Privacy Policy

Last updated: April 23, 2026

Epiphra ("Epiphra", "we", "us", or "our") is a mobile application that provides a private space for reflection, emotional clarity, and journaling through conversations with an AI companion.

This Privacy Policy explains what information we collect when you use the Epiphra app, how we use it, and the choices you have. By using Epiphra, you agree to the collection and use of information in accordance with this policy.

1. Information we collect

Information you provide

• Account information. When you sign up or log in, we collect your name, email address, and (if you choose phone login) your phone number. If you sign in with Google or Apple, we receive your basic profile information from those providers.
• Profile and preferences. Settings you choose in the app, such as your preferred voice, language, and notification preferences.
• Conversations and reflections. The messages you send to the Epiphra AI companion and the responses you receive. These are stored so you can view your chat history.

Information collected automatically

• Device and usage data. Basic information about your device (type, operating system, app version) and how you use the app (features opened, session length, crashes) for reliability and product improvement.
• Voice data. If you use voice features, audio you record is transmitted to our speech-processing provider to generate the AI response. We do not permanently store raw audio recordings on our servers beyond what is needed to process your request.

We do not collect precise location, contacts, photos, or other sensitive personal data.

2. How we use information

We use the information we collect to:

• Create and manage your Epiphra account.
• Provide, maintain, and improve the Epiphra app and its features.
• Generate AI responses to your messages and remember your conversation history so you can continue where you left off.
• Keep your account secure and prevent abuse.
• Communicate with you about service updates, security alerts, and support requests.
• Understand how the app is used in aggregate so we can fix bugs and build better features.

We do not sell your personal information, and we do not use your conversations to serve advertising.

3. Third-party services

Epiphra relies on the following processors to operate. Each only receives the data it needs to perform its function:

• Supabase — authentication, database, and secure storage of your account and conversation history.
• Google (Gemini API) — generates AI replies and processes voice interactions.
• Google Sign-In and Apple Sign-In — authentication providers if you choose to sign in with them.
• App stores (Apple App Store, Google Play) — distribution, analytics, and crash reporting.

These providers have their own privacy policies governing how they handle data.

4. How we store and protect your data

Your data is stored on secure servers operated by our infrastructure providers (primarily Supabase). We use industry-standard measures including encryption in transit (HTTPS/TLS) and access controls to protect your information.

No method of transmission or storage is 100% secure, but we work to protect your data and notify you of material breaches where required by law.

5. Data retention

We retain your account and conversation data for as long as your account is active. You can delete individual conversations from within the app, or delete your entire account at any time, which permanently removes your personal data from our active systems within 30 days (backups are overwritten on a rolling cycle).

6. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your personal information.
• Export a copy of your data.
• Object to or restrict certain processing.
• Withdraw consent at any time.

To exercise any of these rights, email hello@epiphra.com . We will respond within 30 days.

You can also sign out, disconnect Google/Apple, and delete the app from your device at any time.

7. Children's privacy

Epiphra is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact hello@epiphra.com and we will delete it.

8. International users

Epiphra is operated from the United States / your region of operation. If you access the app from outside that region, you understand that your information may be transferred to, processed, and stored in countries whose data-protection laws may differ from those of your country.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated version here and update the "Last updated" date at the top. Your continued use of Epiphra after changes take effect means you accept the updated policy.

10. Contact us

If you have questions, concerns, or requests about this Privacy Policy or your data, please reach out:

Email: hello@epiphra.com
App: Epiphra