Sanctum Light

Privacy Policy

Last Updated: 2026-02-15

1. Introduction

Welcome to Sanctum ("we," "our," or "us"). We are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App").

By using Sanctum, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the App.

2. Information We Collect

2.1 Information You Provide

  • Email address (when you create an account)
  • Password (securely hashed, never stored in plain text)
  • Preferences and settings you configure

2.2 Information Collected Automatically

  • Device identifier (anonymized)
  • App usage data (features used, session duration)
  • Practice completion data and streaks
  • Push notification tokens (if notifications are enabled)
  • App crash reports and performance diagnostics

2.3 Information We Do NOT Collect

  • Location data
  • Contact lists or address books
  • Photos, videos, or media from your device
  • Financial or payment information
  • Health data
  • Biometric data (fingerprint and face authentication is processed entirely on your device)

3. How We Use Your Information

We use the information we collect to:

  • Provide and maintain the App's functionality
  • Personalize your experience (Card of the Day, recommendations)
  • Enhance content quality and text processing
  • Sync your data across multiple devices
  • Track your progress, streaks, and achievements
  • Send notifications you have opted into
  • Improve and optimize the App
  • Respond to your requests or inquiries

4. Third-Party Services

We use the following third-party services to operate Sanctum:

4.1 Google Firebase

We use Firebase for authentication, database storage, and analytics. Firebase is operated by Google LLC. Your data is stored on Google's secure servers and is subject to Google's Privacy Policy: https://policies.google.com/privacy. Users who choose to sign in with Google are subject to Google's Sign-In terms.

4.2 OpenAI

We use OpenAI's API for content quality enhancement and text processing within the App. OpenAI's privacy policy applies: https://openai.com/privacy

Important: No personal or identifiable user information is transmitted to OpenAI. No email addresses, names, account details, or other identifying data is shared with this service.

4.3 RevenueCat

We use RevenueCat for subscription and in-app purchase management. RevenueCat processes purchase receipts and subscription status to manage your access to premium features. RevenueCat's privacy policy applies: https://www.revenuecat.com/privacy

RevenueCat does not have access to your payment details. All payment processing is handled by the Apple App Store or Google Play Store.

4.4 Sentry

We use Sentry for error monitoring and crash reporting to maintain App stability. Sentry may collect device information, operating system version, app performance metrics, and error diagnostic data. When you are logged in, your user identifier may be associated with error reports to help us diagnose issues. Sentry's privacy policy applies: https://sentry.io/privacy/

4.5 Expo / React Native

The App is built using Expo and React Native frameworks. These may collect anonymous crash reports and usage analytics to improve the development tools.

5. Data Storage and Security

5.1 Where Data is Stored

  • Cloud data: Google Firebase servers (United States)
  • Local data: Encrypted on your device using secure storage

5.2 Security Measures

We implement appropriate security measures including:

  • Encryption of sensitive data at rest and in transit
  • Secure authentication via Firebase Auth
  • Password hashing using industry-standard algorithms
  • Regular security reviews and updates

5.3 Data Retention

We retain your data for as long as your account is active. When you delete your account, all your data is permanently removed within 30 days.

6. Your Rights and Choices

6.1 Access and Portability

You have the right to access your personal data. You can export all your data at any time using the "Export My Data" feature in Settings. The export includes your account information and app data in a portable format.

6.2 Correction

You can update your email address and preferences through the App at any time.

6.3 Deletion

You have the right to delete your account and all associated data. Use the "Delete Account" option in Settings. This action is irreversible and will permanently remove:

  • Your user account and profile
  • All saved preferences and app data
  • Practice completion history
  • Achievement and progress data

6.4 Opt-Out of Notifications

You can disable notifications at any time through the Notifications settings in the App or through your device's system settings.

6.5 Withdraw Consent

Where we rely on consent to process your data, you may withdraw consent at any time by adjusting your preferences or contacting us.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws than your country.

By using the App, you consent to the transfer of your information to the United States and other countries where our service providers operate.

8. Children's Privacy

Sanctum is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at development.sanctum@gmail.com and we will delete such information.

9. Your California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to know what personal information is collected
  • Right to know if personal information is sold or disclosed
  • Right to say no to the sale of personal information
  • Right to access your personal information
  • Right to equal service and price

We do not sell your personal information to third parties.

10. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

  • Right of access to your personal data
  • Right to rectification of inaccurate data
  • Right to erasure ("right to be forgotten")
  • Right to restrict processing
  • Right to data portability
  • Right to object to processing
  • Right to withdraw consent

Our legal basis for processing your data is your consent (given when you create an account) and our legitimate interest in providing and improving our services.

11. Brazilian Privacy Rights (LGPD)

If you are in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including access, correction, deletion, and portability of your personal data. You may exercise these rights through the App's settings or by contacting us.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date at the top of this policy and, for significant changes, by providing additional notice through the App.

Your continued use of the App after any changes indicates your acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Email: development.sanctum@gmail.com

For GDPR-related inquiries, you may also contact your local data protection authority.