Privacy Policy

Last updated: 26 October 2026

Breatheasy helps you through panic and anxiety. To do that, you share personal and sensitive things with us: how you feel, what triggers you, what you write in your journal. This policy explains, in plain language, what we collect, why, where it goes and what you can do about it.

The short version:

• We don't sell your data, show you ads or use advertising or analytics trackers.
• A lot stays on your phone only, including your chats with Luma and the contact details of your trusted person.
• Your journal is backed up to your account so you don't lose it, and you can delete it all from inside the app at any time.
• When you chat with Luma, your messages go to our AI provider, Anthropic, to write Luma's replies. Your journal is only included if you switch that on.

Breatheasy is provided by Casefemme LLC ("we", "us"), 6374 Busch Blvd, OH. You can contact us about privacy at hello@usebreatheasy.com.

1. What we collect

Your account

• Your first name, email address and password. We never see or store your password itself, only a scrambled version (a "hash") that can't be turned back into it.
• If you sign in with Google, we receive your name, email address and Google account ID from Google.
• Basic records of your sign-ins (sessions), including the device's IP address and browser or app details, to keep your account secure.

Your answers to the sign-up questions

What you'd like help with (for example panic attacks, worry or sleep), how often you have panic attacks, how much you usually sleep and your weekly check-in goal. We use these to tailor the app and Luma to you.

Your journal (backed up to your account)

• Daily check-ins: your mood, the feelings you pick, what affected your day, your notes and answers to the journal questions, and whether you starred an entry.
• Panic attacks you work through in the app: when they started and ended, how strong they felt before and after, and what set them off if you tell us.
• Your 2-week anxiety check (GAD-7) answers and scores.

This is health information. We collect it only because you enter it, and we use it only to show you your journal, your progress and your patterns, and (if you choose) to help Luma support you.

Kept only on your phone

These never leave your device, except as described for Luma below:

• Your conversations with Luma.
• Your trusted person's name and phone number.
• Reminder times, voice and vibration settings, lesson progress and saved lessons, urges you rode out, your Calm Garden, colouring and other game progress.

They are deleted from the phone when you sign out or delete your account.

Chatting with Luma

Luma is an AI. When you send Luma a message:

• Your recent messages (up to the last 20) are sent through our server to Anthropic, which runs the Claude AI model, to write Luma's reply.
• If you've switched on "Let Luma see my check-ins", a short summary of your recent journal and your sign-up answers is sent too, so Luma can understand how you've been. You can switch this off at any time in Settings.
• Our server does not store the content of your chats. We only count how many messages you send each day, to apply the daily limit.
• Anthropic processes these messages for us under its commercial terms, which do not allow it to train its AI models on them. [Reviewer: confirm Anthropic's current API data-retention period and insert it here.]

Emails we send you

If you ask to reset your password, we email you a 6-digit code. We use your email address only for account messages like this, never for marketing unless you separately agree.

Technical information

Like any online service, our servers keep short-lived technical logs (such as IP address, time and the page or feature requested) to keep the service running, prevent abuse and fix problems.

2. How we use your information

We use your information only to:

• provide the app and its features, including backing up your journal and letting you use it on more than one phone;
• personalise the app (for example, showing sleep breathing first if you came for help with sleep);
• generate Luma's replies;
• keep your account secure and prevent abuse, including applying limits;
• send you messages you asked for, such as password reset codes;
• comply with the law.

We do not use your information for advertising, and we do not sell or rent it to anyone.

3. Our legal bases (UK and EEA)

• Your explicit consent for health information (your journal, anxiety checks and anything you tell Luma). You give this by choosing to enter it, and you can withdraw it at any time by deleting your account or asking us to delete it.
• Performing our contract with you for running your account and the app.
• Our legitimate interests in keeping the service secure and working properly.
• Legal obligations where the law requires us to keep or share information.

4. Who we share it with

We share information only with the service providers we need to run Breatheasy, who may only use it on our behalf:

We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or merger of our business (in which case this policy would continue to apply).

5. Where your information is stored

Your account and journal are stored in a database hosted by Cloudflare in Western Europe. Cloudflare and Anthropic may process information in other countries, including the United States. Where we transfer personal information out of the UK or EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. [Reviewer: confirm transfer mechanisms.]

6. How long we keep it

• We keep your account and journal for as long as you have an account.
• When you delete your account in Settings, we delete your account, journal and anxiety checks from our database straight away. Copies may remain in encrypted backups for up to 30 days before they are overwritten.
• Password reset codes expire after 10 minutes.
• Technical logs are kept for a short period, normally no more than 30 days.

7. Keeping it safe

Everything sent between the app and our servers is encrypted. Your data is encrypted while stored, passwords are hashed, and only the systems that need your information can reach it. No system is perfectly secure, but we work hard to protect your information and will tell you and the authorities if a breach affects you, as the law requires.

8. Your rights and choices

You can:

• See and correct your information: most of it is visible in the app, and you can edit any journal entry.
• Delete your chat history with Luma (Settings → Luma) or your whole account, including your journal (Settings → Delete account).
• Turn off sharing your journal with Luma (Settings → Luma).
• Get a copy of your information, or ask us to restrict or stop using it, by emailing hello@usebreatheasy.com.
• Complain to your data protection authority (in the UK, the Information Commissioner's Office).

Depending on where you live (for example California, Washington, Nevada or other US states with consumer health data laws), you may have extra rights, including to know what consumer health data we collect and share, to withdraw consent and to have it deleted. You can use any of these rights by emailing hello@usebreatheasy.com; we will not treat you differently for doing so. [Reviewer: add any state-specific notices required.]

9. Children

Breatheasy is for people aged [16] and over, and chatting with Luma is for people aged 18 and over. We don't knowingly collect information from younger children. If you believe a child has given us information, please contact us and we will delete it.

10. Changes to this policy

If we make important changes, we'll tell you in the app before they take effect. The date at the top shows when this policy last changed.

11. Contact us

Casefemme LLC
6374 Busch Blvd, OH
hello@usebreatheasy.com