Privacy Policy

Short version

This summary is here so you actually read something. It is not a substitute for the full policy below, which controls.

• Prelua works by observing signals — your check-ins, what content you engage with, how your phone-use rhythm changes. That observation is the product, so we describe it in detail rather than burying it.
• We do not sell your personal information, and we do not share it for anyone’s advertising. There are no advertising SDKs in the app.
• Coach chat messages leave your device and are processed by our third-party AI inference provider in order to generate a reply and to screen for crisis language.
• Health-app data (Apple Health / Health Connect) is read only if you grant permission, is never used for advertising, and is never sold or shared for a third party’s own purposes.
• You can delete your account and your data from inside the app, or by emailing us. See Delete your account.

1. Who we are

Prelua (“Prelua”, “we”, “us”) is operated by Prelua, Registered office address — to be confirmed. For the purposes of applicable data protection law, Prelua is the business responsible for personal information collected through the Prelua mobile application and the prelua.app website (together, the “Service”).

Privacy questions and requests: [email protected].

2. Scope

This policy covers the Prelua app and this website. Prelua is offered at launch only to users in the United States, and our data practices are built to comply with the California Consumer Privacy Act as amended by the CPRA, alongside comparable state privacy laws. Our consent records are structured to be extensible to the GDPR and India’s DPDP Act if we open other markets; this policy will be updated before that happens.

Data is stored and processed in the United States. Prelua is not directed to, and may not be used by, anyone under 13.

3. What we collect

3.1 Account information

• Sign-in identifiers. If you sign in with Apple or Google, we receive a stable user identifier and, depending on your choices with that provider, an email address. Prelua has no password of its own — we never see or store one.
• Anonymous accounts. You can use Prelua without signing in. In that mode we create a randomly generated account identifier. It is not linked to your name or email unless you later choose to attach an Apple or Google account, which preserves your history.

3.2 Onboarding information

• Country. Determined once, at signup, from the IP address of your request. The IP address is read in memory and discarded — we do not store your IP address as part of your profile. We keep only the resulting two-letter country code.
• Birth year, used to apply our 13+ age gate and, for users under 18, the teen safety tier described in section 11.
• Gender — optional, and skippable. Used only to form the cohort buckets described in section 10.
• Your primary goal (for example sleep, anxiety, focus, or habit change).

3.3 What you tell us

• Mood check-ins. Your selected mood and the contextual reason you select alongside it.
• Thought entries. Optional free-text notes you choose to write. These are personal and we treat them as such: they are never shown to other users and never included in the aggregate patterns described in section 10.
• Coach chat messages. The messages you send and the replies you receive.
• Settings — reminder times, quiet hours, notification preferences.

3.4 Behavioural information generated by using the app

• Which content you open, skip, complete, replay or save.
• Which categories you browse and how long you spend in them.
• Whether you open, dismiss, or act on a notification, and how quickly.
• Session timestamps, session length and session frequency.

This is the largest and most important category of information Prelua uses. It is the basis of the Wellness Score described in section 6.

3.5 Passive signals derived on your device

• Sleep proxy. We derive an approximate rest window from periods of phone inactivity. This is a crude directional signal, not a sleep measurement, and we treat it as such.
• Step count from the device’s motion sensors, used as a trend signal only.
• Session-timing consistency and category breadth over time.

3.6 Optional health-app data

If — and only if — you grant permission, Prelua reads a limited set of data from Apple Health (HealthKit) or Health Connect: heart rate, heart-rate variability, and sleep stages. See section 8, which sets out the specific restrictions that apply to this data.

3.7 Device and technical information

• A push notification token and a device identifier, so that a reminder reaches your device and so we do not send you the same notification twice.
• App version, operating system version, and device model.
• Crash and error diagnostics, used to fix defects. We do not attempt to re-identify you from diagnostic data.

3.8 On this website

When you visit prelua.app we record which pages you view, which links and buttons you click (for example, “Join the beta”), the page that referred you, and basic device information: browser, operating system, screen size, and approximate location derived from your IP address. We do this without cookies or any other storage on your device; visits are counted with a privacy-preserving identifier our analytics provider computes on its servers. Website visits are not linked to your Prelua account, and we never record what you type or replay your visit. We use this only to understand which pages help and how people find Prelua.

4. What we never collect

To be unambiguous, Prelua does not collect or request:

• Precise or background location. We derive a country once, at signup, and nothing more.
• Your contacts, calendar, photos, camera, or microphone.
• Your activity on other websites or apps: no browsing history from elsewhere, no cross-app tracking.
• Advertising identifiers. There are no advertising or attribution SDKs in the app, and we do not participate in any advertising network or data exchange.
• Payment card details. Purchases are handled entirely by Apple or Google; we receive a subscription status, never your card.

5. How we use your information

We do not use your information for any purpose materially different from those listed without telling you first.

6. Automated analysis and the Wellness Score

Prelua works by automated analysis. It computes a composite Wellness Score from your mood trend, engagement, check-in consistency, sleep proxy and passive signals, and uses that score — together with rules stored in our system — to decide what content to show you and when to notify you.

The automated analysis affects only what Prelua shows you and when. It is not used to make decisions with legal or comparably significant effects, and it is not used to set your price or restrict access to anything you have paid for.

7. AI, the coach, and third-party inference

Coach chat is powered by large language models that we do not run on your device. This means the following, stated plainly:

• Your coach messages leave your device. They are transmitted over an encrypted connection to our third-party AI inference provider — NVIDIA, via its NIM inference endpoints — which generates the reply. Relevant context from your signal history (for example your recent mood trend) is sent alongside the message so the reply is grounded in your actual data rather than generic advice.
• Message content is screened before the coach sees it. Every message passes through an automated safety classifier that detects crisis, self-harm and abuse language. Where such language is detected, the system responds with crisis resources instead of coaching. This screening necessarily involves automated processing of the content of what you write.
• We do not sell this content, and we do not use it for advertising. We use it to generate your reply, to run the safety screen, to enforce usage limits, and to diagnose failures.
• Our inference provider processes content on our instructions in order to return a response. We choose providers whose terms are compatible with this policy, and we retain the option to run these models on infrastructure we control.

8. Health-app integrations (HealthKit / Health Connect)

These integrations are optional. Prelua functions without them; granting access improves the accuracy of the sleep and recovery components of your Wellness Score.

• We request read access only, and only to the specific data types named in section 3.6.
• Health data is never used for advertising or any similar use-based marketing, is never sold, and is never shared with or disclosed to any third party for that third party’s own purposes.
• Health data is not used for the cohort aggregation described in section 10 and is not disclosed to data brokers.
• You can revoke access at any time in your device’s Health settings. Revoking stops future reads; to remove data already held, delete your account or contact us.

9. Service providers

We keep the list of companies that touch your data deliberately short. Each processes data on our behalf, under contract, for the purpose stated:

We may also disclose information where we are legally required to, to establish or defend legal claims, or to protect someone from serious harm. If Prelua is ever involved in a merger or acquisition, we will notify you before your information becomes subject to a different policy.

10. Aggregation and cohort patterns

Prelua improves its predictions by learning statistical patterns across users. This is done on aggregate data only:

• Individual thought entries and individual chat messages are never included in cross-user analysis, and are never visible to other users.
• Aggregate patterns take the form “X% of users in this cohort who showed signal combination Y went on to show outcome Z”. They contain no identifiers.
• Cohorts are defined by broad age bracket, gender (if you provided it), primary goal, and baseline score quartile. A cohort must contain at least 30 users before it is used at all; below that threshold we fall back to a broader cohort or to your own data only.
• Health-app data and users aged 13–17 are excluded from this process entirely.

11. Users aged 13–17

Prelua accepts users aged 13 and over. If your birth year indicates you are under 18, a mandatory teen safety tier applies:

• Teen data is permanently excluded from cross-user cohort learning. It is used only to serve that individual user.
• No behavioural advertising or profiling for marketing, ever — for any user, and never for teens.
• Crisis-language handling and safety resources are applied without exception.

Prelua is not intended for children under 13 and we do not knowingly collect information from them. If you believe a child under 13 has created an account, email [email protected] and we will delete it. A parent or guardian may contact us at the same address to exercise rights on behalf of a user under 18.

12. How long we keep information

• Active accounts: we keep your data while your account exists, because your history is what makes the product work.
• Anonymous accounts: automatically purged after 90 days of inactivity.
• After you delete your account: your personal data is deleted from our production systems within 30 days. Aggregate statistics that no longer identify you and cannot be linked back to you may remain.
• Backups: encrypted backups are retained on a rolling basis and expire shortly after the deletion window.
• Records we must keep: transaction and tax records are retained as long as the law requires.

13. Your rights and how to use them

If you are a California resident, the CCPA/CPRA gives you the rights below. We extend the same rights to every Prelua user regardless of where they live, because maintaining two standards is how mistakes happen.

• Know what personal information we collect, why, and who we share it with.
• Access a copy of your personal information in a portable format.
• Delete your personal information — see Delete your account.
• Correct inaccurate personal information.
• Opt out of sale or sharing. There is nothing to opt out of: we do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months.
• Limit the use of sensitive personal information — see section 14.
• Non-discrimination. Exercising any of these rights will not change your price or degrade your service. We offer no financial incentive for your data.

How to exercise them. Deletion and data export are available inside the app, under Settings. For anything else, email [email protected]. We will acknowledge within 10 business days and respond substantively within 45 days, extending once by a further 45 days where a request is complex — we will tell you if that happens. We verify requests against the account they concern; where we cannot verify a request we will say so rather than disclose data to the wrong person. An authorised agent may submit a request on your behalf with written proof of authorisation.

Global Privacy Control. Because we do not sell or share personal information, there is no sale for a GPC or Do Not Track signal to stop. We honour such signals as a statement of preference regardless.

14. Sensitive personal information

Some of what Prelua processes is sensitive by nature — information about your mood, rest, and, if you enable it, health-app data. We want to be direct about how that is handled:

• It is used only to provide the Service you asked for — computing your score, selecting content, and running the coach and its safety screen.
• It is not used to infer characteristics about you beyond the product purposes described in this policy, and not for advertising, profiling for marketing, or sale.
• It is not disclosed to third parties except the providers listed in section 9, acting on our instructions.

Because our use of sensitive personal information is limited to what is necessary to provide the Service, the CPRA’s right to limit its use is already reflected in how the product works. If you would like us to stop processing it entirely, that means deleting your account — we cannot run the product without it.

15. Security

Data is encrypted in transit and at rest. Access to production data is limited to those who need it, database access is governed by row-level security policies so that one user’s records are not reachable from another user’s session, and server-side keys are never embedded in the app.

No system is perfectly secure and we will not pretend otherwise. If a breach affects your personal information we will notify you and the relevant authorities as required by law.

16. Changes to this policy

When we change this policy we update the “last updated” date at the top. For changes that materially affect how we handle your information, we will notify you in the app or by email before the change takes effect, and where the law requires it we will ask for your consent.

17. Contact

Prelua
Registered office address — to be confirmed
Privacy: [email protected]
Support: [email protected]