Soma — Privacy Policy

Last updated: 1 September 2026

Soma ("we", "the app") helps you follow an Ayurvedic daily rhythm. This policy explains what the app collects, why, and what your choices are. It is written to be read, not to be hidden behind.

The short version

• Without an account, everything you do in Soma — check-ins, practices, routine, cycle logs, meals, path progress — stays only on your device.
• If you create an account, that same personal data is also backed up to our server (Supabase) so it follows you to a new device. It is stored in rows only you can read, encrypted in transit and at rest.
• Subscriptions are handled by Google Play and RevenueCat. We never see your card details.
• Weather uses your approximate location to fetch local conditions. It is not stored on our servers and never shared.
• We do not sell your data, and we do not use it for advertising.
• Soma is a wellness-education app. It is not a medical device, not a diagnosis, and the cycle features are not a method of contraception.

What we collect and why

Data	Where it lives	Why	Can you avoid it?
Constitution quiz result, daily check-ins, breath/practice sessions, routine, meals, Foundations path, evening reflections, pulse (Nadi) readings	Your device — and, if you sign in, backed up to our server in rows scoped to your account	To personalise the daily guidance and keep it across devices	Use the app without an account, or don't use those features
Menstrual-cycle profile & day logs (flow, symptoms, mood, optional BBT / LH / mucus)	Your device — and, if you sign in with cycle tracking on, backed up to our server (scoped to your account)	To estimate your phase and rhythm and keep the history across devices	Cycle tracking is off by default; turn it off any time; or use the app without an account
Email address, display name	Our server (Supabase), only if you sign up	Authentication and account recovery	Use the app without an account
Approximate location (city-level)	Fetched at runtime, cached on your device; not sent to our servers	To read local weather and tune guidance to it	Deny the location permission — you can set your area by hand, or skip weather
Purchase status ("has Soma Plus")	Google Play + RevenueCat, keyed to your account	To unlock paid features and restore them on a new device	Don't subscribe
Crash and diagnostic logs	Expo / Google Play, aggregated	To fix bugs	—

We do not collect: contacts, photos, browsing history, precise background location, microphone or camera data, or any advertising identifier.

Third parties

• Supabase — authentication and, for account holders, the encrypted backup of your personal wellness and cycle data (EU/US regions, row-level security). supabase.com/privacy
• RevenueCat — subscription entitlements. Receives a random app user ID and your purchase receipts. revenuecat.com/privacy
• Google Play Billing — payment processing. policies.google.com/privacy
• Open-Meteo — weather data. Receives only a coarse latitude/longitude, no identifier. open-meteo.com/en/terms
• Expo / EAS — builds and over-the-air updates; aggregated crash data.

Your choices and rights

• Access / export — your data is on your device (and synced to your account if you signed in); email support@soma.app for a copy of anything held on our servers.
• Delete your account — Settings → Delete account in the app. This erases your server-side account and data immediately and clears local data on that device. You can also request deletion by emailing support@soma.app.
• Turn off syncing — sign out, or use Soma without an account.
• Location — revoke any time in your device settings.

Children

Soma is not directed at children under 13 (under 16 in the EEA/UK). We do not knowingly collect their data.

Changes

We'll update the "last updated" date above and, for material changes, notify you in the app.

Contact

support@soma.app