Privacy Policy

Privacy Policy for ReFrame (US / California Edition)

Last Updated: Apri 3, 2026

1. Introduction

Welcome to ReFrame. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our mobile application. We are committed to protecting your personal information and your right to privacy, especially regarding the sensitive reflections and practice scenarios generated within our app.

2. Information We Collect

Under the CCPA/CPRA, we collect the following categories of personal information:

• Identifiers & Account Data: Name (first, last, preferred), email address, and account passwords. (Note: Under CPRA, an account log-in combined with a password is considered Sensitive Personal Information).

• Professional or Employment-Related Information: Industry, job function, experience level, and people-manager status.

• Protected Classifications (Demographics): Gender and cultural tuning preferences.

• User-Generated Content & Conversations: * Practice Content: Scenario metadata, your text/voice responses, and AI coaching summaries.

  • Reflection Content: Situation text, full conversation histories, and recommended skills. (Note: Because this is free-text, you may voluntarily disclose Sensitive Personal Information, such as mental health status or racial/ethnic origin, within these reflections).

• Internet or Other Electronic Network Activity (Telemetry): Event logs, session IDs, page paths, browser/device user agents, heartbeat timestamps, and session durations.

3. How We Process Your Data & AI Usage

ReFrame utilizes Artificial Intelligence to power our coaching and reflection features.

• OpenAI: We share your practice responses, reflection conversation history, and contextual prompts with OpenAI to generate scenarios, evaluate responses, and create coaching summaries. OpenAI acts as our Service Provider. OpenAI does not use this information to train their models.

4. Sharing with Third-Party Service Providers

We do not sell your personal information. We share your information solely with service providers for business purposes:

• Supabase: Provides our secure database, file storage, and authentication (login/session handling).

• OpenAI: Processes text inputs to generate app features (as detailed above).

• Google: Facilitates secure OAuth sign-in (if you choose to log in via Google).

5. Local Storage, Cookies, and Tracking

We use local storage mechanisms to keep you logged in and capture diagnostic data:

• Web: We use localStorage for authentication tokens, session tracking (app_session_data), and temporary drafts of your app feedback. We also use a UI preference cookie (sidebar:state).

• Mobile: We securely store authentication tokens using SecureStore (with an AsyncStorage fallback).

6. Internal Admin Access

To maintain safety, provide customer support, and improve our product, authorized ReFrame administrative personnel have access to backend dashboards. This access includes the ability to review user profiles, telemetry events, and user-generated content (including practice attempts and reflection conversation transcripts).

7. Your Privacy Rights (Including California CCPA/CPRA Rights)

If you are a resident of California, you have specific rights regarding your personal information:

• Right to Know & Access: You can request a data export from your profile screen, which currently includes your profile data and practice sessions. (Note: Full telemetry, debriefs, and admin feedback are not currently included in the automated export but can be requested by contacting us).

• Right to Delete: You can delete your account via the app. Important limitations: While this removes your account and auth profile from our active database, anonymized app feedback may remain. Furthermore, conversation data already processed by our AI provider (OpenAI) is subject to their independent retention and deletion policies.

• Right to Correct: You may update your profile information at any time within the app settings.

• Right to Limit Use of Sensitive Personal Information: You have the right to limit how we use your sensitive data (like account login credentials or gender) strictly to the operational necessity of providing the ReFrame service.

• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Inactive account data is purged after 90 days.

9. Contact Us

If you have questions or wish to exercise your rights, please contact us at: support@humanize-consultancy.com