Privacy Policy

This Privacy Policy describes how ProvenHERE, LLC, a Delaware limited liability company with its principal place of business in California ("HERE," "we," "us," or "our"), collects, uses, and shares personal information when you use the HERE applications, websites (including provenhere.com and app.provenhere.com), and related services (together, the "Services").

This policy covers the HERE commercial apps and websites, including access through a team or enterprise plan. The HERE Foundation offline application is covered by its own separate privacy policy, not this one.

By using the Services, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Services.

1. Information We Collect

1.1 Information you provide

• Account information. Name, email address, and password when you register directly. If you sign in with a third-party provider (Google, Apple, Slack, or Microsoft), we receive basic profile information from that provider, such as your name, email address, and profile picture. We never receive your password for those services.
• Wellness check-ins. The app may invite you to record how you are feeling before and after a session (an "emotional check-in"). This is optional, and we ask for your explicit consent before your first check-in; you can decline, skip any check-in, or withdraw consent at any time. We treat check-in data as consumer health data and handle it as described in this policy and in our separate Consumer Health Data Privacy Policy. In particular, it is never shared with your employer or Sponsor (Section 6) and never used or shared for advertising.
• Team information. If you join through a team or enterprise plan, we collect information needed to connect you to that plan, such as your work email address or single sign-on identity.
• Calendar information (HERE Pause add-on). If you install our calendar add-on and add a pause to an event, we access that event only as needed to insert the pause link and display relevant details. We do not read your other calendar events, and we do not use calendar data for advertising. HERE's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Communications. Messages you send us, such as support requests and survey responses.

1.2 Information collected automatically

• Usage data. Which sessions, animations, and audio you play, session duration, feature usage, and in-app events, collected through Firebase Analytics.
• Session replay (optional). If you grant permission we use screen recording software to understand how the app is used, which can capture screen interactions during your app sessions (gestures, screens viewed, and interaction recordings). See Section 4 for details and your choices.
• Device and log data. Device model, operating system, app version, language, IP address, and unique identifiers; crash and diagnostic data via Firebase Crashlytics.
• Approximate location (optional). If you grant location permission for the Peace Map feature, we collect your approximate location, deliberately reduced to roughly 11 km / 7 mi precision. We never collect street-level location. You can decline or revoke this permission at any time in your device settings, and the rest of the Services work without it. Peace Map contributions are anonymized at submission, which means they are stored without your name, account, or device identifiers and so cannot be linked to you or individually deleted later.
• Push tokens. A device token via Firebase Cloud Messaging if you enable push notifications.

1.3 Information from other sources

• Purchases and subscription status. When you subscribe, Apple, Google, or Stripe processes your payment and shares your subscription status and transaction identifiers with us (via RevenueCat for app-store purchases). We never receive or store your full payment card number.
• Sponsors. If a Sponsor (such as your employer) provides your access, they may give us your name and work email to provision your account.

2. How We Use Information

We use personal information to:

• provide, maintain, and personalize the Services, including remembering your preferences and favorites and, if you consent to emotional check-ins, suggesting sessions or content based on how you told us you are feeling (this personalization happens within our own systems and never involves sending check-in data to analytics or advertising platforms);
• process subscriptions and manage billing status;
• display aggregate, de-identified activity on the Peace Map;
• send service communications (such as account, security, and billing notices) and, with your consent where required, marketing communications you can opt out of at any time;
• send push notifications you have enabled (you can turn these off in your device settings);
• understand how the Services are used and improve them, including through analytics and session replay;
• measure the effectiveness of our marketing (Section 7);
• detect, prevent, and address fraud, abuse, security incidents, and technical issues; and
• comply with legal obligations.

We do not use your emotional check-in data for advertising, and we do not sell your personal information for money. We do "share" limited device identifiers with Meta for advertising measurement as described in Section 7; you can opt out at any time via our "Your Privacy Choices" page at www.provenhere.com/privacy-choices, through the Global Privacy Control, or through your device tracking settings.

3. Aggregated and De-identified Data

We may create aggregated or de-identified data (for example, regional Peace Map session counts or overall usage statistics) that can no longer reasonably be linked to you, and we may use and share such data for any purpose, including with Sponsors and in public materials, research, and industry reports.

4. Session Replay Analytics

We use UXCam, a session replay analytics service, to see how people move through the app so we can find and fix usability problems. Session replay runs only if you agree to it which we ask when you first use the app. You you can change your choice at any time in Settings → Terms and privacy → Data management. If you consent, UXCam may record your screen interactions during app sessions, including gestures and the sequence of screens you visit. We configure UXCam to occlude sensitive content from recordings including emotional check-in screens, password entries, and text inputs. Recordings are used internally for product improvement only and are retained by UXCam on our behalf for approximately 30 days, after which they are automatically deleted.

If you would like your session recordings deleted, contact us at hello@provenhere.com and we will action your request.

5. How We Share Information

We share personal information only as described below:

• Service providers. Companies that process data on our behalf under contract: Google Firebase (analytics, crash reporting, push notifications, remote configuration), UXCam (session replay), RevenueCat (subscription management), Stripe (web payments), Resend (email delivery), Amazon Web Services (hosting and data storage, United States), and WorkOS (team single sign-on).
• Advertising and measurement partners. Meta (Facebook App Events), as described in Section 7.
• Sponsors. The limited information described in Section 6.
• Legal and safety. When required by law, legal process, or to protect the rights, safety, or property of HERE, our users, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, in which case this policy will continue to apply to your information until you are notified otherwise.
• With your consent. Any other sharing will happen only with your direction or consent.

6. What Your Employer or Sponsor Can See

If your access is provided by a Sponsor (for example, an employer team plan), we may share with that Sponsor only: your name, your email address, your registration date, and the date you last used the Services. We do not share the content of your sessions, which experiences you use, or your emotional check-in data with any Sponsor. If your Sponsor uses team features, we may also provide the Sponsor aggregated, de-identified team statistics (for example, total sessions or overall team mood trends), and only when at least 10 people have contributed, so no individual can ever be identified.

7. Advertising, Analytics, and Your Tracking Choices

We use Meta's Facebook App Events to measure the effectiveness of our advertising (for example, to know that an ad led to an app install). On iOS, this activity is subject to Apple's App Tracking Transparency prompt, if you choose "Ask App Not to Track," we do not use your device identifier for cross-app tracking. On Android, you can limit ad tracking or reset your advertising ID in your device settings.

We do not display third-party ads inside the Services, and we do not share wellness check-in data or session content with advertising partners.

Your opt-out choices. Because this measurement activity may qualify as "sharing" under California law, we provide a "Your Privacy Choices" page at www.provenhere.com/privacy-choices where you can opt out of it. We also honor opt-out preference signals such as the Global Privacy Control (GPC) on our websites. On iOS, choosing "Ask App Not to Track" has the same effect for the app; on Android, use your device's ad privacy settings.

8. Cookies and Similar Technologies

Our websites use cookies and similar technologies as small files stored on your device to keep you signed in, remember preferences, process payments securely (for example, Stripe checkout), and understand how our websites are used. Essential cookies are required for the sites to function; analytics cookies are optional. You can control cookies through your browser settings, and where required by law we will request your consent for non-essential cookies before setting them. The mobile apps do not use browser cookies, though they use the analytics technologies described in Sections 1, 4, and 7.

9. Your Rights and Choices

• Access, correction, deletion. You can update profile details in the app, and delete your account and associated data at any time in Settings → Terms and privacy → Data management. You can also email us to exercise access, correction, deletion, or portability rights, and we will respond as required by applicable law.
• Marketing emails. Use the unsubscribe link in any marketing email or manage your preferences in Settings → Communications. Service and billing emails will still be sent while you have an account or active subscription.
• Push notifications. Disable in your device settings at any time. We provide a link to this inside our own Settings → Communications.
• Location. Decline or revoke location permission in your device settings; the Peace Map contribution feature simply won't be used.

• Tracking. Use Apple's App Tracking Transparency prompt or Android ad settings as described in Section 7.

We will not discriminate against you for exercising privacy rights. If you make a request by email, we may need to verify your identity (for example, by confirming control of the account email address) before acting on it. If we decline a request, you may appeal by replying to our decision, and we will have the appeal reviewed.

10. If You Are in the EEA, United Kingdom, or Switzerland

Where the GDPR or UK GDPR applies, ProvenHERE, LLC is the data controller for the personal information described in this policy. Our legal bases for processing are:

• Performance of a contract: providing the Services, accounts, and subscriptions you request.
• Legitimate interests: securing and improving the Services, and preventing fraud and abuse, balanced against your rights and interests.
• Consent: usage analytics and session replay, optional wellness check-ins, optional location for the Peace Map, marketing communications, and tracking for ad measurement, each of which you can withdraw at any time.
• Legal obligation: where processing is required to comply with law.

You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local supervisory authority.

Our Services are hosted in the United States, so your information is transferred to and processed in the U.S. Where required, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our service providers to protect these transfers.

11. If You Are a California Resident (or in Another U.S. State with a Privacy Law)

California law (CCPA/CPRA) and similar laws in other states give you rights to know, access, correct, delete, and port personal information, and to opt out of "sales" or "sharing" of personal information. In the last 12 months we have collected the categories of information described in Section 1: identifiers, commercial information (subscription status), internet activity (usage and device data), approximate geolocation, and sensory/wellness information you choose to provide (emotional check-ins). We collect them from the sources, for the purposes, and share them with the categories of recipients described in Sections 1, 2, and 5.

We do not sell personal information for money. We do "share" device identifiers for the ad-measurement purposes described in Section 7; to opt out, use our "Your Privacy Choices" page at www.provenhere.com/privacy-choices, enable the Global Privacy Control in your browser, or use your device tracking settings. We treat emotional check-in data as sensitive personal information and do not use or disclose it for purposes beyond those permitted by the CPRA. To exercise any right, use the in-app controls or email hello@provenhere.com; authorized agents may submit requests on your behalf with proof of authorization.

Washington and Nevada residents: our separate Consumer Health Data Privacy Policy describes how we handle consumer health data (such as emotional check-ins) and the additional rights available to you under the Washington My Health My Data Act and Nevada SB 370.

12. Data Retention

We keep personal information only as long as needed for the purposes described in this policy: account data for as long as your account exists; subscription and transaction records as required for tax, accounting, and legal purposes; analytics and session replay data for limited periods set with each provider; and crash logs for diagnostic purposes. When you delete your account, we delete or de-identify your personal information within approximately 30 days, except where we are legally required to retain it.

13. Security

We use administrative, technical, and organizational measures appropriate to the nature of the data; including encryption in transit (TLS), managed cloud infrastructure, and secrets management, to protect personal information. No system is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and regulators as required by law.

14. Children

The Services are intended for adults and are not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it. If you believe a person under 18 has provided us personal information, contact us at hello@provenhere.com.

15. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you by email or in-app notice and update the "Last Updated" date. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy, where permitted by law; where consent is required, we will ask for it.

16. Contact Us