HeadRest
Privacy Policy
Last Updated: September 17, 2026
Introduction
HeadRest ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our meditation mobile application ("App").
Please read this Privacy Policy carefully. By using the App, you agree to the collection and use of information in accordance with this policy.
Information We Collect
Information You Provide
- Account Information
- Email address and basic profile details shared through Google Sign-In or Sign in with Apple
- No app password is stored by HeadRest
- Meditation Context
- The text you enter describing your emotional situation
- This is used solely to generate personalized meditations
- Your mechanism selections (the option you choose when asked a follow-up question)
- Journal Entries
- Personal text entries written after meditations
- Stored until you delete the entry or your account
- Push Notification Device Tokens
- Used solely to deliver meditation-ready alerts
- Removed when you delete your account or uninstall the App
- Usage Data
- Duration preferences (5 or 15 minutes)
- Meditation history (which meditations you've generated)
- Saved or bookmarked content identifiers, if you use those features
- Free usage meter status and Plus access state
- Purchase and Entitlement Information
- App user ID, product identifiers, subscription status, renewal or expiration status, refund or revocation status, offer eligibility, and store transaction references provided by the Apple App Store, Google Play, or RevenueCat
- We do not receive or store your full payment card details
Information Collected Automatically
- Device Information
- Device type and operating system version
- App version
- Product Interaction Analytics
- Screen views and navigation patterns
- Feature usage (e.g., which meditations you play, how long you listen, creation flow steps completed)
- Paywall views, purchase or restore flow events, content lock/unlock events, and Wisdom or catalog content interactions
- Session data (app opens, backgrounding, foregrounding)
- These events are linked to your user ID to provide personalized insights and are not used for cross-app tracking or advertising
- Speech-to-Text
- If you use microphone input, your voice is processed by your device's speech recognition provider, such as Apple Speech on iOS or Android/Google speech recognition on Android, depending on your device and settings
- HeadRest does not store raw microphone audio or send raw microphone audio to HeadRest servers
- The resulting transcription is placed into the text input and is sent to our servers only if you submit it as meditation context
How We Use Your Information
We use your information to:
- Provide the Service
- Authenticate your account
- Generate personalized meditation scripts based on your context
- Store and retrieve your meditation library
- Verify Plus access, restore purchases, enforce free usage limits, and provide locked or unlocked content based on your entitlement state
- Improve the Service
- Analyze aggregate usage patterns
- Fix bugs and improve performance
- Develop new features
- Safety & Compliance
- Detect and prevent misuse
- Comply with legal obligations
Third-Party Services
We use the following third-party services to provide our App:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Authentication & Database | Email, user ID, meditation metadata |
| Anthropic (Claude) | AI-powered story selection and script generation | Your context text (anonymized, not linked to your identity) |
| ElevenLabs | Text-to-speech audio generation | Meditation script text (anonymized) |
| Cloudflare R2 | Audio and image file storage | Meditation audio files, Wisdom audio files, image assets, and signed media access URLs |
| Sentry | Error tracking | Crash reports, error logs (no personal content) |
| PostHog (EU Cloud) | Product analytics | Feature usage events, screen views, linked to user ID |
| OpenAI | Content moderation API | Your context text (anonymized, not linked to identity) |
| OAuth sign-in and Android speech recognition services | Email, profile name, and voice input/transcription data if you use microphone input on Android | |
| Google Analytics for Firebase / Google Ads | App usage and advertising measurement | App-instance identifiers, device and app information, approximate location derived from masked IP addresses, app opens and engagement, and purchase/subscription events and product identifiers. We do not send your HeadRest account ID, name, email, journal entries, or meditation context to this integration. |
| Apple | Sign in with Apple and iOS speech recognition services | Email, name (as you choose to share), and voice input/transcription data if you use microphone input on iOS |
| RevenueCat | Subscription and purchase entitlement management | App user ID, purchase status, product identifiers, subscription events |
| Apple App Store / Google Play | In-app purchase processing | Purchase records, subscription status, refunds, billing country/region as provided by the store |
| Upstash | Job queue (Redis) | Job metadata (emotion, duration — no personal text) |
| Railway | Backend hosting | Server logs (truncated user IDs only) |
| Meta Platforms | Advertising measurement (via RevenueCat) | App lifecycle events (install, trial start, subscription purchase) with an anonymous, app-scoped identifier only |
Advertising Measurement
To understand whether our advertising works, we share a limited set of app lifecycle events — such as app installs, free-trial starts, and subscription purchases — with Meta Platforms via our subscription provider (RevenueCat). These events include an anonymous, app-scoped identifier and never include your name, email, journal entries, or anything you write or say in HeadRest. We do not use Apple's advertising identifier (IDFA) and we never ask the App Tracking Transparency prompt; Meta processes these events in aggregated form for ad measurement. You can opt out of this processing by contacting support@tryheadrest.com.
We also use Google Analytics for Firebase, linked to Google Ads, to measure app installs, engagement, and free-trial or subscription activity. Firebase uses a pseudonymous app-instance identifier and automatically collects technical device/app information, approximate location derived from masked IP addresses, and certain purchase or subscription events. HeadRest separately records a confirmed free-trial start with its product identifier. We do not pass your HeadRest account ID, email, name, journal entries, meditation context, or other personal content to this integration. On iOS, this integration does not collect IDFA or IDFV; advertising storage and ad personalization are disabled, and advertising user-data processing is restricted in regions covered by Google's EU consent policy.
Google may process this measurement data outside the European Union, under its applicable data processing terms. Its server-side retention is separate from HeadRest's local records used to prevent duplicate trial events. Deleting your HeadRest account clears those local records and resets local Firebase analytics data; it does not itself erase events already sent to Google. Contact support@tryheadrest.com for questions or requests about measurement data. Learn more in Firebase's privacy and security information.
Important: When your context text is sent to AI services (Anthropic) for meditation generation, it is:
- Not linked to your email or identity
- Not stored permanently by the AI service
- Used only to generate your meditation in that session
Data Retention
| Data Type | Retention Period |
|---|---|
| Account information | Until you delete your account |
| Meditation audio files | Until you delete your account |
| Journal entries | Until you delete the entry or your account |
| Context text | Processed and discarded after meditation generation |
| Purchase and entitlement records | Retained as needed for purchase support, fraud prevention, accounting, legal, and store-policy obligations |
| Device tokens | Until you delete your account or uninstall the App |
| Error logs | 30 days |
| Product analytics | Until you delete your account (stored in PostHog EU) |
Your Rights
You have the right to:
- Access - Request a copy of your personal data
- Correction - Request correction of inaccurate data
- Deletion - Request deletion of your account and all associated data
- Portability - Request your data in a machine-readable format
To exercise these rights, contact us at: support@tryheadrest.com
Data Deletion
To delete your account and all associated data:
- Open the App
- Go to Settings
- Tap "Delete Account"
- Confirm deletion
Alternatively, email us at support@tryheadrest.com with your account email.
Upon deletion:
- Your account and all personal data are immediately and permanently deleted
- Your meditation audio files are immediately deleted from our servers
- Your journal entries, meditation history, and device tokens are immediately removed
- Your analytics data is deleted from PostHog (EU-hosted) via their deletion API
- Limited purchase, entitlement, refund, and transaction records may be retained where needed for legal, accounting, fraud-prevention, store-policy, or dispute-resolution purposes
- Anonymized aggregate data may be retained for service improvement
Security
We implement appropriate security measures including:
- Encryption in transit (HTTPS/TLS)
- Encryption at rest for sensitive data
- Secure authentication through Google Sign-In and Sign in with Apple
- Regular security audits
However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
Children's Privacy
HeadRest is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.
Crisis Content
HeadRest includes automatic detection of crisis-related content. If you express thoughts of self-harm or suicide:
- The App will not generate a meditation
- You will be shown crisis support resources including hotline numbers
- No meditation or audio is created for this content
We do not store or report crisis content. This detection is solely to provide you with appropriate resources.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Updating the "Last Updated" date
- Displaying a notice in the App
Your continued use of the App after changes constitutes acceptance of the updated policy.
Contact Us
If you have questions about this Privacy Policy, contact us at:
Email: support@tryheadrest.com
Mailing Address:
Aaditya Menon
Ground Floor, 297, 15th B Main Road
Sector 3 HSR Layout
Bangalore 560102, Karnataka, India
California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to Know - What personal information we collect and how it's used
- Right to Delete - Request deletion of your personal information
- Right to Non-Discrimination - We will not discriminate against you for exercising your rights
To exercise these rights, email us at support@tryheadrest.com.
European Privacy Rights (GDPR)
If you are in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):
- Legal Basis: We process your data based on your consent (when you use the App) and our legitimate interests (to provide and improve the service)
- EU Product Analytics Hosting: Our PostHog product analytics are hosted in PostHog EU Cloud (Frankfurt). This does not apply to every service: Google/Firebase advertising measurement and other providers may process data outside the EU, as described above.
- Data Protection Officer: Contact support@tryheadrest.com
- Supervisory Authority: You have the right to lodge a complaint with your local data protection authority