Privacy Policy

Effective October 10, 2026

Overview

Holistic Surfing ("the app", "we") is a personal health and habit tracking app operated by MERIDIAN ALCHEMY LLC. This policy explains what information the app collects, how it is used, and the choices you have. We do not sell your data, and we do not show ads.

Information You Provide

When you create an account we collect your email address and a password (stored as a secure hash by our authentication provider). During onboarding and use, you may choose to provide profile details (name, biological sex, date of birth), health priorities and conditions, lifestyle and sleep information, menstrual cycle entries, meal descriptions and photos, workout and recovery sessions (such as sauna, ice bath, and meditation timers), and tasks or routines you track.

When you use the website booking form, we collect your name, email address, selected offering and time, and any optional message you provide. For a discovery call, we also collect the phone number you ask us to call. We use this information to arrange and administer your booking, send confirmations, and contact you about the session. Payments for introductory consultations are processed by Stripe; we do not receive your full card details.

Information Collected Automatically

The app records basic usage events (such as feature usage counts) and crash reports so we can fix problems. Crash reporting is provided by Sentry and is configured not to include personally identifying information. If you enable location features, your approximate location is used to provide sunrise/sunset and environment-aware guidance; you can decline or revoke location permission at any time in iOS Settings.

When configured, our public website uses Google Analytics 4 to understand aggregate visitor volume, referral and campaign sources, pages viewed, and actions such as contact clicks, waitlist signups, booking requests, and checkout starts. We do not send booking-form fields, health information, or booking-management tokens to Google Analytics. Google Analytics may use cookies and process device, browser, approximate location, and interaction data under Google's privacy terms. You can limit this collection with your browser's cookie or tracking controls.

Where Your Data Is Stored

Your account data is stored with Supabase, our hosted database and authentication provider, protected by row-level security so that only your authenticated account can read your records. A copy of your recent data is cached on your device so the app works offline.

Data Shared With Others

Sharing is always opt-in. If you join a Sync Circle or share a wave snapshot or template, the specific data you choose to share becomes visible to the people you share it with. You can revoke Sync Circle connections at any time from within the app.

Third-Party Processing

Some features send specific data to service providers to do their job: meal photos and descriptions are analyzed by OpenAI via our server; food searches are answered by the FatSecret nutrition database; voice input is transcribed by Apple's speech recognition on your device or Apple's servers; push notifications are delivered through Expo and Apple. If you connect your own AI assistant API key (Anthropic or OpenAI), your assistant messages are sent directly from your device to that provider under your own account, and your key is stored only on your device.

AI Coaching

If you accept AI coaching (the Surf coach), your coach messages plus the app data the coach needs to personalize its replies — your weekly plan and progress, cycle phase summary, nutrition targets and recent meals, and coach preferences — are processed by OpenAI via our server. We ask for your explicit consent before the first coach conversation, and the coach will not respond until you accept. These requests are sent with storage disabled: OpenAI does not retain your conversations and does not use them to train its models. Guidance teaching cards are generated entirely by our own rules and never use AI. Coach conversations and usage counts are stored in our database so the coach can remember context and enforce fair-use limits; deleting your account deletes them.

AI Assistant Connections (ChatGPT, Codex, Claude)

You can connect Holistic Surfing to an AI assistant you already use — such as ChatGPT, Codex, or Claude — through our connector (holisticsurfing.com/connect). You sign in on our page and authorize that assistant to act on your account; your password is never shared with the assistant.

When you ask it to, the assistant reads the data it needs to answer: your weekly plans, templates and progress; your cycle or daily-rhythm status and check-ins; the names of your Sync Circle members and what they have chosen to share with you; and shared plan links you give it. It can make the changes you ask for: adding, editing, completing or removing tasks; creating, editing and applying templates; importing shared plans; logging check-ins, meals and period starts; and sending notes to people in your Sync Circle. Sexual-health and vital-energy practice logs are never available through AI connections.

Data the assistant reads is sent to its provider (OpenAI for ChatGPT and Codex, Anthropic for Claude) and is processed under your own agreement with that provider and its privacy policy, including its retention and model-training settings, which you control in that service. We do not receive your conversations with the assistant and do not use AI connections to run our own AI models; we only receive the individual requests the assistant makes on your account and keep short-lived technical logs (time, action name, errors) to operate and secure the service.

Information people share with you through Sync Circle is available to your assistant only in the same form you can already see it in the app. Please use it with the same care.

You can disconnect at any time by removing the Holistic Surfing connector in your assistant's settings. Changing your Holistic Surfing password signs out every connected assistant.

Your Rights and Choices

You can export your data from Profile → Export & Import Data. You can permanently delete your account and all associated data from Profile → Delete Account; deletion is immediate and irreversible. You may also contact us at any time to request access to or deletion of your data.

Data Retention

We keep app data while your account is active. When you delete your account, your app records are removed from our production database immediately and from backups as they expire. Booking records are retained only as long as reasonably needed to administer sessions, maintain business records, and meet legal obligations. You may contact us to request access to or deletion of booking information, subject to any records we are required to retain.

Children

Holistic Surfing is not directed at children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect data from them.

Changes to This Policy

We will update this policy as the app evolves and revise the effective date above. Material changes will be highlighted in the app.

Contact

Questions or requests about your data: mkress07@gmail.com