
• correct inaccurate information;
• delete information;
• obtain a portable copy of information you provided;
• restrict or object to certain processing;
• withdraw consent for future processing;
• opt out of a sale, sharing, or targeted advertising: Primal does not sell your information for money; to stop the ad-attribution sharing in Section 3.7, choose Ask App Not to Track, turn off Tracking for Primal in iOS Settings, or email admin@functionalapps.org; and
• appeal a decision or complain to your local data-protection authority.

In the app. While you have paid access, export and deletion are available in Settings without contacting us. Settings is inside the paid app, so without an active subscription, email us instead:

• Export my data: Settings → Privacy & data → Export my data produces a JSON copy of your local records and of the account and community records on our servers. The stored Apple credential is redacted from the export. It does not yet include some details of local records (notes and tags on check-ins and urges, and trigger and place tags on relapses); those stay on your device, where we cannot see them, and you can still view them in the app. It also leaves out the photo files themselves (their storage paths are included), reports other members filed about you, and data held by our providers. Email admin@functionalapps.org for a copy of those.
• Delete my account: Settings → Privacy & data → Delete account & data (also reachable from Settings → ACCOUNT → Delete my account); choose Delete now or Delete after 24 hours (which can be cancelled). You can also ask by email at any time. See Section 11.
• Clear Leo chat history: Settings → Privacy & data → Clear Leo chat history deletes every saved Leo conversation on this device.

You can also change certain profile and notification settings in the app, disable notifications in iOS Settings, and delete individual community content where the feature allows.

By email. Access, export, and deletion requests when you no longer have paid access; correction, restriction, objection (including objection to product analytics, crash reports, or ad-attribution sharing), and portability requests; and requests to delete previously collected analytics or AppsFlyer data are handled by emailing admin@functionalapps.org. We may need to verify your identity before completing a request. We will respond within the period required by applicable law.

Complaints. If you are in the UK, you may complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA, you may complain to the supervisory authority where you live or work. You may also contact us first so we can try to resolve the issue.

11. Account deletion

How to delete your account. You can delete your account in either of these ways:

1. In the app (while you have paid access). Go to Settings → Privacy & data (or Settings → ACCOUNT → Delete my account), tap Delete account & data, and choose Delete now or Delete after 24 hours. If you choose the 24-hour option you can cancel it with Cancel deletion on the same screen before the deadline.
2. By email (at any time, including without paid access). Email admin@functionalapps.org with the subject line "Delete account". In the body, include the email address you signed in with; if Sign in with Apple hid your email, include your Primal handle as well. To protect your account, we confirm the request by replying to the email address on the account before we delete anything. We then schedule the deletion to complete within 24 hours. Until then the app shows Deletion scheduled, and you can cancel it there. You can log out of the app after sending your request.

Deletion runs on our servers immediately, or at the deadline through an hourly scheduler.

What is deleted on our servers. The deletion process:

• tries to revoke your Sign in with Apple token and to delete your RevenueCat subscriber record;
• deletes the community posts and replies you authored, including their photos in Cloud Storage, reactions, poll votes, and impressions;
• removes the strength votes, poll votes, and impressions you made on other people's content, and repairs the affected counts;
• deletes purchase-claim records;
• releases your public handle and deletes your public profile;
• deletes your Firebase Authentication account; and
• finally deletes all private records under your account: settings, subscription state, the Sign in with Apple refresh token, Leo usage counters, rate-limit counters, push tokens, joined groups, poll votes, blocks, and any consent records.

If Apple or RevenueCat cannot be reached, your Primal data is still deleted. We keep a failure record (your account ID, the failed step, the error, and, if Apple's revoke failed, the Apple token needed to retry it) and finish that step with the provider manually, then delete the record. If one of our own deletion steps fails, it is retried with increasing delays (after 1, 2, and 4 hours, then every 6 hours, up to 24 attempts) and then passed to us to finish by hand.

What is anonymised rather than deleted. Abuse reports and moderation-queue records that reference your account—whether you were the reporter or the subject—are not deleted. They are anonymised: account-ID fields are replaced with “deleted” and content fields are removed. The reason, status, outcome, and timestamps are kept, and for a report you filed about someone else, the location (path) of the reported item is kept. We retain these anonymised records for safety, enforcement, and dispute resolution for up to 24 months. Their internal record identifiers may still contain the former account ID, which no longer maps to any account after deletion.

What deletion does not reach automatically.

• AppsFlyer and the ad networks. If you allowed tracking, the information they received (Section 3.7) is not deleted by account deletion. Email admin@functionalapps.org, before or after deleting your account, and we will send AppsFlyer an erasure request for your device. You can also stop new sharing at any time in iOS Settings > Privacy & Security > Tracking.
• Our moderation inbox. Report, block, and unchecked-photo emails already sent to it (Section 7) are not altered; they are deleted within 24 months of the email.
• Service logs in Google Cloud Logging, which can contain your account ID, expire within 30 days.
• Provider backups are deleted on the provider's backup cycle.

What is cleared on your device. When deletion completes, the app clears the account's local database, local JSON caches (blocking state, community drafts, and Leo history), account-scoped preferences and consent records, analytics state, Screen Time shields, and the signed-out onboarding store. Leo's "Before we talk" agreement is stored for the device, not the account, so it is not cleared. If you no longer have the app, delete its local data and relevant device backups through your Apple settings. Signing out (without deleting) keeps the local database on the device but removes Screen Time shields until you next sign in.

Deleting your Primal account or the app does not cancel an Apple subscription. Manage or cancel subscriptions in your Apple Account subscription settings.

12. Security

We use safeguards designed for the sensitivity of the information we process, including TLS in transit, platform authentication, access-control rules, server-side validation, Apple Keychain storage for session credentials, and Firebase App Check. Access is limited to people and providers who need it for authorised purposes.

No method of storage or transmission is completely secure. Please use a protected device and contact admin@functionalapps.org if you believe your account or data is at risk.

12.1 Security incidents

If we become aware of a security incident affecting your personal information, we will investigate it, take steps to contain and mitigate it, and notify you and the relevant authorities where applicable law requires. Depending on the situation we may notify you by email, by a notice in the app, or by a notice on our website.

13. Age 18 and over only

Primal is intended only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has used Primal, contact admin@functionalapps.org so we can investigate and delete the information where appropriate.

We do not verify identity, use age-assurance technology, or ask an in-app age question. By using Primal or creating an account you confirm that you are 18 or older; the 18+ restriction is a condition of using the Service, as stated in the Terms and Conditions, and your use is a representation that you meet it.

14. Child safety

Primal has zero tolerance for child abuse material (CSAM), the exploitation or abuse of children, grooming, trafficking, or any content or conduct that exploits, abuses, endangers, or harms a minor, or depicts a minor inappropriately. Users can report content and accounts through the in-app tools or by emailing admin@functionalapps.org.

We may remove content, restrict or terminate accounts, preserve evidence where lawful, and make reports to competent authorities or child-safety organisations when required or permitted by law. We disclose only information reasonably necessary for the safety, investigation, or legal purpose. Primal does not promise continuous or real-time monitoring.

15. Health and emergency notice

Primal is a self-help tool, not a healthcare provider, medical device, therapist, or emergency service. Nobody watches the app for emergencies. Automated checks only show crisis-support information when a Leo message or a community post uses crisis or self-harm language (Sections 3.3 and 3.5); they do not alert anyone. If you may harm yourself or someone else, contact local emergency services or an appropriate crisis service immediately.

16. Emails we send

The only emails Primal sends you are replies to support, privacy, or legal requests you send to admin@functionalapps.org, including the confirmation we send before completing an emailed deletion request. Primal uses Sign in with Apple only, so it sends no sign-in-link, verification, or password-reset emails. Report, block, and photo-check emails go only to our own moderation inbox (Section 7), never to other members.

We do not send marketing email and there is no mailing list to unsubscribe from.

17. Business transfers

If Primal is sold, merged, reorganised, financed, or its assets are transferred, your personal information may be transferred to the successor. Any successor will be bound by this policy for the information transferred, or we will give you notice of any material change in how your information is handled and, where required, ask for your consent.

18. Changes to this policy

We may update this policy as Primal, our providers, or the law changes. We will change the “Last updated” date and provide additional notice in the app when a change is material or consent is required. If we need personal information for a materially different purpose, we will provide notice and seek consent where required.

19. Contact us

Syed Khizer
Email: admin@functionalapps.org

20. Privacy summary

• Primal is run by Syed Khizer, an individual; contact admin@functionalapps.org.
• Primal is for people aged 18+. We do not verify identity or ask an in-app age question; by using Primal you confirm you are 18 or older.
• Primal's first screen says that by continuing you accept this policy and the Terms of Use (EULA), with both linked; the sign-in screen says the same, and the paywall links both. A completed purchase is recorded as acceptance on your device and, once you are signed in, on our servers. All policies are in Settings → Legal.
• Your onboarding answers, journal entries, and Leo chat history stay on your device. Primal does not ask for your name, age, or gender.
• Recovery records (check-ins, urges, relapses, pledges, tasks, focus sessions and your streak) stay on your device and are not uploaded to our servers, except the arena level and streak day count shown on community posts and replies you publish.
• Leo AI processes only the messages you choose to send it, after you agree on Leo's one-time notice on that device. Anonymous product analytics and crash reports are always on, and you can object to either by emailing admin@functionalapps.org. Apart from Apple's permission prompts, Leo's notice, and the one-time Community Rules agreement, nothing in the app asks you to consent.
• Leo requests forwarded to OpenRouter carry your message and up to eight recent turns, never your name, email, account ID, recovery records, or journal. Clear your saved Leo history any time in Settings → Privacy & data.
• The blocker works only through Apple's Screen Time. Primal does not route, inspect, or log your web traffic.
• Recovery information is never sold, never used for advertising or profiling, and never shared with data brokers. Only if you choose Allow on Apple's tracking prompt, AppsFlyer and the ad network that showed our ad learn that you installed or subscribed; you can opt out at any time.
• Other community members can see your handle, arena level, streak day count, and what you post; their apps can also technically read the account IDs attached to posts and to reports on them.
• Export your data as JSON. Delete your account in the app while you have paid access (immediately or after a cancellable 24-hour grace period), or at any time by emailing admin@functionalapps.org with the subject "Delete account" (scheduled to complete within 24 hours of confirming it's you). Deletion does not cancel an Apple subscription.
• After deletion we keep only anonymised moderation records and moderation-inbox emails (up to 24 months), a failure record if a provider step could not finish, and service logs (up to 30 days). AppsFlyer data is erased on request by email.
• The only emails we send you are replies to your requests.