Privacy Policy

Prana acts as the data controller for your personal data within the meaning of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

For any data protection enquiries, contact us at the email provided in your account settings or through the app's support channel.

When you create or edit a recipe — either in the admin dashboard or when submitting a community recipe — you can add a cover image. To do this, the app requests access to your device's camera (to take a new photo) and photo library (to choose an existing photo).

• Camera: Used only when you choose to take a new photo to illustrate a recipe you are submitting or editing.
• Photo Library: Used only when you choose to upload an existing photo from your device to illustrate a recipe you are submitting or editing.

Access to the camera and photo library is requested only when you tap the "Upload from device" button within a recipe form. The app never accesses your camera or photo library automatically, and we never access it in the background. You may decline the permission prompt at any time; declining only prevents you from adding a photo to your recipe — all other features continue to work.

Images you select are uploaded to our servers solely to be displayed as the recipe's cover image within the Service. The original photos remain on your device; we do not delete, modify, or otherwise access your photo library beyond the single image you choose.

Account data:

• Name and email address (collected via your chosen OAuth provider — Google, Apple, or Facebook)
• Subscription plan and payment status

Health and wellness data (special category under GDPR Art. 9):

• Menstrual cycle tracking information (last period date, cycle length, bleeding duration)
• Daily symptom logs (flow, mood, physical symptoms, energy level, notes)
• Health conditions (e.g. PCOS, Hashimoto's, IBS) provided during onboarding
• Dietary preferences, allergens, and exclusions
• Quiz responses used to personalize your experience

Usage data:

• Recipes you favorite or add to meal plans
• Content you interact with (meditations, podcasts, guides)

Community contribution data:

• Recipes you submit for community publication
• Your account display name (username), which is shown publicly as credit when your submitted recipe is published

• Performance of a contract (Art. 6(1)(b)) — managing your subscription and delivering the service you signed up for.
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) — processing your health and wellness data, including cycle tracking and health conditions. This consent is collected separately during registration and can be withdrawn at any time.
• Legitimate interests (Art. 6(1)(f)) — improving our services, analytics, and security.

Your menstrual cycle data, symptom logs, health conditions, and dietary information are classified as special category data under Article 9 of the GDPR. We process this data only with your explicit, informed consent, which you provide during the onboarding quiz.

This data is used solely to:

• Personalize recipe and meal plan recommendations
• Provide cycle-aware content and insights
• Filter content based on your health conditions and dietary needs

You may withdraw your consent at any time by deleting your account, which permanently removes all health data.

• To create and manage your account and subscription
• To personalize your wellness experience and content recommendations
• To provide cycle tracking and symptom logging features
• To communicate with you about your account and service updates
• To improve and optimize our services

We do not sell your personal data. We share data only with the following categories of recipients:

• Cloud hosting provider — for data storage and application hosting
• Authentication providers — Google, Apple, and Facebook for account login
• Payment processor — for subscription billing (if applicable)
• Community members and visitors — when you submit a recipe and it is published, your display name (username) is shown publicly as contributor credit alongside the recipe

All processors are bound by data processing agreements compliant with GDPR Art. 28.

The public display of your username as recipe contributor credit is based on your consent given at the time of submission (Art. 6(1)(a)). You may withdraw this consent by contacting us to remove your name from published recipes or by deleting your account.

Your data may be processed in countries outside the EU/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with GDPR Chapter V.

We retain your personal data for as long as your account is active. Upon account deletion:

• All health data (cycle tracking, symptom logs, health conditions) is permanently deleted
• All quiz responses and personalized preferences are permanently deleted
• Subscription records are anonymized or deleted
• Recipes — including cover photos and images — you submitted and that have been published to the community remain in the Service's content library under the perpetual license you granted at the time of submission (see Terms of Service Section 7.4). This survives the cancellation of your membership or deletion of your account. Only your contributor credit (display name) is anonymized; the recipe content and images themselves are retained

We may retain limited billing records where required by tax or accounting law (typically 5 years), but these are anonymized to remove personal identifiers.

• Right of access (Art. 15) — request a copy of your personal data
• Right to rectification (Art. 16) — correct inaccurate or incomplete data
• Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten")
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3)) — withdraw consent for health data processing at any time
• Right to lodge a complaint (Art. 77) — with your local data protection authority

We use only essential cookies necessary for the functioning of the app (authentication, session management, and your preferences). We do not use tracking or advertising cookies. You can manage cookie preferences through the consent banner displayed on first visit.

The app is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. These measures include encryption in transit (TLS) and at rest, access controls limited to authorized personnel, and regular security reviews.

Despite our efforts, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but commit to promptly investigating and notifying affected users of any data breach in accordance with GDPR Art. 33–34.

If you are a resident of California, USA, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know — request the categories and specific pieces of personal information we collect about you
• Right to delete — request deletion of your personal information
• Right to correct — request correction of inaccurate personal information
• Right to opt-out of sale or sharing — we do not sell your personal data, and you may opt out of any sharing for cross-context behavioral advertising
• Right to limit use of sensitive personal information — restrict the use of sensitive data to what is necessary to provide the service
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us through the app's support channel. We will verify your identity before responding to your request, typically within 45 days.

In addition to the GDPR and CCPA/CPRA, this policy is designed to comply with other major international privacy frameworks, including the UK GDPR and Data Protection Act 2018, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable regional data protection laws.

If you believe your local privacy laws grant you additional rights not described here, please contact us and we will make every reasonable effort to accommodate your request.

We may update this privacy policy from time to time. We will notify you of any significant changes through the app or via email. The "last updated" date below indicates when the policy was last revised.