This privacy policy explains how MantraStream collects, uses, and protects personal data when you explore adaptive affirmation audio. We keep things transparent so you can decide what to share, understand how third-party AI services contribute to your experience, and exercise your rights with confidence.
Privacy Policy Highlights
Data we collect
- Account details: Email address and authentication identifiers managed through our authentication provider when you sign up or log in.
- Subscription status: Our billing provider shares plan state (active, trialing, past due) so we can grant or revoke access to paid features; we do not store full card numbers.
- Affirmation inputs: Goals, topics, and preferences you enter in the app. These remain tied to your account to personalize the stream.
- Usage diagnostics: Timestamps, queued affirmation counts, and error logs; we sample these to maintain uptime and combat abuse, not to build advertising profiles.
How we use your information
- Generate scripted affirmations through third-party AI partners and convert them to speech with approved text-to-speech providers you select.
- Deliver onboarding previews and maintain a synchronized audio queue across devices.
- Process billing, trials, refunds, and receipts through a secure billing provider.
- Send service communications (e.g., billing notices, major policy updates) via email.
- Produce aggregated analytics about feature adoption; we do not sell or rent personal data.
Legal bases
We process personal data to fulfill our contract with you (delivering the app), to comply with legal requirements (e.g., accounting, fraud mitigation), and with your consent when you opt into optional emails or experiments.
Data Sharing
Service providers
- Authentication provider: Manages secure login, session tokens, and hashed credentials.
- AI text providers: Receive goal prompts without names or contact details to generate affirmation text solely for your requests.
- Text-to-speech providers: Convert curated text into audio. We only transmit the text needed to produce each clip you initiate.
- Billing provider: Processes payments, maintains subscription status, and issues invoices on our behalf.
- Logging and monitoring tools: We may use privacy-conscious monitoring (e.g., server-side logs) to keep MantraStream reliable; logs rotate and are access-controlled.
We require each third-party provider to implement appropriate safeguards, and we share the least amount of data necessary to fulfill the service you request. Providers use your information only to process those requests and must not repurpose it.
Legal disclosures
We may disclose information if compelled by law, court order, or lawful request from public authorities. If a request is overly broad, we contest it where feasible.
Data Retention and Security
Retention timelines
- Account identifiers and subscription records are retained while you maintain an account and up to 90 days after closure for financial reconciliation.
- Generated affirmation text and audio metadata remain for up to 30 days to support replays and offline caching; cached audio in your browser can be cleared anytime from settings.
- Diagnostic logs rotate on a 30-day schedule unless extended to investigate abuse or security incidents.
Safeguards
- Encryption in transit via HTTPS everywhere the service is available.
- Role-based access controls restrict staff access to production data.
- Secrets such as API keys remain on the server; we never ship them to the browser or mobile clients.
Your Choices and Rights
Manage or delete data
- Update goals and preferences directly inside the app.
- Export or delete your account by contacting [email protected]; verified requests are fulfilled within 30 days.
- Revoke email consent from any message footer or within account settings.
Cookies and local storage
We rely on necessary cookies and local storage to keep you signed in and to cache audio so playback survives brief outages. We do not run third-party advertising or social tracking scripts.
Children’s privacy
MantraStream is not directed to individuals under 16. If you believe a minor has provided personal data, contact [email protected] so we can delete it promptly.
Cross-Border Data Transfers
We host infrastructure in the United States. When data moves to providers in other regions, we rely on contractual safeguards such as Standard Contractual Clauses or equivalent legal mechanisms to protect your information.
Updates to This Policy
We review this privacy policy at least annually. Significant changes trigger an email notice or in-app banner with the effective date so you can review updates before they apply. The revision date below indicates the latest version.
Effective date: October 11, 2025
For questions about this privacy policy or data practices, email [email protected].