Legal

Privacy Policy

Last updated: September 2026

This Privacy Policy explains how Catatonica, operated by Immanuel Gabriel, an individual ("we", "us", or "our"), collects, uses, and protects your information when you use our Service. We take your privacy seriously — especially given the personal nature of what you share with us.

1. What We Collect

We collect only what is necessary to provide the Service:

• Account information: email address and password (hashed, never stored in plain text)
• Content you create: situation names, intention texts, session records, genesis reflections
• Usage data: session counts, Catatons earned, completion events — used to power your dashboard

2. What We Don't Collect

• We do not collect your location
• We do not use advertising cookies or advertising trackers
• We do not sell your data to third parties — ever
• We do not use your content to train AI models

3. How We Use Your Data

Your data is used solely to:

• Provide and maintain the Service
• Authenticate your account
• Display your situations, sessions, and Catatons back to you
• Send essential service emails (account confirmation, password reset)

4. Data Storage

Your data is stored securely in Supabase (PostgreSQL), with Row Level Security enabled — meaning your data is only accessible by you. Supabase infrastructure is hosted on AWS in the EU (Ireland).

In your browser, the app keeps your sign-in session and the time of your last saved session in local storage, and holds the result of a session in session storage until it is saved to your account. These are functional only — nothing in them is used for tracking.

5. Third-Party Services

• Supabase — authentication and database hosting
• Cloudflare Pages — website hosting and content delivery
• Cloudflare Web Analytics — counts page views and measures page performance through a small script on each page; Cloudflare states it does not collect or use visitors' personal data
• Cloudflare Turnstile — bot protection on the sign-in and sign-up forms
• Google — optional "Continue with Google" sign-in, and Google Fonts, which serves the typefaces and receives your IP address when a page loads
• jsDelivr — delivers the Supabase client library to your browser and receives your IP address when it does

Each of these services has their own privacy policies governing their data handling.

6. Your Rights

You have the right to:

• Access all data we hold about you
• Request a copy of your content
• Delete your account and all associated data
• Correct inaccurate information

To exercise these rights, email privacy@catatonica.app.

7. Data Retention

We retain your data for as long as your account is active. To delete your account, email privacy@catatonica.app from the address you signed up with. We permanently delete your personal data within 30 days of the request.

8. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect data from children under 13.

9. Changes to This Policy

We may update this policy from time to time. The current version is always on this page, and the "Last updated" date above shows when it last changed. Where a change materially affects how we handle your data, we will also give notice in the Service or by email where appropriate. Continued use after changes constitutes acceptance.

10. Contact

For privacy questions or data requests: privacy@catatonica.app