🌿 Privacy & Data

Privacy Policy

Last updated: June 2026 · Effective: June 15, 2026

🌿 Our core promise: Your well-being data is sacred to us. We will never sell, rent, or trade your personal data to third parties for their marketing purposes. Everything you share in Willow is used solely to provide and improve your sanctuary experience.

1. Who We Are

Willow is developed and operated by Danuk Studio. We are the data controller for all personal data collected through the Willow App and website. For all privacy-related enquiries, contact us at support@danukstudio.com.

2. What Data We Collect

Account Data (when you create a permanent account):

Email address
Display name (if provided)
Authentication provider (Email, Google, or Apple)
Firebase User ID (UID)

Well-being & Usage Data:

Mood logs, energy levels, and mood notes
Habit completion history and streaks
Sleep duration logs
Focus session durations
Journal and Brain Dump entries
Companion progress, Essence balance, and unlocked items
In-app feature usage patterns (non-identifying)

Device & Technical Data:

Device type and OS version
App version
Crash reports and diagnostic logs (via Firebase Crashlytics)
Advertising identifier (IDFA on iOS if ATT permission granted; GAID on Android)

Purchase Data: Managed entirely by the App Store / Google Play and RevenueCat. We receive purchase confirmation only — we never store payment card details.

Anonymous Users: If you use Willow without creating an account, your data stays on-device (SharedPreferences) and is associated only with an anonymous Firebase UID. No personally identifiable information is collected.

3. How We Use Your Data

Provide the Service: Syncing progress across devices, powering Anchor Circle, and delivering personalised AI affirmations.
Improve the Service: Analysing anonymised, aggregated usage to prioritise features.
Crash Reporting: Diagnosing and fixing crashes via Firebase Crashlytics.
Advertising: Displaying ads via Google AdMob. Personalised ads only if you grant ATT permission.
AI Features: Your mood state and companion context are sent to the Google Gemini API to generate affirmations. Prompts are anonymised and not linked to your account by the API.
Purchases: Validating Essence purchases via RevenueCat.
Legal Compliance: Meeting obligations under applicable data protection laws.

4. Third-Party Services & Sub-processors

We use the following partners who may access your data solely to provide their services:

Google Firebase Auth, Firestore database, Crashlytics, Cloud Storage. GDPR-compliant. Policy ↗

RevenueCat In-app purchase receipt validation and subscription management. Policy ↗

Google AdMob Ad serving. Uses advertising ID for personalised ads (if ATT granted on iOS). Policy ↗

Google Gemini API AI affirmation and companion response generation from anonymised prompts. Terms ↗

Apple / Google Sign-In OAuth authentication. We receive only your name, email, and a unique identifier. Policy ↗

We may disclose your data if required by law, court order, or governmental authority, or to protect the safety of our users.

5. App Tracking Transparency (iOS)

On iOS 14.5+, we request permission via Apple's ATT framework to track your activity across apps and websites for personalised advertising. Declining this does not affect your ability to use Willow — you will still see ads, just not personalised ones.

Change your preference anytime: iOS Settings → Privacy & Security → Tracking → Willow.

6. Data Retention

Account & well-being data: Retained until you delete your account.
Crash reports: Auto-deleted by Firebase Crashlytics after 90 days.
Anonymous user data: Deleted after 24 months of inactivity.
Purchase receipts: Retained by RevenueCat per their policy.

7. Your Rights

Depending on your location, you may have the right to:

Access a copy of the personal data we hold about you
Rectify inaccurate data
Erase your data ("right to be forgotten") — delete your account in-app via Profile → Settings → Delete Account, or email us
Restrict our processing of your data
Port your data in a machine-readable format
Object to processing for direct marketing
CCPA (California): You have the right to know what data we collect and to opt out of its sale. We do not sell personal data.
GDPR (EEA/UK): You may lodge a complaint with your local data protection authority.

To exercise any right, email support@danukstudio.com. We respond within 30 days.

8. Children's Privacy

Willow is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact us at support@danukstudio.com and we will delete the account immediately.

9. Data Security

We protect your data with:

TLS encryption for all data in transit
Firebase Security Rules — only you can read your own data
Secure credential handling via Firebase Auth (raw passwords are never stored)
Apple-compliant nonce-based cryptography for Sign in with Apple

No transmission or storage method is 100% secure. While we apply every reasonable measure, we cannot guarantee absolute security.

10. International Data Transfers

Our services operate globally. Your data may be transferred to and processed in the United States or other countries via our service providers. Where applicable (EEA/UK transfers), we ensure appropriate safeguards such as Standard Contractual Clauses are in place.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via in-app notification or by updating the "Last updated" date above. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

For any privacy questions, data requests, or concerns:
📧 support@danukstudio.com
We aim to respond to all enquiries within 5 business days.