Privacy Policy — Awaira
Effective date: October 1, 2026
This Privacy Policy explains how Awaira handles personal data through the Mac, Windows, Linux, Android, iPhone and browser apps, the awaira.app website, purchases, support, and feedback.
1. Who is responsible for your data
Trading as Awaira,("Awaira", "we", "us"). We are the data controller for the server-side processing described in this policy.
Privacy requests can be sent to hello@awaira.app. We have not appointed a Data Protection Officer because we do not currently meet the legal thresholds requiring one. Awaira is established in Armenia and has not appointed an EEA or UK data-protection representative. EEA and UK users may contact the controller directly at hello@awaira.app. This statement does not limit any rights or remedies available under applicable law.
2. The privacy boundary: detection stays on your device
Awaira uses your device's camera to detect when a hand approaches your face. Camera frames are analysed live on your device using on-device computer vision and discarded from memory after analysis. We do not receive camera video or frames.
The following remain on your device and are not sent to Awaira's servers:
- detections and daily or weekly progress;
- the behavior you select, onboarding answers, trigger reflections, and preferences;
- locally generated insights and exported reports; and
- optional camera snapshots. Snapshots are off by default and are uploaded only if you deliberately attach one to a support or feedback submission.
The installed apps store local information in their application support or container directories. Removing an app does not always remove these files. You can delete optional desktop snapshots from the app's screenshots folder. To remove all local data from an installed app, delete Awaira's application support or container data using your operating system's storage tools. Contact us if you need platform-specific instructions.
The browser app stores daily activity counts, touch areas, reflections, notes and preferences in IndexedDB on the browser and device you use. If browser storage is unavailable, the session runs in memory. Signing out does not erase this local history. Use “Clear this demo's data” in the browser app or clear the site's storage in your browser to remove it. Clearing browser data does not erase the Google-linked account or trial record held on our server; contact us to request deletion of server records.
The iPhone app does not transmit onboarding answers, camera frames, detections, or progress data. Because Awaira does not receive this local information, we cannot access, recover, or delete it for you remotely.
3. Information we process on our systems
We do not use advertising or third-party analytics SDKs in the Awaira apps, and we do not sell personal data or disclose it for behavioral advertising. The website does use the first-party page-view counting described below. iPhone purchases use Apple In-App Purchase; the iPhone app does not use Lemon Squeezy, a licence key, or our own checkout.
| Activity | Information and purpose | Lawful basis where GDPR/UK GDPR applies | Retention |
|---|---|---|---|
| Installed app free trial | Stable device identifier, app platform, and trial dates for Mac, Windows, Linux and Android, used to provide one trial per device and prevent resets. | Contract; legitimate interest in preventing abuse and product planning. | Three years after the last trial check, then deleted or anonymised. |
| Browser app account and trial | Google account identifier, email address, display name, account creation and last account activity dates, licence key if you add one, and recent key-attempt information. A separate trial record links the Google identifier to trial dates. Used to sign you in, provide one browser trial per account, check access, prevent key guessing, and support your account. We do not store your Google password or ID token. | Contract; legitimate interest in account and licence security. | Account record: 24 months after the last sign-in or licence action. Browser trial record: three years after its last check. Licence and purchase records follow the periods below. |
| Licence activation (Mac, Windows, Linux and Android) | Licence key, installation identifier, activation instance, plan, expiry, and last check, used to provide and protect your licence, which may be active on more than one device depending on your plan (see Terms for current device limits). | Contract; legitimate interest in licence security. | While active and 24 months afterwards; longer only for a dispute or legal claim. |
| Purchases (paid licence) | Order/event IDs, email, plan, and status received from Lemon Squeezy, used for fulfilment, support, accounting, and fraud prevention. | Contract; legal obligations; legitimate interest in fraud prevention. | For the applicable tax/accounting period, ordinarily seven years after the transaction. |
| iPhone App Store purchase lifecycle | Verified Apple notification ID, product and transaction lineage IDs, subscription/lifetime status, storefront environment, and relevant dates. We do not receive the Apple Account, email, payment details, receipt, or awareness data through this record. Used to audit purchase, renewal, expiration, refund, and restore support. | Contract; legitimate interest in fraud prevention and operating paid access. | For the applicable tax/accounting period, ordinarily seven years after the transaction. |
| Discovery question (desktop only) | Random response ID, source, optional other text, platform, and timestamps, used to understand product discovery. | Legitimate interest. The answer is optional. | 24 months, then aggregated and the response-level record deleted. |
| Downloads | Platform, referring page, user-agent, timestamp, and a short-lived, non-reversible hash used only to de-duplicate download counts (derived from your IP and user-agent with a salt that changes daily; no IP or persistent identifier is stored, and it cannot be used to track you across days). Used to deliver and troubleshoot installers and measure platform demand. | Legitimate interest in operating distribution. | 90 days, then deleted or aggregated. |
| Website page views | Page path, referring page, browser user-agent, timestamp, and a hash derived from IP address and user-agent that changes daily when configured. The IP address is used to calculate the hash but is not stored in this page-view table. Used to count visits and understand which pages help people find Awaira. The browser app does not send this page-view event. | Legitimate interest in measuring and improving our website. | Individual page-view rows: 90 days, then deleted. |
| Waitlist | Email, optional name, source/referrer, user-agent, and timestamps, used to send a requested availability notice. | Consent. | Notice plus 30 days, withdrawal, or 24 months after signup—whichever comes first. |
| Support and bugs | Email, message, platform, user-agent, optional attachment and filename, used to respond and investigate. Attachments are emailed to hello@awaira.app. | Contract or requested steps; legitimate interest in support/security; explicit consent for health data you include. | Messages and attachments: 24 months after submission. |
| Feedback | Rating, message, optional name/email, platform, attachment, and consent records, used to review and improve Awaira. Attachments are emailed to hello@awaira.app. | Legitimate interest; consent for follow-up; explicit consent for health data you include. | Feedback and attachments: 24 months. |
| Testimonials | Five-star feedback, the reviewer's supplied name, and a separate publication-consent record. Used only to display the review on the Awaira website. | Consent; explicit consent where health information is revealed. | Until withdrawal or three years, with annual review. |
| Security logs | IP address and request/device metadata processed by hosting infrastructure to secure and troubleshoot the service. | Legitimate interest in service security. | No longer than 30 days unless investigating a specific incident. |
Where we rely on legitimate interests, those interests are limited to operating, securing, and improving Awaira in ways users reasonably expect. You may object as described below. We do not use server data to profile BFRB behavior.
4. Health and other sensitive information
Awaira does not receive the behavior, detections, or progress stored in the app. A support message, feedback, attachment, or testimonial may nevertheless reveal information about your health or BFRB if you choose to include it. We do not require that information. Please share only what is necessary.
The support and feedback forms ask for explicit consent before processing health information you voluntarily include. Testimonial publication uses a separate, unchecked opt-in. If you choose it, we publish your written five-star review with the name you provide. We show a surname when you supplied one, and never infer or add one. You may withdraw consent at any time by emailing hello@awaira.app. Withdrawal does not affect processing that was lawful before withdrawal. We will remove a published testimonial and delete consent-based sensitive data unless another legal ground requires limited retention, such as a legal claim.
5. Service providers and other recipients
- Vercel hosts the website/API and stores support/feedback records.
- Neon provides the managed PostgreSQL database.
- Resend delivers support and operational email, including attachments, to hello@awaira.app.
- Google provides the sign-in used by the browser app. When you sign in, Google gives us an ID token that we verify, then the account identifier, email address and display name described above. Google acts under its own privacy notice for sign-in. Signing in is required only for the browser app.
- Google Fonts, Google-hosted MediaPipe models and jsDelivr deliver fonts and browser app detection files. Your browser may send these providers ordinary request data such as your IP address and user-agent when it loads those files. They do not receive camera frames, detections or notes from Awaira.
- Lemon Squeezy is our merchant of record for paid-licence purchases and handles checkout, payment details, subscriptions, refunds, tax, and licence issuance. It acts under its own privacy notice for those activities. We do not receive full card details. The iPhone app does not send data to Lemon Squeezy.
- Apple processes iPhone In-App Purchase payments and manages the Apple Account used for them under Apple’s own terms and privacy policy. Apple sends us a signed server notification containing the limited purchase-lifecycle fields described above; we verify it before storing it.
- Professional advisers, courts, regulators, law enforcement, or a purchaser of Awaira may receive relevant information where necessary and subject to legal/confidentiality protections.
We do not sell or rent personal data or share website activity with advertising providers.
6. International transfers
Our providers may process data in the United States and other countries outside your country. Where data is transferred from the EEA or UK to a country without an applicable adequacy decision, we use the European Commission's Standard Contractual Clauses and, where relevant, the UK International Data Transfer Addendum or another legally approved safeguard. You may request information about the applicable safeguard at hello@awaira.app.
7. Whether information is required
Camera permission is needed for detection, but camera frames remain on your device. The iPhone app requires an active App Store subscription or Lifetime Unlock after any eligible introductory trial. It has no licence-key activation or discovery question.
For the Mac, Windows, Linux and Android apps, a stable device identifier is required for the free trial, and a licence key/installation identifier is required to activate Pro. The browser app requires Google sign-in to start its account-based trial or use a paid licence. It needs an internet connection to verify access and download its detection files. Purchase information required by Lemon Squeezy is necessary to complete a paid-licence purchase; the same licence can unlock the browser app if it has a free activation. Apple Account and payment information are handled by Apple for iPhone purchases; the discovery question, feedback, testimonial, waitlist, optional support fields, and attachments are voluntary.
8. Automated decisions
For the Mac, Windows, Linux and Android apps, and when you use the web version, trial and licence systems automatically return whether access is active, expired, revoked, or already bound to another device. On iPhone, Apple’s StoreKit entitlement system automatically returns whether the customer has an active subscription or Lifetime Unlock. These checks are necessary to provide the selected edition. We do not use solely automated decision-making that produces legal or similarly significant effects, and we do not profile users based on health or BFRB activity. Contact us if an access result is wrong and you would like a human review.
9. Security
We use HTTPS in transit, access controls, private attachment storage, service-provider security features, and data minimisation. No system is completely secure. Please do not send passwords, payment-card details, or unnecessary sensitive images or recordings through support or feedback.
10. Your data-protection rights
Depending on your location, you may have rights to access, correction, deletion, restriction, portability, objection, withdrawal of consent, and complaint to a data-protection authority.
Email hello@awaira.app to exercise a right. Tell us enough to locate the relevant record. We may request proportionate proof of identity. We normally respond within one month and do not charge unless a request is manifestly unfounded or excessive.
EEA residents may complain to the supervisory authority in their country; the Irish Data Protection Commission is available online. UK residents may contact the Information Commissioner's Office. We would appreciate the opportunity to address your concern first.
11. Children
Awaira is not directed to children under 16, and we do not knowingly collect their server-side personal data. A parent or guardian who believes a child submitted information should contact us so we can delete it. Local on-device data remains under the device user's or guardian's control.
12. Website storage and tracking
The website stores a theme preference in your browser's local storage. The browser app uses IndexedDB for local activity history, notes and preferences. These records stay in that browser until you clear them or the browser removes site storage. They are separate from your server-side account and are not synced between devices.
After browser app sign-in, Awaira sets a same-site, secure, HttpOnly session cookie containing a signed account identifier, email address, display name and expiry. It lasts up to 30 days and lets the browser app check your access without another Google sign-in on every visit. Signing out clears that cookie; it does not delete your local history or server account.
Public website pages send a first-party page-view event to Awaira with the information listed in the table above. We do not load advertising pixels or use advertising cookies. Our hosting provider also processes basic request metadata to deliver and secure the site.
13. Changes to this policy
We may update this policy when Awaira or its legal obligations change. We will update the effective date and provide additional notice in the app or website when a change materially affects your rights or how we use personal data.