Privacy Policy

What Information Do We Collect?

Information you provide

We collect personal information you voluntarily provide when you register, express interest in our Services, or contact us. This includes: billing addresses, names, email addresses, usernames, and passwords.

Sensitive information we may process (with your consent or as permitted by law): financial data, personal journal entries, personal goals and life tracking data, AI conversation history, fitness and wellness data, and financial transaction data.

Payment data is handled and stored by Paddle. See their privacy notice at paddle.com/legal/privacy.

Social media login data — if you register via Google or another social provider, we receive certain profile information from that provider. See Section 7.

Information collected automatically

We automatically collect device and usage information — IP address, browser type, OS, device IDs, language preferences, referring URLs — primarily for security and internal analytics. We also use cookies and similar technologies; see our Cookie Notice.

Google API

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How Do We Process Your Information?

We process your information to provide, improve, and administer our Services, communicate with you, prevent fraud, and comply with law. Specifically:

• Facilitate account creation and authentication
• Deliver and improve our Services
• Respond to inquiries and provide support
• Send administrative and marketing communications (you can opt out)
• Fulfill and manage orders, payments, and returns
• Identify usage trends for internal analytics
• Protect our Services against fraud and abuse
• Comply with legal obligations

What Legal Bases Do We Rely On?

For EU/UK users (GDPR): We rely on Consent, Performance of Contract, Legitimate Interests, Legal Obligations, and Vital Interests as appropriate.

For Canadian users: We rely on express or implied consent, which you can withdraw at any time.

For Indian users (DPDP Act 2023): Sensitive categories such as health/medical data, medication tracking, menstrual cycle data, and mental-health journals require a separate explicit consent before processing. This consent is requested in-app at the point of enabling each feature.

When and With Whom Do We Share Your Information?

We share data only with service providers who need it to perform work on our behalf:

• AI providers — Google Cloud AI, Anthropic
• Cloud infrastructure — Google Cloud Platform, Firebase
• Payments — Paddle (Merchant of Record)
• Auth — Google Sign-In
• Analytics — Google Analytics for Firebase
• Hosting — Railway
• Rate limiting & caching — Upstash Redis
• Email — Resend
• Cookie compliance — Termly.io

We may also share information in connection with a merger, acquisition, or sale of company assets.

Do We Use Cookies?

Yes. We use cookies and similar tracking technologies to maintain security, prevent crashes, save preferences, and support basic site functions. We also use Google Analytics. Full details are in our Cookie Notice.

To opt out of Google Analytics tracking visit tools.google.com/dlpage/gaoptout.

Do We Offer AI-Based Products?

Yes. SailToFuture uses AI for insights, habit analysis, goal decomposition, finance advice, sleep coaching, and conversational features. These are powered by Google Cloud AI (Gemini) and Anthropic (Claude).

Your inputs and outputs are shared with these AI providers to deliver the features. You can opt out of AI processing at any time via your account settings or by contacting us.

How Do We Handle Social Logins?

If you register or log in via a social media account (e.g. Google), we receive certain profile information — typically name, email address, and profile picture. We use this only for the purposes described in this notice. We are not responsible for how the social platform itself uses your data.

Is Your Information Transferred Internationally?

Our servers are located in the United States and India. Your information may be transferred to, stored in, and processed in countries other than your own, including the US, UK, and India. We use Standard Contractual Clauses and other safeguards to protect your data during international transfers in compliance with GDPR and other applicable laws.

How Long Do We Keep Your Information?

We retain personal information only as long as necessary for the purposes in this notice, or as required by law. We will not keep your data for longer than 12 months after account termination unless a legal obligation requires otherwise. When no longer needed, data is deleted or anonymised.

How Do We Keep Your Information Safe?

We implement appropriate technical and organisational security measures including encryption at rest and in transit, field-level encryption for sensitive data, and access controls. However, no electronic transmission over the internet is 100% secure. Transmitting personal information is at your own risk; you should only access our Services in a secure environment.

Do We Collect Information From Minors?

No. We do not knowingly collect data from or market to children under 18 years of age. If you believe we have collected data from a minor, contact us at privacy@sailtofuture.com and we will promptly delete it.

What Are Your Privacy Rights?

Depending on your location, you may have the right to: access a copy of your data, correct inaccuracies, request deletion, restrict or object to processing, and data portability. For EEA/UK/Switzerland users these rights arise under GDPR/UK GDPR.

To exercise your rights: submit a data subject access request or email privacy@sailtofuture.com.

You may also withdraw consent or unsubscribe from marketing at any time via your account settings or the unsubscribe link in our emails.

Account termination

Contact us or use in-app settings to delete your account. We will deactivate it and remove your data from active databases, though we may retain some data to prevent fraud or comply with legal requirements.

Controls for Do-Not-Track

Most browsers include a Do-Not-Track (DNT) signal. No uniform standard for recognising DNT has been finalised, so we do not currently respond to DNT signals. If a standard is adopted that we must follow, we will update this notice accordingly.

Do United States Residents Have Specific Rights?

Residents of California, Colorado, Connecticut, Virginia, Texas, and other US states with privacy laws may have additional rights, including: right to know, right to access, right to correct, right to delete, right to a copy, right to non-discrimination, and right to opt out of the sale or sharing of personal data.

To exercise these rights, submit a data subject access request or email support@sailtofuture.com.

Do Other Regions Have Specific Rights?

Australia

We process your information under Australia's Privacy Act 1988. If you believe we have unlawfully processed your information, you may lodge a complaint with the Office of the Australian Information Commissioner.

India (DPDP Act 2023)

Users in India have rights under the Digital Personal Data Protection Act 2023, including the right to access, correct, and erase personal data, and to withdraw consent. Sensitive personal data (health, financial, biometric) requires explicit consent obtained prior to collection. Contact our Data Protection Officer at privacy@sailtofuture.com.

Do We Make Updates to This Notice?

We may update this Privacy Notice from time to time. The updated version will carry a revised "Last updated" date at the top. For material changes, we will notify you by email or in-app notification. We encourage you to review this notice periodically.

How Can You Contact Us?

How Can You Review, Update, or Delete Your Data?

Based on applicable laws you may have the right to review, correct, or delete the personal information we hold about you. Submit a data subject access request or email privacy@sailtofuture.com.