This privacy policy applies to Sonia AI: Mindful Mood Tracker, a web application accessed through a browser, together with any related services operated by Muhammad Nurhazrul (collectively, the "Application"). Muhammad Nurhazrul is hereby referred to as the "Service Provider".
Information Collection and Use
The Application is designed to keep what you write on your own device. Your conversations, journal entries and preferences are stored in a database held inside your browser’s storage for this site.
You can use the Application without an account, and by default you have none. In that state nothing you write is stored on a server owned by the Service Provider, and there is one consequence worth stating plainly: because the data is tied to this browser on this device, it does not follow you to another browser, another computer, or a private window. Clearing your browsing data for this site erases it, and there is no backup anywhere else.
If you create an account, the same information is additionally copied to the Service Provider’s cloud storage so that it reaches your other devices and survives clearing your browser. This is described under Accounts and Sync below, and it happens only after you have created an account — never before. Settings › Data Management offers an export in either case, so you can keep your own copy.
Data that stays on your device unless you create an account:
- Your nickname, age range, chosen personality, concerns and support style
- Everything you type in a conversation, and every journal entry
- Your favourites, session history and audio progress
Data that leaves your device:
- The content of your messages is sent to Anthropic, the Service Provider's artificial intelligence provider, so that a reply can be generated. This is the only way the Application can respond to you, and it is described under Artificial Intelligence below.
- If error reporting is enabled for this deployment, crash reports — browser and operating system version, the route you were on, and a stack trace — are sent to Sentry, together with a randomly generated identifier that is not linked to your nickname. Conversation content, journal entries and crisis flags are deliberately excluded from these reports.
- If you create an account, your email address is held by Google Firebase Authentication, and your conversations, journal entries and preferences are copied to Google Cloud Firestore so they reach your other devices. This is described under Accounts and Sync below.
- If you subscribe, your payment details are collected and processed by RevenueCat and its payment processor. The Service Provider never receives or stores your card number, and receives only whether a subscription is active.
The Service Provider does not collect your name, phone number, contacts, photos or location, and asks for an email address only if you choose to create an account, subscribe, or contact support. The randomly generated identifier used for error reporting is not linked to your nickname or to anything you write.
Accounts and Sync
Accounts are optional. Every feature of the Application — conversations, breathing, sleep sounds, the journal and Crisis Help — works without one, and without one nothing you write leaves this browser except as described under Artificial Intelligence below.
What creating an account does. It copies your profile, conversations, messages, journal entries, favourites, daily plans and audio progress to Google Cloud Firestore, filed under an account identifier that belongs to you alone. The copy is what allows the same journal to appear on your phone and your laptop, and what allows it to survive clearing your browser or losing the device.
Where it is stored and who can read it. The data is held in Google Cloud Firestore under the Service Provider’s Firebase project. Access rules restrict every account to its own data: no other user of the Application can read what you have written. The Service Provider does not read your conversations or journal entries and has no feature that would display them.
What is stored about the account itself. Google Firebase Authentication holds your email address and an authentication credential so that you can sign back in. If you sign in with Google, Google additionally tells the Application your email address and account identifier; the Service Provider does not receive your Google password.
Turning it off. Signing out stops the copying immediately and leaves the local copy on your device untouched. Deleting the cloud copy is done through Settings › Data Management › Reset everything, which while signed in removes both the copy on this device and the copy held for your account.
Cookies and tracking technologies
The Application or its third-party SDKs may use cookies, SDKs, pixels, and similar technologies to support functionality, analytics, or service delivery. Where required by applicable law, the Service Provider will obtain consent before using non-essential tracking technologies.
Your Rights
You may request access to, correction of, or deletion of your personal data held by the Service Provider. To exercise these rights, or to withdraw consent where processing is based on consent, contact the Service Provider at biztech755@gmail.com.
Your California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. To exercise your CCPA/CPRA rights, contact the Service Provider at biztech755@gmail.com.
Artificial Intelligence
Sonia's replies are written by an artificial intelligence model. The Application does not host that model. It is operated by Anthropic PBC, 548 Market Street, San Francisco, CA 94104, United States — an independent company, and the only third party that ever receives what you write.
What is sent to Anthropic, and how it is collected. The Application collects this data from you directly, as you type it in the Application, and sends it over an encrypted connection at the moment you send a message:
- The text of the messages you type in a conversation
- The earlier messages in that same conversation, so the reply can follow the thread
- Your nickname, and the personality, concerns and support style you chose during setup, so the reply is addressed to you
- When a conversation ends, its transcript, once, so that a short journal summary can be written for you
What is never sent to Anthropic: your journal entries, your conversation history from other sessions, your name, email address, phone number, contacts, location, photos, health data, or any advertising or tracking identifier.
What it is used for. The data above is used for one purpose only — generating the reply or the journal summary you asked for, and returning it to your browser. It is not used for advertising, profiling, or any other purpose, and the Service Provider does not sell it or share it with anyone else.
Your permission is asked first. Before anything you write is sent to Anthropic, the Application shows you a screen explaining what is sent and who receives it, and asks you to agree. Nothing is transmitted unless you agree. Declining is a real choice: breathing exercises, sleep sounds, your journal and Crisis Help all continue to work without it. You can withdraw your agreement at any time in Settings › Your data › AI conversations, and transmission stops immediately.
Protection by the third party. Anthropic acts as the Service Provider's processor and is contractually required to protect this data to the same standard set out in this policy, to use it only to provide the service described above, and not to use it for any purpose of its own. Anthropic states that it does not train its models on data submitted through its business API, and by default retains that data for no more than thirty days. Anthropic's own handling of the data is additionally governed by its privacy policy, linked below.
Journal summaries are generated the same way, from the conversation they summarise, and are subject to the same permission.
AI-generated replies can be wrong. Sonia is not a therapist, not a doctor and not a crisis service, and nothing it says is medical advice. Please speak to a qualified professional before making any decision about your health, and use the Crisis Help screen — always free, and available without an account — if you need urgent support.
The Service Provider may use the information you provide to send important information, required notices, and, where permitted by law, marketing communications.
For a better experience while using the Application, the Service Provider may require you to provide certain personally identifiable information, including but not limited to biztech755@gmail.com. The information the Service Provider requests will be retained and used as described in this privacy policy.
Third Party Access
Apart from the message content sent to the AI provider with your permission, as described under Artificial Intelligence above, only anonymous usage and crash data is transmitted to external services, and only in order to operate and improve the Application. Each of these providers is named below, acts on the Service Provider's instructions, and is contractually required to protect the data it receives to the same standard set out in this policy. The Service Provider does not sell your data and does not share it with advertising networks.
International Data Transfers
The Service Provider or its third-party service providers may transfer personal data to countries outside your country of residence, including outside the European Economic Area (EEA). Where applicable law requires safeguards for international transfers, the Service Provider will use appropriate mechanisms.
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions or other legally recognized transfer mechanisms
- Your consent, where required and legally permitted
Data protection laws in other countries may differ from those in your jurisdiction. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.
Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:
The Service Provider may disclose User Provided and Automatically Collected Information:
- as required by law, such as to comply with a subpoena, or similar legal process;
- when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
- with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.
Opt-Out Rights
You can stop all further collection by signing out, if you have an account, and then clearing your browsing data for this site, which also erases everything the Application has stored locally. Clearing your browser does not delete the cloud copy held for an account — use Settings › Data Management › Reset everything while signed in for that, or the contact address below.
To request deletion of your personal data, to withdraw consent, or to exercise any of your rights, contact the Service Provider at biztech755@gmail.com.
Data Retention Policy
The Service Provider retains personal data based on its necessity for the stated purposes:
- User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law
- Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance
- Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you
- Data required for legal compliance: Retained as long as required by applicable law
You may request deletion of your personal data, subject to any legal obligation to retain it. If you want the Service Provider to delete User Provided Data submitted through the Application, please contact them at biztech755@gmail.com. Please note that some User Provided Data may be required for the Application to function properly.
Data Deletion
You can request deletion of your personal data or account by contacting the Service Provider at biztech755@gmail.com. The Service Provider will process your request within the timeframes required by applicable law.
You can delete your own data immediately, without contacting anyone: Settings then Data Management offers both "Delete all conversations" and "Reset everything". While signed in, "Reset everything" deletes both the copy in this browser and the copy held for your account. Without an account, clearing your browsing data for this site removes the database with it. For the anonymous error records held by the third parties listed above, contact the Service Provider and they will be deleted.
Children
The Application is not intended for children under 13 years of age, or such higher age as required by applicable law. Setup asks for your age range and blocks the Application entirely for anyone under 13. Users aged 13 to 17 receive additional safety handling. The Service Provider does not knowingly solicit data from children or market the Application to them.
Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The Service Provider does not knowingly collect personally identifiable information from children under 13 years of age in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (biztech755@gmail.com) so that they will be able to take the necessary actions.
Security
The Service Provider is concerned about safeguarding the confidentiality of your information. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains.
Data Breach Notification
If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.
Changes
The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.
Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at biztech755@gmail.com.
This privacy policy is effective as of 2026-08-31
Your Consent
Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.
Contact Us
If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at biztech755@gmail.com.