Pholarix ("we", "us") operates CalmPath and is the entity responsible for your personal information (the "controller" under the GDPR). Contact our privacy contact at hello@pholarix.com.au.

This policy is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and, where they apply to users outside Australia, the EU General Data Protection Regulation and the UK GDPR.

Account information: your name (or preferred name), email address, password (stored only as a secure hash by our authentication provider) and an optional profile photo. If you sign in with Google, we receive your name and email address from Google, and nothing else.

Child information you choose to enter: a first name or nickname, optionally a birth year, and whatever you log, such as quick logs, ABC observations, mood check-ins, focus goals, therapy sessions, care contacts and notes. We deliberately do not ask for a child's full name, date of birth, diagnosis, medical records or government identifiers. Some information you enter may be sensitive information about a child, for example information that suggests a health condition or disability; by entering it you consent to us handling it as described in this policy.

Team diary content: notes and reactions added by people you invite, and their name, email address and role.

Feedback you send us through the app, and your correspondence with us.

Billing information: a Stripe customer reference, your subscription status and billing period dates. Your card details are entered directly with Stripe and never reach our systems.

Technical information: device or browser push tokens if you enable notifications, and standard server logs (IP address, browser type, timestamps) used for security and to keep the Service running. We do not use advertising trackers.

Product use within CalmPath: to understand whether CalmPath is helping families, we record which main steps your account takes and when (for example signing in on a day, asking a question, saving an observation, adding or achieving a goal, starting checkout). We record the step only, never what you typed, your child's details or the AI's answer. If you rate an answer or tell us why you are cancelling, we keep your rating, the reason you chose and any note you write. This stays in our own database in Australia, is seen only by our small admin team, is never sold or used for advertising, and is deleted with your account.

Usage analytics, only if you allow it: on the web we ask before using Google Analytics (Google LLC, United States) to count which pages are used and where visitors come from. Page addresses are reduced to the page type (for example "/skill", never which skill), and we never send your name, email address, your child's details or anything you write. Google Analytics sets its own cookies and receives your IP address, which Google truncates. You can turn this on or off at any time on the Cookies Policy page.

CalmPath is for adults. We do not knowingly collect information directly from children, and children do not hold accounts. Information about a child is entered by the child's parent, guardian or carer, who is responsible for having the authority to do so. If you believe a child has provided information to us directly, contact us and we will delete it.

To provide and personalise the Service for your family, including generating coaching suggestions and progress views (performance of our contract with you).

To process payments, manage your subscription and communicate with you about your account (performance of our contract and our legitimate interests in running the Service).

To keep the Service secure, prevent misuse and comply with our legal obligations (legitimate interests and legal obligation).

To respond to feedback and support requests (legitimate interests).

Where you enter sensitive information about a child, on the basis of your explicit consent, which you can withdraw by deleting that information or your account.

We do not sell personal information, and we do not use it for advertising.

When you use "Help me understand this", the ABC log or the chat, the description you type, your child's age and short summaries of matched framework skills are sent through our server to our AI provider, OpenAI (United States), to generate a response. Your child's name, your account details and your other data are not sent.

We have configured our use so that this information is not used to train AI models, and our provider's API terms prohibit training on it. An automated safety screen runs before any AI request; messages that indicate self-harm, abuse or a medical emergency are not sent to the AI at all.

Identical questions may be answered from a short-lived cache on our server to reduce cost; cached answers are not linked to your identity beyond the question text and your child's age.

People you invite: co-parents, carers and team members you add to your family space see the information the Service shows them for their role. That sharing is your choice, and you can revoke it from Profile.

Service providers who process information on our behalf, under contracts that restrict their use of it: Supabase (database, authentication and file storage, hosted in Sydney, Australia); OpenAI (AI responses, United States); Stripe (payments; Stripe may act as merchant of record for your purchase, in which case Stripe also processes your information under its own privacy policy); Google (only if you choose Google sign-in); Netlify (web hosting and content delivery, with servers in multiple countries); Google (usage analytics, only if you allow it); and email delivery providers for account and service emails.

Authorities and others where required by law, to enforce our Terms, or to protect the rights, safety or property of any person, including a child at risk.

A successor if our business is sold or restructured, on the same terms as this policy.

Your family's data is stored in Australia. Some processing described above happens overseas, principally in the United States (AI responses, payments, hosting infrastructure). Where we transfer information overseas we take reasonable steps to ensure it is handled in accordance with the Australian Privacy Principles, and, for users in the EU or UK, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions. Australia may not be regarded as providing an adequate level of protection by every jurisdiction; by using the Service from outside Australia you acknowledge this.

Every database table is protected by row-level security so that only members of your family can read or write your family's data. Data is encrypted in transit and at rest. Access by our staff is limited to what is needed to operate and support the Service. We use security headers, secure authentication and payment processing by a PCI-DSS compliant provider. No system is perfectly secure; if we become aware of a data breach that is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and other regulators where the law requires.

We keep your information while your account is active. When you delete your account, your family's data, including all child profiles, logs, notes and invitations, is permanently deleted, and any subscription is cancelled. Some information may persist briefly in backups before being overwritten, and we may keep limited records (for example billing records and feedback) where the law requires or to resolve disputes. Feedback is retained without identifying you once your account is deleted.

You can access and correct your information in the app at any time, export it by asking us, and delete it by deleting your account from Profile. Step-by-step instructions, including how to ask us by email if you cannot sign in, are at calmpath.app/account-deletion. You can withdraw consent to notifications in your device settings.

If you are in the EU or UK you also have rights to restrict or object to processing, to data portability, and to lodge a complaint with your local supervisory authority.

To exercise any right, or to complain about how we have handled your information, contact hello@pholarix.com.au. We will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection regulator.

See our Cookies Policy for what we store in your browser and why. In short: what is necessary to keep you signed in and the app working, plus Google Analytics cookies only if you allow them. Nothing for advertising.

We may update this policy. Material changes will be notified in the app or by email before they take effect. The version date is shown at the top of this page.