Threvo — Privacy Policy

Effective Date: June 13, 2026 · Last Updated: June 13, 2026

This Privacy Policy ("Policy") describes how the developer of Threvo ("we," "us," or "our") collects, uses, discloses, and safeguards personal information in connection with the Threvo mobile application (the "App"). By accessing or using the App, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the App.

1. Scope and Application

This Policy applies to all personal information processed through the App, whether you access it on iOS or Android. It is intended to satisfy our obligations under the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"), the EU General Data Protection Regulation ("GDPR") where applicable, and the California Consumer Privacy Act ("CCPA") where applicable.

2. Eligibility

The App is available only to individuals who are at least eighteen (18) years of age. We verify eligibility through an age gate at registration. We do not knowingly collect personal information from individuals under 18. If we become aware that such information has been collected, we will delete it without undue delay. If you believe a minor has provided us with personal information, contact us at threvo.app@gmail.com.

3. Information We Collect

We collect only the information necessary to deliver and improve the App's functionality:

• Account Information: email address, used for authentication and account administration.
• Goal and Activity Data: goals you create, daily action completions, and related metadata.
• Reflection Content: written daily reflections you submit within the App.
• Mood Data: numerical mood ratings on a scale of one (1) to five (5).
• Coaching Conversations: messages exchanged with the App's AI coaching feature.

Guest Mode: where you use the App without registering an account, all data is stored exclusively on your device. We do not receive, access, or retain Guest Mode data, and it is permanently lost if the App is deleted from your device.

4. Purposes of Processing and Legal Bases

We process personal information for the following purposes and, where the GDPR applies, on the following legal bases:

• Provision of the Service (performance of contract): to operate core App functionality, including goal tracking, streaks, reflections, and history.
• AI Coaching (performance of contract): your coaching messages are transmitted to Anthropic, PBC for processing through the Claude API in order to generate responses. We do not sell this content, and it is not used to serve advertising.
• Subscription Management (performance of contract): verification of subscription entitlements through Apple and RevenueCat. We never receive or store payment card details.
• Service Communications (legitimate interests / performance of contract): transactional emails such as password resets. We do not send marketing communications without your prior express consent.
• Safety Screening (legitimate interests): limited automated screening of coaching messages for crisis-related keywords, as described in Section 5.

5. AI Coaching Feature — Material Disclosures

The coaching feature within the App is an artificial intelligence system. It is not a human being, is not a licensed therapist, physician, or counsellor, and does not provide medical, psychiatric, or psychological advice. You acknowledge and agree that:

• Coaching conversations are processed by Anthropic, PBC through its Claude API, acting as our service provider.
• The feature is designed for personal reflection and goal support only and is not a substitute for professional care.
• The App is not an emergency service and cannot respond to crises. If you are experiencing a mental health emergency, contact 9-8-8 (Suicide Crisis Helpline in Canada and the United States) or your local emergency services immediately.

As a precautionary measure, messages are screened for crisis-related keywords prior to AI processing. This screening is a safety feature only and is not a clinically validated assessment tool.

6. Data Storage, Security, and International Transfers

Personal information is stored on infrastructure provided by Supabase, Inc., located in the United States (us-west-2 region). Because our servers are located in the United States, your information is transferred to, and processed in, the United States, which may have data protection laws that differ from those of your jurisdiction.

We implement administrative, technical, and organizational safeguards appropriate to the sensitivity of the information, including encryption in transit (TLS) and at rest (AES-256), database row-level security restricting each account to its own records, server-side verification of subscription entitlements, and per-user rate limiting on AI endpoints. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Disclosure of Personal Information

We do not sell, rent, or trade personal information. We disclose personal information only to the following categories of service providers, each acting on our instructions and bound by contractual confidentiality obligations:

• Supabase, Inc. — database, authentication, and storage infrastructure.
• Anthropic, PBC — AI processing of coaching conversations.
• Apple Inc. and RevenueCat, Inc. — subscription billing and entitlement management.

We may also disclose personal information where required by applicable law, regulation, legal process, or enforceable governmental request, or where necessary to protect the rights, property, or safety of our users or the public.

8. Retention and Deletion

Personal information is retained only for as long as your account remains active. You may delete your account at any time within the App (Settings → Delete my account). Deletion is immediate and irreversible: all personal information associated with your account is permanently removed from our production systems. We maintain no user-accessible backup restoration process; once deleted, data cannot be recovered.

9. Your Rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you and obtain a copy in a portable, machine-readable format.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of your personal information (also available in-app at any time).
• Withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing.
• Lodge a complaint with your supervisory authority, including the Office of the Privacy Commissioner of Canada, your EU/UK data protection authority, or the California Privacy Protection Agency, as applicable.

To exercise any of these rights, contact us at threvo.app@gmail.com. We will respond within thirty (30) days, subject to extension where permitted by law. We do not sell personal information within the meaning of the CCPA, and we do not discriminate against individuals who exercise their privacy rights.

10. Changes to This Policy

We may amend this Policy from time to time. Material changes will be communicated through the App or by email prior to taking effect, and the 'Last Updated' date above will be revised accordingly. Your continued use of the App following the effective date of any amendment constitutes acceptance of the amended Policy.

11. Contact

Questions, concerns, or requests regarding this Policy may be directed to: threvo.app@gmail.com.