Privacy policy

The short version

Align Life is a private space for exactly two people. Your data exists so the two of you can see it — nobody else. We don't show ads, we don't sell data, and we don't share your information with advertisers or data brokers. We collect only what the app needs to work, we protect it in transit and at rest, and when you delete your account we erase your data — all of it — after a 30-day grace period.

The rest of this policy explains exactly what that means, in detail. We wrote it to be read.

What Align Life is

Align Life is a shared life app for couples: a daily question you both answer, plus shared tasks, calendar, routines, expenses, savings goals, and optional wellness and cycle tracking. Almost everything in Align Life is designed to be seen by exactly two people — you and the one partner linked to your account. That is the product, and it shapes everything below.

What we collect

We collect only the information you give us or that the app needs to run. Here is the full list.

Account information. Your name, email address, and a password (stored only as a secure hash — we cannot see your password). If you sign in with biometrics, that check happens entirely on your device; we never receive your fingerprint or face data.

Couple space. The link between your account and your partner's account, your couple's chosen currency, your relationship start date and other important dates you add, and shared settings like your ritual hour (the time you both get the daily question).

Daily ritual. Your answers to the daily question, the short reply you can leave after a reveal, and your couple's streak. Your partner sees your answer only after they have answered too.

Tasks, calendar, and routines. Tasks and their details, calendar events (including events you choose to import from your device calendar), routines and habits, and completion history including streaks.

Money. Expenses including amounts, categories, dates, and notes; budgets; recurring payments; savings goals and contributions. Align Life does not connect to your bank — everything here is what you type in.

Wellness and cycle data. This is health data and we treat it as the most sensitive thing we hold. If you turn on cycle tracking, we collect period start and end dates, cycle and period length, flow level, and the symptoms you select. Cycle tracking is off until you explicitly turn it on through an in-app consent card that explains what will be stored and who can see it. You can turn it off, and delete the data, at any time.

Device and technical information. A push notification token for your device (so we can deliver notifications), your device platform and app version, and your timezone (so reminders arrive at the right local time).

Feedback and support. Anything you send us through the in-app feedback form or by email.

Website. If you join the waitlist on alignlife.app, we collect the email address you submit. The website does not use advertising trackers.

What we do not collect

We do not collect your contacts, your precise location, your photos (unless a future feature asks and you agree), your browsing history, your messages outside the app, or advertising identifiers. We do not use third-party advertising SDKs. There are no ads in Align Life and there never will be data-funded ones.

Who sees your data: the partner model

Align Life is built around sharing with one person. When you link with your partner, your shared records — tasks, calendar, expenses, goals, habits, daily question answers after both of you reveal — are visible to both of you. That sharing is the point of the app, and joining a couple space is how you agree to it.

Cycle and wellness data works differently. It is yours, not the couple's, by default. When you set up cycle tracking, you choose per category what your partner can see — for example, predictions but not symptoms, or nothing at all. Each category is opt-in, off by default, and changeable at any time in cycle settings.

Nobody at Align Life reads your content in the course of normal operations. Access to production systems is limited to what is needed to run and debug the service, and content fields classified as sensitive are additionally encrypted at the field level (see the next section), so they are unreadable in the database itself.

How we protect your data

We want to be precise here rather than hand-wavy, because "bank-level security" is a phrase, not a fact.

In transit: all traffic between the app, the website, and our servers uses TLS (HTTPS). Nothing travels in the clear.

At rest, disk level: our database and hosting provider (Railway) encrypt storage at the infrastructure level.

At rest, field level: on top of that, sensitive free-text fields are individually encrypted with AES-256-GCM before they are written to the database. This covers content like task and goal titles and notes, expense descriptions, calendar event details, wishlist items, daily question answers and replies, cycle symptoms, habit names, and notification content. Even someone with direct database access cannot read these fields without the separate encryption key, which is stored outside the database.

What is not field-encrypted: structured, non-text fields — dates (including period dates), numeric amounts, cycle length, flow level, toggles, and identifiers — are not individually field-encrypted. They are protected by TLS in transit and disk-level encryption at rest, and by access controls. We tell you this because a privacy policy should describe the system you actually have.

Access: authentication uses short-lived signed tokens (7-day access, 30-day refresh) with server-side revocation. The app supports a biometric lock so the contents stay private even if someone has your unlocked phone.

No system is perfectly secure, and we do not promise otherwise. What we promise is layered protection, honest description of it, and prompt notification if something goes wrong (see "If there is a breach").

Analytics and your choice

We use PostHog, hosted in the United States, to understand how the app is used — which screens are opened, which features are used, where people get stuck. This helps us decide what to build and fix.

• Analytics events are tied to a numeric user ID, not your name or email.
• Your content is never sent to analytics — no answers, no amounts, no health data. Events describe actions ("expense created"), not contents.
• You can opt out in Settings. The opt-out is respected from the moment the app starts — including the app's first events at launch — not just after you visit the settings screen.
• We do not use analytics for advertising, and we do not share analytics data with anyone else.

Notifications

Push notifications are delivered through Expo's push service using a device token. You control notification categories in Settings and can turn any of them off.

One deliberate choice worth stating: notifications related to cycle tracking use generic wording. Your lock screen will say something like "You have a new update in Align Life" rather than spelling out health information for anyone glancing at your phone.

Service providers (subprocessors)

We use a small number of infrastructure providers to run Align Life. Each one processes data only on our instructions, only for the purpose listed, and none of them may use your data for their own purposes.

We do not sell data to anyone, and we do not share data with advertisers, data brokers, or "partners" of any kind. If this list changes, we will update this policy.

International transfers

Align Life is available globally, and the providers above are in the United States, so your data is stored and processed there regardless of where you live. Where the law of your region requires safeguards for such transfers — such as the GDPR's standard contractual clauses — we rely on those safeguards with our providers. Details are available on request at [to be completed].

How long we keep data, and deletion

While your account is active, we keep your data so the app works — your history is the product.

When you delete your account, here is exactly what happens:

1. You request deletion in the app (Settings → Account → Delete account) or via alignlife.app/delete-account.
2. A 30-day grace period starts. Your account is deactivated. If you change your mind, sign back in within 30 days and everything is restored. This exists because deleting a shared life record in a moment of heat is a real thing that happens.
3. After 30 days, we permanently erase your data: your account, profile, answers, replies, tasks, goals, expenses, calendar events, habits, all cycle and wellness data, notification logs, verification codes, and push tokens. This is row-level erasure, not anonymization.
4. Content you created is also removed from your partner's shared space. Your partner keeps only what they themselves created.
5. Copies in encrypted backups expire on the backup rotation schedule, within 30 days of erasure.

We keep two narrow things longer where the law requires or permits it: records needed to comply with legal obligations, and minimal logs needed for security and fraud prevention, each kept no longer than necessary.

You can also delete individual items (an expense, an answer, your cycle history) at any time without deleting your account, and you can turn cycle tracking off and wipe its data separately in cycle settings.

Your rights

You have rights over your data wherever you live. The mechanics differ slightly by region; the spirit does not. To exercise any of these, use the in-app options where they exist, or contact us at [to be completed]. We will respond within the timeframe the applicable law requires. We do not discriminate against you for exercising your rights.

If you are in the European Economic Area (GDPR)

You have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent at any time (for example, for cycle tracking or analytics) without affecting past processing. Our legal bases are: performance of our contract with you (running the app), your explicit consent (health and cycle data — Article 9), and legitimate interests (security, and analytics unless you opt out). You may lodge a complaint with your local supervisory authority. Our EU representative, if appointed, is [to be completed].

If you are in the United Kingdom (UK GDPR)

You have the same rights as under the GDPR, described above. You may complain to the Information Commissioner's Office (ico.org.uk). Our UK representative, if appointed, is [to be completed].

If you are in California (CCPA/CPRA)

You have the right to know what personal information we collect, use, and disclose (this policy is that disclosure); to access it; to correct it; to delete it; and to limit use of sensitive personal information. We do not sell your personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. Your cycle and wellness data is sensitive personal information under the CPRA; we use it only to provide the features you turned on, which is the use the law permits without a separate limit request. You may designate an authorized agent to act for you.

If you are in India (DPDP Act 2023)

You have the right to access a summary of your personal data and how it is processed, to correction and erasure, to grievance redressal, and to nominate a person to exercise your rights if you are incapacitated or deceased. Where we process data based on your consent (cycle tracking, analytics), you may withdraw it as easily as you gave it. Our grievance officer is [to be completed], reachable at [to be completed]; we will acknowledge and respond to grievances within the timelines under the Act. If you are not satisfied, you may complain to the Data Protection Board of India.

Everywhere else

Email [to be completed] and we will honor the access, correction, deletion, and portability rights described above as a baseline, regardless of what your local law technically requires.

Children

Align Life is not for children. You must be at least 16 to use it. We do not knowingly collect data from anyone under 16, and if we learn we have, we will delete it. Because the app includes wellness and cycle-tracking content, expect it to carry a higher age rating in the app stores.

If there is a breach

If a security incident affects your personal data, we will notify you and the relevant authorities without undue delay, as required by law — and plainly: we will tell you what happened, what data was involved, and what we are doing about it. We will not bury it.

Changes to this policy

When we change this policy, we will update the effective date at the top and, for material changes, tell you in the app before the change takes effect. If a change requires new consent (for example, a new use of health data), we will ask for it — we will not assume it.

Contact

Questions, requests, or concerns: [to be completed]

[to be completed]
[to be completed]
Grievance officer (India DPDP): [to be completed], [to be completed]