Privacy Policy for The Sanctuary

Last Updated: October 18, 2026

The Sanctuary ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and disclose information when you use our application on the web and on Android, our website at sanctuary.nicolla.ai, and our social media profiles.

1. Information Collection

The Sanctuary is designed to be a private experience.

• Main Content: All affirmations are stored locally within the application.
• User Progress: Your progress (unlocked affirmations, favorites, settings) is stored exclusively on your device using localStorage. We do not have access to this data.
• AI Age Confirmation: If you confirm that you are at least 18, the application stores that confirmation flag on your device using localStorage.
• Active AI Session: The mood or topic text you enter, the generated response, its response type, and language are stored on your device using sessionStorage. This lets an active support session survive navigation or a reload. The data remains until you reset the support session or the browser/WebView session ends.
• No Accounts: We do not require registration or ask for direct identifiers. Information you choose to enter in the optional AI feature is described below.

2. Optional AI Support Feature

The optional "Personalized Support" feature is available only after you confirm that you are at least 18. When you deliberately start it, the mood or topic text you enter is sent over HTTPS through our proxy hosted on Google Cloud Run to Google's Gemini service to generate a response. Google processes the submitted text and generated output under the Gemini API Terms and the privacy and data-processing terms applicable to the configured service and region. Do not enter sensitive personal data, account credentials, medical records, exact addresses, or other information you would not want to send to an AI service.

Our proxy processes the prompt and generated response transiently and does not store or log their content, except when you deliberately report a response (see below). To verify the Android app and prevent abuse, Google Firebase App Check / Play Integrity processes an attestation token. For fair-use limits, our proxy stores counters associated with a random installation identifier and a one-way hash of the requesting IP address. Counters are not linked to prompt or response content and include an expiry timestamp; deletion timing depends on the configured Firestore TTL and retention controls.

AI responses may be incomplete or incorrect and are not medical care, therapy, or emergency assistance. If you are in immediate danger, contact local emergency services or a trusted person. If you choose "Report response", the app sends the reported response, its response type, your app language, the time of the report and any optional comment you write to our proxy, where it is stored so that a person can review it. The mood or topic text you entered is not part of the report, and the report carries no account, device, or advertising identifier. Reports are kept for up to 180 days and are then deleted automatically. If the report cannot be sent, the app offers to send it from your email app instead; that message is sent only when you decide to send it.

3. Third-Party Services (Advertising)

To keep the application free, we use Google advertising services:

• Google AdMob (Android) / Google AdSense (our website and the web version of the app): These services may collect and use data such as your device's advertising identifier, IP address, cookies, and app/usage activity to show personalized or non-personalized advertisements.
• In the Android app, ads appear as a banner, as rewarded videos that you choose to watch (for example to open an AI support session or an extra affirmation from a theme), and occasionally, at most once a day, as a full-screen ad when you move from today's affirmation to your library.
• Where the law requires it, for example in the European Economic Area, the United Kingdom and Switzerland, a consent message from Google asks for your choice before ads use your data for personalization.
• Google's use of advertising identifiers and cookies enables it and its partners to serve ads based on your activity. See how Google uses information from sites or apps that use its services.
• You may opt out of personalized advertising in your device settings or at Google Ads Settings.

4. On-Device Storage and Cookies

We use localStorage for functional data, including settings, affirmation progress, the AI age-confirmation flag, local usage safeguards, and earned access to an AI session. We use sessionStorage for the active AI mood/topic and generated response until you reset that support session or the browser/WebView session ends. Third-party advertisers may use cookies or device identifiers as described in Section 3.

Optional app analytics (Android)

If you choose Allow analytics in the app, we use Google Analytics for Firebase to understand visits and return visits, screens and features used, sharing actions, ad delivery, and whether an AI request succeeds. Analytics is disabled until you agree. Declining does not restrict any feature. This choice is separate from advertising consent, and you can change it in Settings at any time.

Firebase associates usage events with a pseudonymous app installation identifier and processes app version, device/OS information, approximate region, timestamps, session information and available installation attribution. We do not send affirmation text or IDs, your saved library, your AI input, generated answers, response classifications, report comments, email addresses, or the proxy's installation identifier to Analytics. This is pseudonymous measurement, not anonymous data. Firebase Analytics advertising-ID collection and advertising personalization are disabled; AdMob's separate processing is described in Section 3.

Your analytics choice and daily measurement counters are stored locally and excluded from Android backup. Turning analytics off stops subsequent collection, clears the SDK's local analytics data and resets its installation identifier. It does not delete events already received by Google. Those events are retained according to the Analytics property's configured retention and Google's processing terms. Analytics data is processed by Google over encrypted connections; see Google's privacy policy. The web version of the app does not load Firebase Analytics.

Website analytics (optional)

Our website may use Google Analytics to count visits and to see which pages and languages are read. In the European Economic Area, the United Kingdom and Switzerland it starts with all analytics and advertising storage denied (Google Consent Mode), so no analytics cookies are set unless you agree in the consent message. Until then, Google may receive cookieless signals, such as that a page was viewed, which do not use cookies or identifiers stored on your device. Elsewhere, analytics cookies are used unless your browser sends a Global Privacy Control signal, which we treat as a refusal. Links in our social media posts carry campaign tags, such as the platform and the language, so that we can tell which channels people come from. These tags do not identify you.

5. Our Social Media Profiles

We publish the daily affirmation on social media platforms such as Instagram, Facebook, Threads, TikTok, YouTube, Pinterest, Bluesky, Mastodon, Telegram and X. When you view, follow or comment on our profiles, the platform processes your data under its own privacy policy. Our automated publishing reads statistics about our own posts (views, likes, comments and shares) and checks public comments on our posts for words that may mean someone needs support, so that a person can reply. We do not store the text of comments, build profiles of the people who comment, or send comments to AI services.

6. Data Security and Retention

Data you store in the app stays on your device and is under your control. You can clear it at any time from your device's app storage settings, and it is removed when you uninstall the app. If you have enabled Android Auto Backup for your device, Android may include app data in your own Google account backup and restore it when you reinstall; that backup is controlled by you and your device settings, and we have no access to it. An active AI support session — the text you entered and the response it generated — is excluded from that backup and stays on the device where it was created.

Information transmitted for the optional AI feature, optional analytics or advertising is sent over encrypted connections (HTTPS) and handled by Google under its own privacy terms. Apart from the fair-use counters and the reports described in Section 2, we do not store your data on our own servers. Optional analytics is stored and processed by Google as described in Section 4.

7. Age Requirements and Children's Privacy

The optional AI Support feature is for adults aged 18 or older and requires an in-app age confirmation. The Sanctuary is not directed to children, and we do not knowingly collect personal information from children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes are posted on this page with an updated date.

9. Contact Us

If you have any questions about this Privacy Policy, contact us at nicolla@nicolla.ai.