Effective: April 2026 · Auralith · Version 1.0
Please read carefully the following Privacy Policy relating to the Zenithra – Self Development app ("the App") and website, operated by Auralith ("we", "us", "our").
By registering or signing in to the App, you confirm that you have read and understood this Privacy Policy and agree to the collection and use of your data as described here.
We are committed to protecting your personal data in full accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For all privacy-related matters, contact our Data Protection contact at: [email protected]
1 — Who We Are
1.1 The App is owned and operated by Auralith, a company based in the United Kingdom. Auralith is the data controller responsible for your personal data collected through the Zenithra App.
1.2 Zenithra is a self-development and productivity application designed to help users track habits, manage daily tasks, monitor fasting and nutrition, log moods, manage finances, and improve personal wellbeing through AI-powered insights.
1.3 The App is available on iOS (Apple App Store) and Android (Google Play Store), as well as via web browser as a Progressive Web App (PWA).
2 — What Personal Data We Collect
2.1 We collect the following categories of personal information from you directly when you use the App:
- Identity data: Your name (or display name) and profile avatar.
- Contact data: Your email address, used for account registration, login, and service communications.
- Account data: Your login credentials (password stored in encrypted/hashed form — we never store plain-text passwords).
- Device & technical data: Mobile device ID, device type, operating system version, app version, IP address, browser type, and crash/error logs collected for technical support.
- Usage data: Information about how you interact with the App — which features you use, how often, and in what order — collected in anonymised or aggregated form to improve the App.
- Subscription & financial data: Your subscription tier and status. Full payment card details are handled exclusively by Apple or Google — we receive only a subscription confirmation token. We never store your card details.
- Behavioural & app content data: Tasks, to-do lists, habit logs, calendar events, time blocks, mood entries, journal notes, gratitude entries, and any other content you voluntarily create within the App.
Special Category Data: Because Zenithra includes health, wellness, fasting, and nutrition features, we also collect, store, and process the following "special category" or sensitive personal data — but only with your explicit consent, which you provide when you enter this data into the App:
- Sex / gender
- Age and date of birth
- Height
- Start weight and goal weight
- Current weight log entries
- BMI (calculated from height and weight)
- Calorie intake (calculated from your nutrition log entries)
- Fasting schedules, fasting duration, and fasting history
- Mood logs and emotional wellbeing scores
- Sleep and energy levels (if logged)
- Activity levels and exercise logs
- Personal health goals (e.g. weight loss, muscle gain, mental wellness)
You will have consented to us collecting, storing, and using this health and wellbeing data when you first entered it into the App, or via a separate consent prompt. You can withdraw your consent at any time by contacting us at [email protected], however this may mean we are no longer able to provide certain features of the App to you (see Section 7 below).
3 — How We Collect Your Data
3.1 Direct interactions. The majority of your data is collected directly from you when you: register an account; complete your profile; log habits, tasks, meals, fasts, moods, or finances; contact our support team; or respond to in-app prompts.
3.2 Automated technologies. When you use the App, we automatically collect certain technical data including device identifiers, session duration, feature usage patterns, and crash reports. This data helps us diagnose bugs, improve stability, and understand which features are most valuable.
3.3 Third-party sources. We may receive limited technical data from Apple App Store, Google Play Store, or our cloud infrastructure provider (Supabase) in connection with account authentication and subscription status.
3.4 AI interactions. When you use AI-powered features (e.g. the Zenithra Secretary briefings, AI insights, personalised recommendations), your anonymised and aggregated usage data may be processed to generate personalised responses. We do not share personally identifiable information with AI language service providers.
3.5 Health & fitness integrations (optional). The App may offer optional integration with Apple Health (iOS) or Google Fit (Android). This is entirely optional and no data is shared without your explicit permission. If you choose to link these services, selected activity data (e.g. steps, active time, calories burned) may appear in your Zenithra profile. This data is stored in your account for your personal use and will not be shared with third parties.
3.6 Cookies & local storage. The App uses browser local storage and session tokens to keep you logged in and to save your preferences. We do not use advertising cookies, third-party tracking pixels, or cross-site behavioural tracking. Your personal data is stored securely on Supabase servers (EU — Ireland region), not in browser cookies.
4 — How We Use Your Data, and Our Legal Basis
Below we have set out precisely how your personal data is used, and the legal basis under UK data protection law for each use:
4.1 Purpose/activity: To register you as a new user and create your Zenithra account.
Type of data: Name, email address, password (encrypted), device ID, financial details (if you purchase a subscription).
Lawful basis: Performance of a contract with you. Your consent (for health and dietary data).
4.2 Purpose/activity: To process your subscription, manage payments, and deliver premium App features.
Type of data: Name, email address, device details, subscription status (financial details processed by Apple/Google only).
Lawful basis: Performance of a contract with you. Necessary for our legitimate interests (to recover fees owed and maintain subscription records).
4.3 Purpose/activity: To provide the core Zenithra service — including habit tracking, task management, fasting tracking, calorie and nutrition logging, mood logging, AI insights, and your Life Score.
Type of data: Name, email address, personal profile, special category health and lifestyle data (age, sex, height, weight, fasting logs, calorie data, mood logs, activity levels).
Lawful basis: Performance of a contract with you. Your explicit consent (special category health, dietary, and wellbeing data).
4.4 Purpose/activity: To deliver personalised onboarding tips, motivational messages, daily briefings, and AI-powered insights tailored to your goals and usage patterns.
Type of data: Name, email address, personal profile data, usage data, habit and task data, mood and fasting logs.
Lawful basis: Performance of a contract with you. Your consent (for personalised communications and health-related recommendations).
4.5 Purpose/activity: To manage our relationship with you, including notifying you of changes to the App, Terms of Service, or Privacy Policy.
Type of data: Name, email address, subscription status.
Lawful basis: Performance of a contract with you. Necessary for our legitimate interests (to keep records updated and to inform you of material changes). Necessary to comply with legal obligations.
4.6 Purpose/activity: To administer and protect our business and the App, including troubleshooting, data analysis, system testing, security monitoring, and IT maintenance.
Type of data: Name, email address, device ID, technical usage data, crash logs.
Lawful basis: Necessary for our legitimate interests (for running our business, provision of IT and administration services, and network security).
4.7 Purpose/activity: To ensure the App is being used in accordance with our Terms of Service and to detect, prevent, and address fraud or abuse.
Type of data: Name, contact details, account details, usage behaviour.
Lawful basis: Necessary for our legitimate interests (to protect our business and users). Compliance with legal obligations.
4.8 Purpose/activity: To monitor trends, analyse usage patterns, and improve existing features and develop new features for the App.
Type of data: Anonymised or aggregated device ID, personal profile, usage data, feature interaction data.
Lawful basis: Necessary for our legitimate interests (to develop our products and services and grow our business). Data used for this purpose is anonymised wherever possible.
4.9 Purpose/activity: To enable you to take part in optional surveys, feedback forms, or in-app questionnaires about your experience.
Type of data: Name, contact details, opinions and any other information you voluntarily provide.
Lawful basis: Your consent. Necessary for our legitimate interests (to develop and improve our products and services).
4.10 Purpose/activity: To obtain insurance, legal advice, or to make or defend a legal claim, or for the purposes of a corporate transaction (e.g. merger or acquisition).
Type of data: Name, contact details, account details, relevant correspondence.
Lawful basis: Necessary for our legitimate interests (to administer our business, defend our legal interests, and raise corporate funds). Compliance with legal obligations.
5 — Who We Share Your Data With
5.1 We do not sell, rent, or trade your personal data to any third party for commercial purposes. We only share your data with third parties in the following limited and controlled circumstances:
- Cloud infrastructure (Supabase, EU Ireland): Your account and app data is stored on Supabase's GDPR-compliant, EU-based servers. Supabase processes data only on our instruction and under a data processing agreement.
- Payment processors (Apple / Google): In-app subscription billing is handled entirely by Apple App Store or Google Play Store. They process payment data under their own privacy policies and compliance frameworks. We receive only a subscription confirmation.
- AI service providers: Anonymised, non-personally-identifiable data may be processed by AI language model services to generate personalised App content (e.g. Secretary briefings, insights). No name, email, or directly identifying data is shared.
- Analytics providers: We may use analytics platforms to help us understand App usage and prioritise improvements. Where personal data is shared, we do so only in accordance with data protection laws and require all providers to respect your data and treat it in accordance with applicable law.
5.2 We may consult with specialist third-party experts (e.g. wellness or technical consultants) to address specific queries. In such cases, only the minimum data necessary is disclosed and no personally identifiable information is shared.
5.3 If required by law, court order, or government/regulatory authority, we may disclose your personal data to law enforcement agencies, regulatory bodies, or legal advisers in connection with any alleged criminal offence, legal proceedings, or a suspected breach of our Terms of Service.
5.4 Should Auralith be transferred to a new owner in the future, the new operator would be entitled to use your personal data in a way consistent with this Privacy Policy in order to provide a continued service to you. We will notify you of any such change before it takes effect.
6 — How You Can Manage Your Data & Preferences
6.1 You have full control over how we contact you and how your data is used within the App. You can manage your preferences at any time:
- Push notifications: Manage in Profile → Notifications, or via your device Settings at any time.
- Email communications: Essential service emails (e.g. password resets, billing receipts) cannot be turned off as they are required to deliver the service. Optional marketing or newsletter emails can be unsubscribed from via the link in any such email.
- Health data consent: To withdraw consent for the processing of your special category health data, contact [email protected]. Note: withdrawal of this consent will limit or prevent access to health-related features of the App.
- Account deletion: You can permanently delete your account via Profile → Data & Privacy → Delete Account. All your personal data will be deleted within 30 days.
6.2 If you wish to opt out of anonymised analytics collection, please contact us at [email protected].
7 — Data Security
7.1 We take the security of your personal data very seriously. We implement the following technical and organisational security measures:
- All data transmitted between your device and our servers uses HTTPS/TLS encryption.
- Your password is stored using industry-standard bcrypt hashing — we never store plain-text passwords.
- Your data is stored on Supabase (EU Ireland), a platform built with privacy features, row-level security, and end-to-end encryption capabilities.
- Access to your personal data is restricted to authorised personnel only, on a strict need-to-know basis.
- We conduct regular security reviews and promptly address any identified vulnerabilities.
7.2 You are also responsible for maintaining the security of your own account — keep your password confidential, do not share your login details, and notify us immediately at [email protected] if you suspect unauthorised access.
7.3 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware, as required by UK GDPR.
8 — International Data Transfers
8.1 Your data is primarily stored and processed within the European Economic Area (EEA) via Supabase's EU Ireland data centre, which offers equivalent data protection standards to the UK.
8.2 Some of our third-party service providers (e.g. AI services) may be based outside the UK/EEA. In such cases, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK ICO or equivalent adequacy protections, before any personal data is transferred internationally.
9 — Your Rights Under UK GDPR
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights regarding your personal data:
9.1 Your right to request access (commonly known as a "data subject access request" or DSAR) — this enables you to receive a copy of the personal data we hold about you and to verify that we are lawfully processing it.
9.2 Your right to rectification — if any data we hold about you is inaccurate or incomplete, you can correct this yourself within the App (e.g. updating your profile), or contact us and we will update it within one calendar month. We may need to verify the accuracy of the new data you provide.
9.3 Your right to be forgotten (erasure) — this enables you to ask us to delete or remove your personal data where there is no good reason for us continuing to process it. You also have this right where you have objected to processing (see 9.6), where we may have processed your data unlawfully, or where we are required to erase it to comply with local law. Note that we may not always be able to comply with a request for erasure for specific legal reasons, which we will explain at the time of your request.
9.4 Your right to restrict processing — you can ask us to suspend or limit how we use your personal data in certain circumstances, for example if you want us to establish its accuracy, or where our use is unlawful but you do not want us to erase it.
9.5 Your right to data portability — you can request that we provide you with a structured, machine-readable copy of your personal data within one calendar month, so you can transfer it to another service if you wish.
9.6 Your right to object — you can object to us processing your personal data where we are relying on legitimate interests as our legal basis, including profiling based on those interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
9.7 Your right to withdraw consent — where we are relying on your consent to process your personal data (particularly for special category health and wellbeing data), you can withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing already carried out before withdrawal. If you withdraw consent, we may not be able to provide certain features to you — we will advise you if this is the case at the time of withdrawal.
9.8 Rights related to automated decision-making — if any automated processing produces decisions that significantly affect you, you have the right to request human review, to express your point of view, and to contest the decision.
To exercise any of the above rights, contact us at [email protected]. We will respond within 30 days (one calendar month). If your request is complex, we may extend this by a further two months — we will inform you within 30 days if this applies.
If you have not received a satisfactory response within 30 days, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
10 — How Long We Keep Your Data
10.1 We retain your account and personal data for as long as your account is active and you continue to use the App.
10.2 If you have not signed in or used the App at all for a continuous period of 3 years, we will automatically delete your account and all associated personal data from our systems. Each time you sign in and use the App, this 3-year period resets. Once deleted, your account cannot be recovered — if you wish to use Zenithra again you will need to create a new account, and no previous data will be recoverable.
10.3 If you choose to delete your account manually (via Profile → Data & Privacy → Delete Account), we will permanently delete all your personal data within 30 days.
10.4 Certain data may be retained for longer periods where required by law — for example, billing and financial transaction records may be retained for up to 7 years under UK financial regulations, even after account deletion.
10.5 Anonymised, aggregated data (which cannot identify you individually) may be retained indefinitely for product improvement and statistical analysis.
11 — Changes to This Privacy Policy
This policy is effective from April 2026 and replaces any previous version with immediate effect.
We may, from time to time, update this Privacy Policy to reflect changes in our data practices, legal requirements, or new App features. Where a change is material or requires your consent under law, we will notify you by email and/or via an in-app notice before the change takes effect. It is your responsibility to check this policy periodically for updates.
Any changes posted to this policy become effective immediately upon posting. Your continued use of the App after notification of changes constitutes your acceptance of the updated policy.
Contact & Data Controller
Data Controller: Auralith
Data Protection Contact: [email protected]
Jurisdiction: United Kingdom
For all privacy queries, subject access requests, consent withdrawal, or data deletion requests, please email us at [email protected]. We aim to respond within 7 working days and will fully process all requests within 30 days.
© 2025–2026 Auralith. All rights reserved. Zenithra is a product of Auralith, United Kingdom.